Security & Privacy
How Thermal protects your data.
Everything below is true in the product today: what’s encrypted, how bank connections work, what you can export or delete yourself, and every company that touches your data.
Encrypted at rest
AES-256 on every byte of sensitive data
Your data, your call
Export everything or delete it anytime
Never sold or shared
Your financial data stays yours. Period.
Cancel or switch anytime
No contracts, no lock-in, no questions
Encryption & Access
Encrypted in transit, encrypted at rest
The same handful of controls apply to every byte of financial data Thermal holds.
AES-256 at rest, TLS in transit
Sensitive data is encrypted with AES-256 while it's stored, and every connection between your browser and our servers runs over TLS.
Bank credentials never reach us
Your login for Chase, Fidelity, or any other institution is entered directly into Plaid's interface. Thermal never sees it and never stores it on our servers.
Production access is restricted and audited
Access to the systems that hold your data is limited to what's needed to operate the service, and that access is audited.
Bank Connections
Plaid handles the connection. You keep control.
Read-only, always
Thermal can see balances, transactions, and holdings. It cannot move money, initiate a payment, or make any change at your bank. The same promise you see in the connect flow (“Read-only · Revoke any time”) is enforced end to end, not just written on the screen.
12,000+ institutions, one connection layer
Bank connections run through Plaid, the same infrastructure behind Venmo and Robinhood, so linking an account works the same way it does in apps you already trust.
Disconnect whenever you want
Disconnecting a connection from Settings → Accounts stops Thermal from pulling any new data immediately. Your existing history stays put until you choose to delete it.
Your Rights
Export it. Delete it. Leave whenever you want.
Full export, two formats
Download your entire account (accounts, transactions, budgets, investments, insights) as a JSON file from Settings, or export just your transactions as CSV whenever you need a spreadsheet.
Self-serve deletion, 30 days
Delete your account from Settings and Thermal deletes your financial data, account information, and associated records within 30 days. No support ticket required.
No contracts, cancel anytime
Cancel your subscription at any time from account settings. There's no retention flow standing between you and the cancel button.
Account Security
Lock your account down the way you want
Passkeys
Sign in with Face ID, Touch ID, or Windows Hello instead of typing a password.
Two-factor authentication
TOTP-based 2FA works with any authenticator app (Google Authenticator, Authy, 1Password), plus one-time backup codes if you lose your device.
Session management
See every device signed in to your account and revoke any of them, one at a time or all at once.
Strong passwords
Passwords require at least 12 characters, with a strength check as you type.
All of it lives under Settings → Security.
Sub-processors
Every company that touches your data. No more, no less.
We don't sell your personal information to third parties, and we only share data with the vendors it takes to run Thermal.
Plaid
Bank connections and financial data retrieval.
Stripe
Payment processing. We never see your full card number.
MarketStack
Market data for securities you hold. Only ticker symbols are sent, never your account credentials or full holdings.
Convex
The database and backend infrastructure that stores your data.
Vercel
Application hosting and delivery.
Resend
Transactional email delivery.
Grafana Faro
Frontend performance metrics and error monitoring.
Read the full privacy policy for exactly what each vendor receives, or the case for not selling your data in the first place.
Something look wrong? Tell us.
For privacy or data requests, security questions, or anything else about how your data is handled, reach out through the contact page.
Contact usTry all of it, free, for 14 days
The trial includes every feature on this page at the Pro level. No credit card to start.
14 days free · Full Pro access · No credit card