Your money is safe here
You are about to show MarginSheet™ everything. That is a lot to ask, so here is exactly how it works, in plain language.
MarginSheet can look. It cannot touch.
The connection to your bank is read-only. We can see what came in and what went out, so we can keep your books. We cannot move a dollar, pay a bill, or transfer anything, anywhere, ever.
This is not a promise we are making. It is how the connection is built. Even in the worst case anyone could imagine, there is no path from MarginSheet to your money.
How this works
The connection is created with read-only scopes: the balances and the transactions on the accounts you picked. No payment scope and no transfer scope is ever requested, so the access MarginSheet holds cannot authorize a movement of money. There is no privileged version of it to escalate to, because a payment scope was never part of the connection in the first place.
Your bank login never comes to us.
When you connect an account, you sign in on a screen that belongs to Plaid, not to MarginSheet. Your username and password go straight from that screen to your bank. We are not in the middle of it, and there is nothing for us to store.
You may already have used Plaid without knowing the name. They are the connection behind Venmo, Robinhood, Chime, and most of the banking apps on your phone. Thousands of banks work with them, and they are independently audited every year for exactly this.
What we get back is permission to read the accounts you picked. Nothing else. You can switch it off from your bank, or from MarginSheet, whenever you want.
Your household's books belong to your household.
Nobody outside your household can see them. Not another MarginSheet customer, not by accident, not because somebody made a mistake in our software.
That is not left to careful programming. It is built into the place your data is stored, so a mistake in our app cannot show your books to anyone else. The system refuses before the mistake can happen.
Inside your household, everyone sees the same books. That is on purpose: a household's money is shared, and MarginSheet does not keep secrets between the people in it. We tell people that before they join, not after.
How this works
Isolation is enforced by the database, underneath the application, rather than by the queries the application writes. Every table holding household data carries a policy that filters it to one household, and the role the application connects as holds no privilege to bypass that policy. A query that forgets to filter returns nothing at all rather than returning somebody else's books.
The same mechanism covers the credential that reads your bank. It is stored where the application role has no read privilege, so the running app cannot fetch it even if it asks.
We check this by attacking it. The controls are deliberately broken in testing, with the filter removed and the app told to read what it should not, to confirm the database still refuses.
The safest data is the data nobody has.
Most of protecting your information is choosing not to collect it. Here is what MarginSheet deliberately does not keep.
No passwords.
MarginSheet does not have passwords at all. You sign in with Face ID, or with a link we email you. There is no password to forget, to reuse, or to be stolen from some other company's breach.
We do not track where you are.
No IP addresses, no record of where you signed in from.
We do not record your screen.
Some apps do, to study how people use them. Yours would be a recording of your bank account.
We do not follow you around the internet.
No advertising trackers, no pixels, no data sold to anyone, for any reason.
There are no ads and there never will be.
MarginSheet makes money one way: the subscription you pay. There is no second business quietly running in the background, which means there is nothing pulling us toward using your information for something else.
How this works
These are enforced rather than agreed to. Every privilege on the account table's password column is revoked, so nothing the application runs can read it or write to it, and there is no code path that could start storing one by accident.
Addresses are dropped by the database itself. A trigger clears the field as the row is written, so an address is discarded at the moment of the write rather than collected and deleted on a schedule afterwards.
We use a few companies to make MarginSheet work, and we will name every one.
Plaid connects your bank accounts. Stripe handles your payment card, so we never see the number. Anthropic provides the AI that MyKeeper™ is built on. A few others handle email, text messages, and keeping the site online.
Every one of them is a company you can look up, and none of them is in the business of selling your information. The full list, and exactly what each one receives, is in our privacy policy.
We are new, and we would rather tell you that than let this page imply otherwise.
Larger companies in this category carry a certification called SOC 2, where outside auditors spend months checking that a company's security actually works the way it says. We do not have it yet. It takes most of a year to earn, and MarginSheet is younger than that. We are working toward it.
Until then, everything on this page is our own account of our own work. What we can tell you is that none of it is a plan or an intention. It is all built, and we test it constantly by deliberately trying to break it, to be sure it still stops us.
The part of this that protects your bank password, though, is not ours to prove. That is Plaid, and they are audited every year.
Found a problem?
If you find a security problem, email security@marginsheet.com and we will get back to you within one business day.