What is a read-only bank connection, and is it safe for a landlord?
A read-only bank connection lets software see your balances and transactions so it can match rent and expenses to your books. It is not a way to move money, and you can see and cancel each connection yourself. It is safe only if you check what the permission screen actually grants, use a business account for the rental, and review your list of connections now and then. Plaid, a common connector, says you control ongoing access to your shared data in its portal.
What "read-only" means in practice
Without a bank connection you download a statement every month, open the file and type or paste each line into your books. With a connection, the software asks the bank for the same lines, usually once a day, and files them for you. The data flows one way: from the bank to the software. The software cannot ask the bank to send a payment, because that permission is not part of the grant.
The words you want on the permission screen are the account names, the data types, such as balances and transactions, and a note that the app can view and not initiate. If a screen offers payment permissions, it is a different kind of connection and deserves a separate, more careful decision.
Three ways software gets your bank data
| Method | How it works | What to know |
|---|---|---|
| Connector service | You sign in to your bank inside a pop-up from a connector such as Plaid, and the app receives data, not your password. | You can review and revoke what you shared in the connector's own portal. |
| Direct bank feed | Your accounting software and your bank are linked by an agreement between them. | Fewer steps, but only banks on the list are supported. |
| File upload | You download a CSV or statement and upload it. | No standing access at all, and more typing risk. |
Plaid's own page on how it handles data says you get clear information about which accounts are shared, and that you can use its portal to see the data types you have shared and control ongoing access. Other connectors have similar pages. Read the one for the connector your software uses.
Habits that keep a connection safe
- Connect the business account that holds rent, not your personal checking account. It keeps the shared data small and the books cleaner, and the IRS advises keeping a business account separate from personal finances.
- Turn on two-factor sign-in at the bank first. A connection is only as safe as the login behind it.
- Share only the accounts the software needs. A rental LLC with one operating account and one deposit account needs two connections, not six.
- Look at the list of connections every quarter and remove tools you stopped using.
- Watch for a re-authentication request that arrives by email. Open your bank or software yourself instead of using the link.
What can still go wrong
Read-only does not mean risk-free. Transaction data includes tenant names, amounts and sometimes memos, so a breach at the software company would expose that. Connections can also break when a bank changes its login, which leaves gaps in your books until you reconnect. And a duplicate import can post the same deposit twice if you also upload a statement.
Treat each connection as a vendor relationship. Ask who the software company is, where it says it stores data and what it does when you disconnect. FTC guidance for businesses says to keep personal information only as long as you need it and to limit who can reach it.
How to cancel a connection
- Open the software and use its disconnect or remove bank option, so it stops asking for data.
- Open the connector's portal, if there is one, and remove the connection there as well.
- Check your bank's list of linked apps or connected services and remove it there too, if the bank has one.
- Change your bank password if you had any doubt, and confirm that no new connection appears.
DoorKeeping connects to your bank so it can match rent and expenses. Rent goes from your tenant to your own account, DoorKeeping never holds your money, and a payment goes out only when you approve it.
Sources
- Plaid, How we handle data, read Oct 30, 2026
- IRS, Publication 583, Starting a Business and Keeping Records, read Oct 30, 2026
- FTC, Protecting Personal Information: A Guide for Business, read Oct 30, 2026
Questions
- Can read-only access be used to steal money?
- Not by itself, because it has no payment permission. The risk is the data it shows and the bank login behind it, so protect both.
- Do I have to give my bank password to the rental software?
- With a connector you sign in on the connector's pop-up and the app receives data, not your password. Never type it into a form you do not recognize.
- Is uploading a statement safer than a connection?
- It leaves no standing access, but it costs time and invites typing mistakes. Many landlords use a connection plus a quarterly review.