No bank logins.
Aggregator-based apps need your banking credentials to log in on your behalf. Those credentials sit in a third-party vault for as long as the connection lives. You can't audit what gets accessed when. You're exposed to every breach the aggregator suffers, and some banks revoke their fraud guarantees the moment you hand the keys over.
We never ask. No banking credentials live in our system, in transit, or in any partner's vault, because there's no partner doing this. Your bank stays your bank, and your relationship with it stays clean.