What Upside does with your bank connection
Upside is a cashback app that connects to your bank account to track your spending and reward you for purchases at partner merchants. When you link your bank account, Upside uses read-only access — it can see your transactions but cannot move money, change passwords, or make transfers on your behalf. The app uses encryption to send your login credentials to a third-party service called Plaid, which handles the actual connection between Upside and your bank.
The connection works like this: you enter your bank username and password into Upside's app, Plaid receives those credentials (not Upside directly), and Plaid retrieves your transaction history from your bank's servers. Upside then uses that data to match your purchases against its merchant network and calculate your cashback. Your bank credentials are not stored on Upside's servers — Plaid stores them in encrypted form on its own infrastructure.
This setup is standard across hundreds of fintech apps, including budget trackers, investment platforms, and loan services. It is not unique to Upside, and it is not inherently unsafe, but it does mean you are trusting two companies — Upside and Plaid — with access to your transaction history.
Key Takeaways
- Upside uses Plaid to connect to your bank account, and the connection is read-only, meaning Upside cannot move money or change your account settings.
- Your bank login credentials go to Plaid, not directly to Upside, and Plaid encrypts them rather than storing them in plain text.
- Upside can see all your transactions once connected, not just purchases at partner merchants, so consider what transaction data you are comfortable sharing.
- Plaid is used by hundreds of apps and has been audited by third parties, but security depends partly on how Upside and Plaid handle the data they collect.
- You can revoke Upside's access to your bank account at any time through your bank's settings or through Upside's app, and this stops the data flow when ready.
How Plaid sits between you and your bank
Plaid is a data aggregation company that acts as a middleman for thousands of apps trying to connect to bank accounts. Instead of Upside building direct connections to every bank in the country — a task that would take years — Upside uses Plaid's existing connections. Plaid has already negotiated with Chase, Bank of America, Wells Fargo, and hundreds of smaller banks to access transaction data securely.
When you enter your credentials into Upside, you are actually entering them into a Plaid-hosted login screen, not Upside's. Plaid then uses those credentials to log into your bank on your behalf, pull your transaction history, and send it back to Upside. Your actual bank password never touches Upside's servers. Plaid encrypts your credentials using industry-standard encryption (AES-256) and stores them in a way that even Plaid employees cannot read without additional authentication.
Plaid has been audited by SOC 2 Type II, which is a third-party security assessment that checks data handling, access controls, and encryption practices. This does not mean Plaid is risk-free — no company is — but it does mean an independent auditor has reviewed their security practices and found them acceptable for handling financial data.
What data Upside actually sees
Once connected, Upside can see your full transaction history, not just the purchases that earn cashback. This includes the merchant name, the amount, the date, and sometimes the category (groceries, gas, dining). Upside uses this data to identify which transactions match its partner merchants and calculate your rewards. But the app also uses this data to build a profile of your spending habits, which it may use for internal analytics or to show you targeted offers.
Upside's privacy policy states that it does not sell your transaction data to third parties, but it does share anonymized spending patterns with partners and uses your data to improve its recommendation engine. If you are uncomfortable with any company having a complete view of your spending — including purchases that do not earn rewards — you should not link your bank account to Upside. You can instead use Upside's receipt-upload feature, which lets you manually submit photos of receipts and earn rewards without giving the app access to your bank.
The receipt method is slower and requires more work on your part, but it limits Upside's visibility to only the purchases you choose to report.
Real security risks and how to manage them
The main risk in linking your bank account to any app is not that the app will steal your money — read-only access prevents that — but that a data breach could expose your transaction history or credentials. If Plaid's servers were compromised, an attacker could potentially access encrypted credentials or transaction data. If Upside's servers were compromised, an attacker could access the transaction history Upside has already collected. Neither scenario is likely, but both are possible.
A secondary risk is that you are trusting Upside's employees not to misuse the access they have. Even with read-only access, an employee with access to your transaction data could theoretically use it for identity theft, social engineering, or selling information to data brokers. Upside has access controls and logging systems to prevent this, but these controls depend on the company's internal security culture and hiring practices, which you cannot directly verify.
To reduce these risks: use a strong, unique password for your bank account so that if Plaid's credentials are compromised, the attacker cannot use them elsewhere. Enable two-factor authentication on your bank account if your bank offers it — this prevents an attacker from logging in even with your password. Monitor your bank account regularly for unauthorized transactions, though read-only access makes this less likely. And revoke Upside's access if you stop using the app, rather than leaving the connection open indefinitely.
How to revoke Upside's access if you change your mind
You can disconnect Upside from your bank account in two ways. The fastest is through Upside's app: go to Settings, find the Connected Accounts section, and select Disconnect. This tells Plaid to stop sharing your data with Upside, and the connection stops when ready. Upside will no longer be able to see new transactions, though it will retain the historical data it has already collected.
The more thorough method is to revoke access through your bank's website or app. Log into your bank, go to Connected Apps or Third-Party Access (the exact name varies by bank), find Plaid or Upside in the list, and select Revoke or Remove. This prevents Plaid from logging into your bank on Upside's behalf, even if Upside still has stored credentials. Most banks show you which apps have access and let you revoke them individually without affecting other connections.
Revoking access does not delete the historical data Upside has already collected. If you want Upside to delete your data entirely, you will need to contact Upside's support team and request data deletion under your state's privacy laws (California, Virginia, Colorado, and others have data deletion rights). Upside is required to honor these requests, though the company may take 30 to 45 days to process them.
Comparing Upside to other cashback apps
Most cashback apps use the same Plaid connection method, including Rakuten, Fetch Rewards, and Ibotta. The difference between them is not usually the security of the connection — that is handled by Plaid — but how each app uses the data it collects. Rakuten, for example, also connects via Plaid but has a larger merchant network, so it sees more of your transactions as may be able to access for rewards. Fetch Rewards does not require a bank connection at all; it works entirely through receipt uploads, which means it never sees your full transaction history.
If you want cashback rewards without linking your bank account, receipt-based apps like Fetch, Ibotta, and Checkout 51 are your options. They are slower and require more manual work, but they give you complete control over what data the app sees. If you are willing to link your bank account, Upside is roughly as safe as Rakuten or other Plaid-based apps — the security depends on Plaid's infrastructure and Upside's data handling practices, both of which are industry-standard but not perfect.
What Upside's privacy policy actually says
Upside's privacy policy states that it collects transaction data, merchant information, and spending patterns when you link your bank account. The company says it does not sell this data to third parties, but it does share anonymized aggregated data with partners and uses individual data to improve its service and show you targeted offers. Upside also says it retains your data as long as your account is active, and for a period after you delete your account (the exact period is not specified in the public policy).
The policy also covers how Upside handles data breaches: if a breach occurs, Upside says it will notify affected users without unreasonable delay, as required by law. This does not prevent breaches from happening, but it does mean you will be told if your data is compromised. You can request a copy of Upside's full privacy policy on its website, and you can request deletion of your data by contacting support.
Frequently Asked Questions
Can Upside take money out of my account?
No. The connection Upside uses through Plaid is read-only, which means it can only see transactions and account balances. It cannot initiate transfers, change passwords, set up bill pay, or move money. If money disappears from your account after linking Upside, it is not because of Upside — it is a separate fraud issue with your bank account.
What happens if Plaid gets hacked?
If Plaid's servers are compromised, an attacker could potentially access encrypted credentials or transaction data. Plaid encrypts credentials so they cannot be read without decryption keys, but encryption can theoretically be broken. If this happens, Plaid is required to notify affected users. You should monitor your bank account and consider changing your bank password, though read-only access limits what an attacker can do with your credentials.
Does Upside sell my transaction data?
Upside says it does not sell individual transaction data to third parties. It does share anonymized aggregated data with partners and uses your data to show you targeted offers and improve its service. If you do not want any company analyzing your spending patterns, do not link your bank account — use the receipt upload method instead.
Is it safer to use the receipt upload feature instead?
Yes, if your concern is limiting what data Upside sees. The receipt method means Upside only knows about purchases you manually report, not your full transaction history. The tradeoff is that it requires more work on your part and you will earn rewards more slowly. The security of your bank account itself is the same either way.
Can I use Upside if my bank is not supported?
Plaid supports most major banks and thousands of smaller ones, but not all. If your bank is not on Plaid's list, you can still use Upside through the receipt upload feature. You can also contact Upside support to ask if they plan to add your bank, though there is no may provide they will.