SimpleFIN, explained

What is SimpleFIN, and is it safe?

SimpleFIN Bridge is a small paid service that passes read-only bank data to the money apps you pick. Here is who runs it, how it reaches your bank, what it and MX say about security, and the risks we see.

Zedi Pro uses SimpleFIN for read-only bank sync. SimpleFIN has not endorsed Zedi; this page is our reading of their public pages.

The short answer

A reasonable pick for read-only bank data you pay for yourself. Its strength is openness, not certificates: SimpleFIN publishes its security notes and incidents, but no SOC 2 report of its own.

What SimpleFIN is

  • A protocol for read-only bank data

    SimpleFIN calls itself “like RSS for financial information”: a public spec for sharing read-only bank data, around since 2013.1,2,3

  • Bridge, the paid service

    SimpleFIN Bridge serves the protocol for banks that do not run it themselves. You link banks in Bridge, then hand an app a one-time setup token.2,4

  • Who runs it

    One Part Rain, LLC, doing business as SimpleFIN, owns and runs Bridge. The same small company makes the Buckets app. Bridge has been public since June 2015.5,6,7

  • Who uses it

    SimpleFIN’s ecosystem page lists apps like Actual, Buckets and Skwad, and says a listing is not an endorsement. Zedi is not listed there today.8,9

  • Where it works

    SimpleFIN says it supports US and Canadian banks only, and not every one of them. Data usually refreshes about once a day.10,9

How it reaches your bank

Five steps, from your bank to an app like Zedi.

  1. 1. You subscribe to Bridge

    You sign up at SimpleFIN Bridge and pay SimpleFIN directly. The app never sees that payment.11

  2. 2. You link your bank in Bridge

    SimpleFIN says it uses MX to connect to banks. MX’s docs say some banks send you to their own sign-in page, and others take your login in MX’s screen.12,13

  3. 3. SimpleFIN never holds your login

    SimpleFIN says bank logins never touch its servers: they are held by MX. Zedi never sees them either.12,5

  4. 4. You hand the app a token

    You create a one-time setup token in Bridge and paste it into the app, which trades it once for a read-only access key.4

  5. 5. The app can only read

    The app can then read accounts, balances and transactions. SimpleFIN’s spec has no call to send or move money.2

Is SimpleFIN safe?

No service is perfectly safe, Zedi included. Here is what each company says about itself, and what SimpleFIN does not publish.

What SimpleFIN says

  • Outside testing

    SimpleFIN says outside security firms test Bridge regularly. It names no firm, report or schedule.12

  • Sign-in without a password

    SimpleFIN says Bridge sign-in uses a passkey or an emailed code, and recommends turning on authenticator-app 2FA.12

  • Alerts on new IP addresses

    SimpleFIN says it notifies you each time your data is read from a new IP address.12

  • Traffic and cards

    SimpleFIN says it uses TLS for all server-to-server traffic, and that card payments go through Stripe, never its servers.12

  • Staff access needs your OK

    SimpleFIN says staff need your OK to see your transactions for debugging, that it logs how many they view, and that this access expires and can be revoked.12

What MX says

  • Yearly outside reports

    MX says an outside assessor issues its SOC 2 Type II report each year, and it offers a SOC 3 report to download.14,15

  • Card data rules

    MX says it holds a PCI DSS attestation, renewed each year, and has outside firms run penetration tests.14,15

  • Locked in transit and at rest

    MX says it encrypts sensitive data with TLS 1.2 and 1.3 in transit and AES-256 at rest.14

  • US data centers

    MX says it hosts all data in US data centers, watched around the clock.15

These cover MX, not Bridge. MX’s reports are about MX. MX says its public privacy statement does not cover data it handles as a service provider, which is its role for Bridge.16,5

What SimpleFIN does not publish

  • No audit report of its own

    SimpleFIN publishes no SOC 2 report or other outside attestation for Bridge itself.12

  • Nothing on stored data

    SimpleFIN does not say how it encrypts the data it stores.12

One incident, published

SimpleFIN lists one incident. According to MX, on May 28, 2026 a bug on MX’s side may have shown up to 39 users each other’s transactions, balances and account names for about 4 hours. SimpleFIN says no bank usernames or passwords were exposed, and all potentially affected users were notified.12

The risks, plainly

Our own reading of SimpleFIN’s public pages. None of these stop us from building on it, but you should know them.

  • A very small operator

    Bridge is run by one small company, with one maintainer visible on GitHub. It has lasted since 2015, but publishes no team size, funding or uptime promise.5,3,7

  • Thin legal terms

    SimpleFIN’s privacy policy sets no retention period and says full removal is not always possible. Its terms cap liability at what you paid.5,17

  • It leans on MX

    The one listed incident was an MX bug, and banks can drop out on MX’s side: Venmo and PayPal were removed in November 2025, which SimpleFIN called temporary.12,18

  • No shutdown notice promised

    SimpleFIN’s terms say nothing about notice if Bridge shuts down. Sync would stop, and transactions already in Zedi would stay.17

  • Zedi can’t cut access for you

    The protocol has no revoke call, so disconnecting in Zedi deletes our copy of the key but cannot end access at SimpleFIN.2

  • New-IP alerts may be us

    SimpleFIN notifies you when a new IP address reads your data. Zedi’s server address can change after an update, so that alert may be Zedi.12

  • Only simplefin.org, for now

    Zedi only connects to simplefin.org addresses. If another SimpleFIN server ever replaced Bridge, we would need to update Zedi first.

What it costs

SimpleFIN Bridge costs $1.50 a month or $15 a year, plus tax, paid to SimpleFIN directly, and covers up to 25 banks and 25 apps. Bank sync is part of Pro ($3.50 a month, billed by Zedi), with no markup on SimpleFIN.11

See pricing

What Zedi does with it

Zedi’s side of the connection, straight from our code.

  • One locked key

    Zedi stores one read-only access key, locked with AES-256-GCM. The unlock key lives outside the database.

  • Two calls, nothing more

    Zedi makes the one-time claim, then reads your accounts. It sends SimpleFIN the key and a date range, nothing about you.

  • No detours

    Zedi only talks to simplefin.org over HTTPS, follows no redirects, and keeps the key out of its logs.

  • Walled off

    Your connection is walled off from every other user in the database, and deleting your account deletes it too.

Zedi’s data policy: what is kept, and for how longWhat Zedi itself sees

How to disconnect, at both ends

Two steps. Zedi can’t end access at SimpleFIN for you.

  1. 1. In Zedi

    Open Settings > Connections & keys and press Disconnect. Zedi deletes its copy of the key and the account links.

  2. 2. In SimpleFIN Bridge

    Delete the Zedi app connection. That ends access at the source.

  3. 3. If you are done with sync

    Cancel your SimpleFIN subscription on their site, so they stop billing you.

Transactions already synced stay in Zedi until you delete them.

Questions

What is SimpleFIN?+
SimpleFIN is a public protocol for sharing read-only bank data. SimpleFIN Bridge is the paid service that runs it for banks that don’t: you link banks there, then give each app a one-time setup token.
Is SimpleFIN safe?+
No service is perfectly safe. SimpleFIN says access is read-only and bank logins are held by MX, never on its servers, and MX says it has SOC 2 Type II and PCI DSS attestations. SimpleFIN says it lists every security incident; one so far. It publishes no SOC 2 report of its own.
Who owns SimpleFIN?+
SimpleFIN Bridge is owned and run by One Part Rain, LLC, doing business as SimpleFIN, according to its privacy policy. The same small company makes the Buckets app.
Does SimpleFIN see my bank password?+
SimpleFIN says no: bank logins are held by MX, the company it uses to reach banks, and never touch SimpleFIN’s servers. Zedi never sees them either.
Can SimpleFIN move my money?+
SimpleFIN says all access is read-only, and its protocol has no call to send or move money, so an app connected through it, Zedi included, can only read.
How much does SimpleFIN cost?+
$1.50 a month or $15 a year, plus tax, paid to SimpleFIN directly, for up to 25 banks and 25 apps. Zedi Pro is a separate $3.50 a month, and Zedi adds no markup.
Is Zedi a SimpleFIN partner?+
No. Zedi uses SimpleFIN the way any app can, and SimpleFIN has not endorsed Zedi. SimpleFIN’s public pages offer no way for an app to pay for you, so you subscribe yourself.
How do I disconnect SimpleFIN from Zedi?+
Two steps. Press Disconnect in Zedi under Settings > Connections & keys, then delete the Zedi app in SimpleFIN Bridge. Only the second step ends access at the source.
What happens if SimpleFIN shuts down?+
Sync would stop. Transactions already in Zedi would stay, and statement uploads keep working. SimpleFIN’s terms say nothing about notice if Bridge ends.

Sources

Pages on SimpleFIN’s, MX’s and other sites, each checked October 11, 2026.

  1. SimpleFIN home page. Checked October 11, 2026.
    https://www.simplefin.org/
  2. SimpleFIN protocol specification, v2.0.0 entry dated March 19, 2026. Checked October 11, 2026.
    https://www.simplefin.org/protocol.html
  3. SimpleFIN on GitHub, organization created January 26, 2013. Checked October 11, 2026.
    https://github.com/simplefin
  4. SimpleFIN Bridge developer guide. Checked October 11, 2026.
    https://beta-bridge.simplefin.org/info/developers
  5. SimpleFIN Bridge privacy policy, effective June 29, 2026. Checked October 11, 2026.
    https://beta-bridge.simplefin.org/info/privacy
  6. One Part Rain, LLC. Checked October 11, 2026.
    https://onepartrain.com/
  7. Hacker News, SimpleFIN Bridge launch post, posted June 19, 2015. Checked October 11, 2026.
    https://news.ycombinator.com/item?id=9747577
  8. SimpleFIN ecosystem page. Checked October 11, 2026.
    https://www.simplefin.org/ecosystem.html
  9. Actual docs, SimpleFIN sync. Checked October 11, 2026.
    https://actualbudget.org/docs/advanced/bank-sync/simplefin/
  10. SimpleFIN Bridge institution search. Checked October 11, 2026.
    https://beta-bridge.simplefin.org/search-institutions
  11. SimpleFIN Bridge home and pricing. Checked October 11, 2026.
    https://beta-bridge.simplefin.org/
  12. SimpleFIN Bridge security page, last updated August 27, 2024, incident list current to 2026. Checked October 11, 2026.
    https://beta-bridge.simplefin.org/info/security
  13. MX Connect widget docs. Checked October 11, 2026.
    https://docs.mx.com/connect/
  14. MX, How MX Protects Your Data, updated September 3, 2026. Checked October 11, 2026.
    https://www.mx.com/whitepapers/security-how-mx-protects-your-data/
  15. MX trust page. Checked October 11, 2026.
    https://www.mx.com/trust
  16. MX Privacy Statement, last updated October 8, 2026. Checked October 11, 2026.
    https://www.mx.com/privacy/
  17. SimpleFIN Bridge terms, last updated July 21, 2026. Checked October 11, 2026.
    https://beta-bridge.simplefin.org/info/terms
  18. SimpleFIN Bridge issue 20, Venmo and PayPal removed, posted November 18, 2025. Checked October 11, 2026.
    https://github.com/simplefin/bridge-issues/issues/20

Know exactly where your money goes.

Start free with your files. Read-only bank sync is part of Pro, whenever you want it.

Start free

How bank sync works in Zedi, and SimpleFIN vs Plaid