We earn this every day.
How Plumb keeps your data safe, what we promise about it, and how to verify those promises yourself.
Three commitments that don’t bend.
We don’t sell your data. Ever.
Not to brokers, not to advertisers, not to anyone, not for anything. The subscription is the business model, by design. If you ever read anything that contradicts this, it’s a mistake we owe you a correction on.
We collect the minimum.
If we don’t need it to give you a plan, we don’t ask for it. Every field in onboarding has a clear reason behind it. The Coach knows your finances; we don’t know your friends, your location history, or your political views.
Your data is yours.
Export everything in standard formats anytime. Delete your account in one tap; your personal data is gone within 30 days, except billing and consent records the law requires us to keep. We’re stewarding it for the year — that’s all.
Bank-grade is the floor, not the ceiling.
Plumb takes security as seriously as a bank does — but we hold ourselves to higher standards because the stakes are personal, not just regulatory.
TLS 1.3 in transit. AES-256 at rest.
All data — banking, transactions, conversations — is encrypted at every layer. Database encryption keys rotate quarterly. Backup keys are stored in a separate KMS region.
Passwordless by design.
You sign in with a one-tap magic link sent to your email — no password to create, forget, or reuse, and nothing for phishing or credential-stuffing breaches to steal. On returning visits, your device biometric (Face ID, Touch ID, or the Android equivalent) keeps sign-in quick.
Two-person production access. Always logged.
Production database access requires approval from two engineers. Every read and write is logged to an immutable audit trail. We do not allow individual employees to read user data without an audit record.
AWS, US-only. No data crosses the border.
Hosted on AWS US-East and US-West with VPC isolation. No data is replicated outside US jurisdiction. Backups encrypted, 90-day retention, restore tested quarterly.
Built to the standard — and honest about what’s still in progress.
SOC 2 Type II
Underway with our audit firm. We’ll publish reports here on issuance.
PCI DSS
Card payments run through our processors, Stripe and TailoredPay — both PCI Level 1 certified, the highest tier. We never touch card numbers — full stop.
GLBA
Gramm-Leach-Bliley Act. We treat consumer financial information as covered data and follow the Safeguards Rule.
CCPA / CPRA
California Consumer Privacy Act and Privacy Rights Act. Data subject requests handled within 45 days, no fee.
CFPB §1033
Aligned with the CFPB’s 2024 final rule on consumer data rights. Open banking is a regulated right; we treat it that way.
State privacy laws
CO, VA, CT, UT, TX, IA, and others as applicable. Where they conflict, we default to the strictest standard.
We describe the standards we build to. Independent attestations are published here when we hold them.
Every third party with access to your data, listed.
We can’t run Plumb without some help. Here’s exactly which companies process your data on our behalf, what they do, and what data they touch. They are all contractually bound to confidentiality and to use your data only for the purposes below.
| Provider | Purpose | Data scope | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, infrastructure, and email delivery | All operational data, email address, message content | US-East, US-West |
| Array | Bank account linking | Banking transactions and balances (read-only) | US |
| Stripe | Payment processing | Card numbers (we never see them) and billing | US |
| TailoredPay | Payment processing | Card numbers (we never see them) and billing | US |
| Anthropic | AI Coach inference | Conversation context, under a written agreement prohibiting use for training | US |
| Website analytics (Google Analytics via Google Tag Manager) | First-party analytics cookies only; advertising features and Google Signals disabled | US | |
| Freshdesk (Freshworks) | Customer support ticketing | Name, email address, and message content of support requests | US |
| Sentry | Error monitoring | Aggregated app errors, no PII | US |
We keep this list current and tell you by email about material changes before they take effect.
Security researchers welcome.
If you’ve found a security issue with Plumb, we want to hear about it. Safe Harbor: we will not pursue legal action against security research conducted in good faith — meaning you make a genuine effort to avoid privacy violations and service disruption, you do not access or exfiltrate more data than needed to demonstrate the issue, you report it to us within 72 hours of discovery, and you do not disclose it publicly until we have fixed it. Reach us at security@plumbfinance.com.
In scope: plumbfinance.com, *.plumbfinance.com, the Plumb iOS and Android apps. Out: third-party services (Array, Stripe, etc.), social engineering, physical attacks, denial-of-service.
Anything we haven’t covered?
Email support@plumbfinance.com. We’ll reply in plain English, by a real person.
Get in touch →