Security and privacy

Private by design.
Secure by default.

Your financial data belongs to you. Here is how we protect it, from the moment you connect a bank to the day you choose to leave.

Never sold
Your financial data is not for sale.
Never used for AI
Not shared with AI companies.
No trackers
No ads or analytics in the app.
Yours to delete
Remove everything, anytime.

Protection at every layer.

The safeguards behind every connection, sign-in, and request.

Bank connections

Linked through Plaid, with read-only access.

Institutions connect through Plaid
We never see or store your online banking password
Read-only access, so Meadowlark can’t move money
Bank access tokens are encrypted with AES-256
Disconnecting revokes our access at Plaid

Encryption

Protected in transit, at rest, and in between.

HTTPS everywhere, with TLS 1.2 or newer
Encrypted all the way to our servers, not just to the edge
Database encrypted at rest
Sensitive secrets encrypted again by our application
Your data is never cached on our network

Sign-in protection

Strong defaults, with more when you want it.

Passwords hashed with Argon2id
Two-factor authentication with an authenticator app
Email verification for every new account
Rate limits and lockouts stop repeated guessing
Email changes need approval from your current address
A password reset signs out every other session

Infrastructure

Careful foundations, kept up to date.

Every request passes through Cloudflare’s network protection
Our servers only accept traffic routed through Cloudflare
A strict Content Security Policy blocks unapproved scripts
Meadowlark can’t be embedded in other websites
Dependencies kept current and scanned for vulnerabilities
Error reports are scrubbed of financial and personal details

Your data, your call.

Financial data is shared only with the services that make Meadowlark work: Plaid, Stripe, and our cloud providers.

We never

Sell your financial data
Share your data with AI companies or use it to train models
Run ads, analytics, or tracking scripts inside the app
See or store your online banking password
Store your card number. Stripe handles payments.

You can always

Delete your account and its data, permanently
Disconnect an institution and choose whether to keep its history
See your signed-in sessions and sign any of them out
Turn on two-factor authentication
Reach a real person at hello@meadowlarkapp.com

Deleted means deleted.

When you delete your account, we erase your data rather than hide it. We also revoke our bank access at Plaid and remove your customer record at Stripe.

Who we work with.

A small set of established providers. Each receives only what it needs to do its job.

Cloudflare: Web hosting and network protection
Render: API hosting
PlanetScale: Encrypted database hosting
Plaid: Read-only bank connections
Stripe: Payments and billing
Resend: Account and security emails
Sentry: Error reports, scrubbed of personal details
Google: Optional sign-in, and analytics on our public site only

Questions?

Write to hello@meadowlarkapp.com. Report security issues to security@meadowlarkapp.com.

Private by design.Secure by default.