Bank credentials stay with Plaid
Granite uses Plaid to connect supported financial institutions and does not receive or store the login credentials you use with your bank.
Security at Granite
Financial security should be understandable
Granite is designed to use the financial context required for your budget while keeping access bounded, visible, and under your control.
The short version
- Granite does not receive your bank password.
- Your data is not sold.
- AI and assistant access has explicit boundaries.
- You can disconnect accounts and request deletion.
Protected in transit
Granite uses HTTPS/TLS when information moves between supported clients and services.
Scoped assistant access
Supported assistant connections require authorization and only receive the permissions you approve.
Deletion controls
You can disconnect financial institutions and request deletion of your Granite account and associated data.
Protection in layers
From connection to everyday access
Security is not one badge or vendor. It is a series of boundaries covering how information enters Granite, where it is used, and how you control that access.
01
Bank connections
Granite never receives your bank password
Granite uses Plaid to connect supported financial institutions. The connection can provide the financial information needed for Granite features, while the credentials used at your institution are not provided to Granite.
- Eligible account balances and transaction activity can be used to calculate budgets, forecasts, and spending insights.
- Connection status is monitored so Granite can tell you when an institution needs attention.
- You can reconnect or remove a linked financial institution from Granite.
02
Data protection
Purposeful access to sensitive context
Granite uses managed authentication, database, and application infrastructure to operate the service. Access to production information is limited to people and services that need it to provide, secure, and maintain Granite.
- HTTPS/TLS protects supported data flows in transit.
- Authentication and application data are handled through managed backend infrastructure.
- Granite does not sell personal information.
03
Account and device access
Your device can add another layer
On supported phones, Granite can use Face ID, Touch ID, fingerprint, or device biometrics as an optional way to protect access to the app.
- Biometric matching is performed by the supported device rather than Granite receiving your fingerprint or face scan.
- Biometric access uses device-bound keys and a protected local session marker.
- If the device biometric set changes, Granite can require another password sign-in.
04
AI and assistant access
Optional processing with visible boundaries
Granite can provide deterministic calculations without external AI processing. When an AI-assisted feature is enabled, Granite sends the prompt and minimum relevant context needed to provide the requested explanation.
- Bank login credentials are never included in AI requests.
- Supported assistant integrations use OAuth permissions that you review before connecting.
- Connections can be reviewed or revoked, and Granite keeps limited activity records for security and transparency.
Your controls
Access should not be all or nothing
Granite provides separate controls for analytics, optional AI processing, connected institutions, assistant permissions, and account deletion.
Analytics choice
Granite loads optional website analytics only after you accept the analytics preference.
External AI choice
Where available, external AI processing can be enabled or disabled from your Granite settings.
Connection control
Linked financial institutions can be reconnected when needed or removed from Granite.
Account deletion
Deletion can be requested through Granite’s deletion flow or by contacting support.
Security questions
Clear answers before you connect
This page explains Granite’s product approach. The Privacy Policy contains the full description of data collection, processing, retention, and legal rights.
Does Granite store my bank username or password?
Granite uses Plaid to connect supported financial institutions and does not receive or store the login credentials you use with your bank.
What financial information can Granite receive?
Depending on the institution and connection, Granite may receive eligible account information such as balances, transactions, merchant names, amounts, and categories. Granite uses this information for the budgeting, forecasting, and insight features you request.
Does Granite sell personal or financial information?
Granite does not sell personal information. Information may be processed by service providers that help operate features such as bank connections, infrastructure, analytics you have accepted, notifications, and optional AI-assisted experiences.
Can an AI assistant access all of my Granite data?
Supported assistant connections require authorization and are limited by the permissions granted to that connection. Available tools can also depend on subscription and Granite settings.
Can I delete my Granite account and data?
You can request deletion of your Granite account and associated data. Granite’s Privacy Policy describes the deletion timeline and limited retention exceptions.
Questions or concerns?
Talk directly with Granite
Contact us if you have a privacy question, need help removing a connection, or want to report a potential security issue.