BankBridge is built to keep bank data out of reach: secrets are encrypted, tokens never reach the browser and every endpoint is permission-checked.
Encryption
- Access tokens, Plaid secrets, asset report tokens and webhook secrets are encrypted with AES-256-GCM (or XChaCha20-Poly1305 when sodium is available).
- The key comes from
BANKBRIDGE_ENCRYPTION_KEY(wp-config or environment) — set it before going live — falling back to your WordPress salts. - Rotate with
wp bankbridge rotate-key; check withwp bankbridge key-audit. Site Health flags secrets that can’t be decrypted (for example after changing salts during a migration).
Capabilities
| Capability | Allows |
|---|---|
manage_bankbridge | Settings, connections, Sandbox toolkit |
view_bankbridge | Dashboards, connections, logs (read-only) |
bankbridge_view_reports | Consumer, income and asset reports |
bankbridge_manage_transfers | Refund/cancel transfers, payouts |
bankbridge_use_explorer | API Explorer |
Data minimisation
- Only the last four digits of account numbers are stored; Auth numbers are shown masked.
- Logs redact tokens and secrets recursively.
- WordPress personal-data export and erase include BankBridge data; retention for logs and transactions is configurable.
- Removing a user can remove their connections at Plaid.
Abuse protection
- Public routes are rate limited per user/IP (
rate_limit_per_minute, default 20). - Plaid webhooks must carry a valid signature in Production.
- Payment amounts and schedules are signed server-side.
- Guest bank payments are off by default; guest connections are bound to an HttpOnly cookie hash and purged after 24 hours.