Trust

Aggregate connects to your bank, payments and accounting accounts. This page says how that access is limited, and only describes what is built today.

Aggregate can’t move moneyIt only reads your accounts. No tool in Aggregate, for you or for an AI, can move money.
You sign in with your bank, not with usBank connections go through Plaid or SimpleFIN, on their screen. We never see your bank password.
Your provider keys are encryptedBank tokens and API keys are encrypted before they are stored, each with its own key (AES-256-GCM), under a master key kept outside the database.
You decide what each AI can seeEach AI you connect gets its own access, and you choose which companies it can see.
Each workspace is kept apartEvery request is checked against the person making it, and every database query is limited to that person’s workspace.
The code is publicAggregate is licensed under the GNU AGPL v3. Anyone can read the code that handles your data.

For your security review

Company: Aggregate Finance LLC, a New Jersey limited liability company.
Questionnaire: Our CAIQ v4.1 self-assessment is on our CSA STAR listing. These are our own answers, not an audit.
Policies: Eight written policies, approved by the founder on November 1, 2026. Read them.
Subprocessors: Fly.io, Neon, Cloudflare, Resend, Plaid, Vercel and Frankfurter, plus Google or Apple if you sign in with them. What each one handles.
Data flow: Your accounts reach Aggregate through Plaid, SimpleFIN or the provider’s own API. Aggregate sends the AI you connect only what you grant it. Our server doesn’t call an AI model. Data is hosted in the US.
Encryption: HTTPS only. Bank tokens and API keys use AES-256-GCM, each with its own key, under a master key held as a hosting secret outside the database. Backups are encrypted before they leave the server.
Access: Sign-in uses passkeys, a one-time email link or code, Google or Apple, with no passwords. AI access is limited to what you choose and expires after 90 days. Who at Aggregate can see your data.
Incident response: If someone gets into your data without permission, we email the owners of affected workspaces promptly, and as the law requires. Read the policy.
Safe harbor: Good-faith security research is covered by the disclose.io Safe Harbor. Read it.
Not in place yet: No SOC 2 report or other certification, no outside penetration test, no failover outside one US region, no uptime commitment during beta, and no second person reviewing code or access.
Contact: security@aggregate.finance. We aim to reply within 2 business days. For a data processing agreement, write to privacy@aggregate.finance.

The details are on the security page and in the code. Live uptime is on the status page.