Security at Croft
Your money is personal. We protect it that way.
Croft sees your balances and transactions so it can plan your paycheck. It never sees your bank password, and it can't move money out of your bank.
Four promises, in plain words
We never see your bank password
You sign in on your bank's own screen, through Plaid. Croft only gets a key that lets it see balances and transactions, and that key is locked with AES-256 encryption.
Croft can look, not touch
Croft can't move money out of your bank, make payments from your accounts or open accounts. When it says "pay $224 extra", you make that payment yourself, at your bank.
We never sell your data
Not to advertisers, not to lenders, not to anyone. Croft is paid for by its members, and that's the whole business.
A second step, every time it matters
Before any bank connects, Croft asks for a code by text, a passkey or an authenticator app. So even someone with your email can't get to your accounts.
What happens when you connect a bank
- You sign in on your bank's screen, inside Plaid's window. Croft never sees what you type.
- You choose which accounts Croft adds.
- Croft gets a view-only key. You can take it back any time from Accounts, or at your bank.
Plaid's own page explains how it handles your data: plaid.com/how-we-handle-data
The details, if you want them
Locked on the way, locked at rest
Everything between your device and Croft travels over HTTPS, and your bank key is stored with its own layer of AES-256 encryption.
AI, only with your OK
Ask Croft and setup use an AI service from Anthropic. It gets only what it needs to answer you, and Anthropic's terms say it may not train its models on it. Turn it off any time in Settings.
Support access is your choice
If you need help, our team can see your Croft screens, read-only, for 30 minutes at a time, and every visit is logged. Don't want that? Turn it off in Settings › Privacy & data.
Leave whenever you like
Settings › Privacy & data › Delete my account removes your data and disconnects your banks at Plaid. Messages you've sent us are kept unless you ask us to delete them too, as our Privacy Policy explains. You don't need to email anyone.
Honest about the limits
No system is perfectly secure, and we won't pretend otherwise. If you think something's wrong with your account or with Croft, tell us and we'll look into it right away.
Report a security concern: security@bluequanta.io
The full detail is in our Privacy Policy.