Security at RealChange
The short version: read-only access to your transactions, no credentials on our side, and card details that never reach us.
Nobody here sees your bank credentials
No one at RealChange ever has access to your bank or card login. The connection is made inside Plaid and we never receive it.
256-bit encryption
Traffic is encrypted in transit, and access tokens are encrypted at rest.
Read-only bank access
We request the Transactions product and nothing else. It is used to calculate round-ups and to process your donation. We cannot move money in your bank.
Card details go to Stripe, not to us
The card is saved directly with Stripe. Card numbers never touch our servers.
Every money event is logged
Each charge writes an immutable audit row, and a nightly job reconciles Stripe against our ledger.
Removing your data
You can ask us to delete your record at any time. Removal happens within 30 days of the request.
Request removal