Security

Banks connect through Plaid. You sign in to your bank inside Plaid's window, so Stoke never sees or stores your bank login.

Access is read-only. Stoke can read balances and transactions to build your forecast, and it can't move money or change anything at your bank. Disconnecting a bank revokes Stoke's access to it.

There are no passwords. You sign in with a passkey or a one-time link sent to your email, so there's no password to steal or reuse.

Everything travels over TLS 1.2 or higher, and the database is encrypted at rest.

Bank access tokens and account numbers get a second layer: they're encrypted with AES-256-GCM before they're stored, using keys that can be rotated.

Stoke runs on Vercel (hosting) and Supabase (database), and all data is stored in the United States. Both providers maintain a SOC 2 Type 2 report and ISO 27001 certification.

Those are the providers' audits. Stoke itself has not been independently audited. Access to production systems is restricted and protected with multi-factor authentication.

Connecting an AI assistant is optional and available on Pro. You choose read-only or read and write when you connect, and you can revoke access at any time in Settings.

Once connected, the assistant handles your data under its provider's privacy policy.

Your data is never sold or shared with advertisers, and Stoke shows no ads. The subscription is how it's paid for.

Cancel and your accounts, transactions, and forecast stay. Delete your account and they're permanently removed.