How to map and revoke a finance app's data access

What to take away

Removing an app icon is not revocation. A connection can survive on a server-side token, an aggregator, or stored credentials long after the software leaves your phone.

This applies to budgeting tools, portfolio dashboards, tax services, payment apps and lending tools. Anything that reads a financial account has a connection worth mapping.

Build a connection inventory

Open a table with one row per app-to-account relationship. Fill what you know and mark the rest unknown.

Never put a full password, access token, account number or recovery code in this table. Store it somewhere you control, not in a shared note.

Find both connection views

Inside the app, look under settings for connected accounts, linked institutions, data permissions, integrations or security. Then sign in to the financial institution through an address you typed yourself and look for connected apps, authorized services, shared access or third parties.

The two lists often disagree. The bank sees the aggregator that authenticates you; you recognize the app that displays the numbers. Record both names rather than treating the mismatch as an error.

Read what you actually authorized

Pull the current terms, permission screen and privacy notice. Then work through the questions below and write the answers next to each connection.

The 12 CFR 1033.331 revocation provision describes a data provider offering a reasonable method to revoke a third party's access to covered data. It then requires timely revocation and notice to the third party.

Compliance dates for that rule sit under a court stay, so treat the text as a design principle, not a live deadline. It still explains why provider-side control matters next to an app-side button.

Identify the connection method

Redirected authentication or API authorization

The app sends you to an institution-controlled sign-in page. The institution returns a token with defined access. You never type your bank password into the app's own form.

Credential-based retrieval

The app or aggregator holds your credentials and signs in as you to collect data. Multifactor prompts, password changes or redesigned pages can interrupt it.

File import

You download a statement or transaction file and upload it. There may be no continuing bank connection, but the imported copy stays with the app.

Unknown

Do not guess. Ask the app and the institution which entity authenticates the user, who stores credentials or tokens, and how future access ends.

Export evidence before you change anything

Redact secrets before sharing anything with a third party. Keep the originals in one controlled location.

Revoke inside the app

Use the disconnect, unlink or revoke control. Read the confirmation carefully, because "hide account" may remove a display tile without ending retrieval.

If the app only offers account closure, ask support whether closure revokes every connection and what records remain.

Revoke at the financial institution

If the institution runs a connected-app dashboard, remove the matching app or aggregator there as well. That gives you a second control and a second confirmation.

Where no dashboard exists, contact the institution through a verified support channel. Give the app name, aggregator, accounts, connection ID and authorization date. Ask for the exact action that stops future retrieval or payment initiation. Never send a password or full token to support.

Handle shared credentials

If you handed credentials to the app or aggregator, change the financial-account password after revoking. Use a unique password and review multifactor and recovery settings.

A password change is defensive. It is not a substitute for killing an API token or server-side authorization.

If a breach notice names the app or aggregator, follow the institution's incident instructions and read your statements closely.

Request deletion separately

Send a specific request naming the account and app profile. Include the connected institution. List the categories of imported data. Name any derived profiles, backups or processors in scope. State your requested completion date. Say what confirmation you want back. Note any retention exception the provider claims.

Revocation stops future access. Deletion concerns copies already held. A provider may keep records it says are required for legal, fraud, accounting, dispute or security purposes. Ask it to name the category and the retention period instead of promising that every byte vanishes at once.

Test that access stopped

Wait out the app's former refresh cycle, then check the bank's connected-app view and the app's last-refresh time. Do not create a real transaction as a test.

A clean check reads: revocation recorded, token or connection disabled, no later successful fetch, app shows disconnected, deletion response tracked.

If a fresh balance or transaction appears, preserve the timestamp and reopen the case with both the app and the institution. It may be a cached display, so ask for the underlying fetch time.

Close the record

Write a short final note covering the entities involved, controls used, confirmations, the last successful access time, the deletion outcome and any unresolved retention.

Review remaining connections quarterly, and again whenever a device, email address or financial account changes.

Common questions

Does deleting the app stop access?

No. The server-side connection lives on the provider's systems, not your phone. Revoke it through the app and the institution wherever both controls exist.

Should I change my bank password?

Change it if you gave credentials to the app or aggregator, or if you suspect exposure. Then revoke the tokens and authorizations directly, because a new password alone may not end an existing token.

Is disconnecting the same as deleting my data?

No. Disconnecting ends future access. Deletion covers copies already collected, so send a separate request and track the response.

How do I prove revocation worked?

Keep the confirmation text, case number and timestamps, then confirm no successful retrieval happens after the recorded revocation time. If one does, escalate to both the app and the institution with the timestamp.