How we protect your data

• Your bank login never touches bnbnet. You sign in to your bank inside Plaid’s window. bnbnet only receives read-only access to transactions.
• Bank access tokens are encrypted with AES-256 and stay on our server. They’re never sent to your browser.
• Everything travels over HTTPS.
• Each host’s books are private. Every request is checked against your signed-in account, and our database tables are locked to the bnbnet server only.
• Passwords are handled by our sign-in provider and are never stored in plain text.
• Payments are handled by Stripe. We never see your full card number.
• Webhooks are verified. Messages from Plaid, Stripe and Twilio are checked for a valid signature before we act on them.
• You’re in control. Disconnect a bank, turn off texts or delete your account at any time.

Version 2026-11-05 · Last updated November 5, 2026.