A bank app lets the people who use your app link their own bank accounts: a budget tracker, a spending coach, a bill reminder. Turn it on with **Link a bank** on a live site, or ask for it when you start a project. It needs sign-in, so Syndai adds accounts first if your site has none.

## Your Plaid keys, not Syndai's

Your app links banks with **your** Plaid account, never Syndai's. Plaid gives each business its own client ID and secret, and Plaid bills you for bank links directly.

1. Create a Plaid account at [dashboard.plaid.com](https://dashboard.plaid.com/signup).
2. In the Plaid Dashboard, open Developers → Keys and copy your client ID and Sandbox secret.
3. In Syndai, add three secrets to the project: `PLAID_CLIENT_ID`, `PLAID_SECRET` and `PLAID_ENV` set to `sandbox`.

Until all three are set, the app's bank screens say bank linking is not set up yet.

## Sandbox first

A new bank app runs on Plaid Sandbox: test banks and test logins, no real money and no real accounts. Try every screen there. Plaid's Sandbox user is `user_good` with password `pass_good`.

## Going live

Plaid reviews your business before you can link real banks. Your app runs in Sandbox until you finish these:

1. **Company details.** In the Plaid Dashboard, fill in your company profile: legal name, address, website and what your app does with bank data.
2. **Use case.** Choose Transactions only. Your app reads transactions and balances. It never moves money, reads investments or checks account numbers.
3. **Plaid's agreement.** Accept Plaid's production terms for your company.
4. **Security questionnaire.** Answer Plaid's questions about how your app keeps data safe. The answers Syndai can give are below.
5. **Bank OAuth.** Some banks (Chase, Wells Fargo, Capital One and others) need your app registered with them. Plaid's Dashboard lists each bank's status; registration takes a few days to a few weeks.
6. **Switch to production.** Replace `PLAID_SECRET` with your Production secret and set `PLAID_ENV` to `production`. Republish.

Plaid's free Trial covers 10 production Items (a linked login at one bank) for teams made on or after April 15, 2026. After that Plaid bills each Item monthly.

### What to tell Plaid about where data lives

- **Hosting.** Your app's pages and data run on Cloudflare (Workers and Durable Objects), operated by Syndai. Your app's data stays in its own database, separate from every other app.
- **Encryption.** Each Plaid access token is stored encrypted with AES-256-GCM under a key derived for your app alone, and is bound to the row that holds it. The key is never stored next to the data. The token is never sent to a browser and never appears in a data export.
- **In transit.** Every connection uses HTTPS (TLS 1.2 or later).
- **Access.** Each person sees only their own linked banks and transactions. Your app's server code reads a token only to call Plaid.
- **Webhooks.** Every Plaid webhook is checked against Plaid's signature (ES256) before it is used.
- **Products.** Transactions only. No money movement, no investments, no account and routing numbers.

### What happens when data is deleted

- **A person disconnects a bank** in your app: the app removes that Item at Plaid (`/item/remove`) and deletes its rows.
- **A person deletes their account**: their Items are removed at Plaid before their rows are deleted.
- **You delete the project**: Syndai removes every Item your users linked, at once.
- **You take the app offline**: its data, and its linked banks, are kept 30 days so you can bring it back. After 30 days Syndai removes every Item at Plaid, then deletes the data. If Plaid cannot be reached, Syndai keeps trying daily and never deletes the data first, so no Item is left billing you.

## Not financial advice

A bank app can show, sort, total, forecast, budget, remind and explain money in general terms. It never tells anyone to buy, sell or hold an investment, or how to split or rebalance a portfolio. In the US, that advice needs a registered investment adviser. Ask the agent for it and it says so and stops. Every bank screen says "Not financial advice."