Privacy

Why we'll never ask for your broker login

Many portfolio apps open with the same request: connect your broker. You hand over your credentials or an OAuth authorization, and your trades sync automatically. That is convenient, and it has a cost that the onboarding screen does not mention.

For many people, the account behind that login holds the largest sum of money they control outside their house. The decision to connect a third-party app to it deserves more than the two seconds the onboarding screen gives it.

This article explains what connecting involves, what can go wrong, and why we built BullBenchmark around a file you upload yourself. The short answer is that an uploaded file shows a tracker your past trades and nothing else, while a live connection is a standing permission that has to stay secure for as long as it exists.

What connecting your broker means

In the best case it is a read-only OAuth link through an aggregator, an extra company in the chain with access to your full account history. In the worst case, which is still common, it is screen-scraping, where the service logs in as you with your credentials stored on its servers.

Some brokers' terms void your protections if you share credentials. The two methods differ in what they expose.

OAuth, done properly, is the better of the two. You log in on the broker's own page, the broker issues the app a token, and that token is scoped. It is read-only, it can be revoked, and it does not contain your password.

A read-only token still exposes your position history, your account value and your trading behavior to another company's servers, for as long as the token lives. Read-only limits what the app can do, not what it can see.

Screen-scraping is the version that does not appear in the marketing copy. The app asks for your username and password, stores them, and logs in as you at intervals. There is no scoping, because the broker does not know it is happening. Whatever you can do while logged in, the service can technically do too.

Because you handed over the credentials voluntarily, the broker's terms tend to leave the consequences with you.

The aggregator in the middle

Most tracking apps do not build broker connections themselves. They rent them from an aggregator, a company whose business is maintaining connections to hundreds of financial institutions. Your relationship is with the app, but your data flows through a firm you have never evaluated, under a privacy policy you have never read, for a retention period you do not control.

Every additional database that holds a complete picture of your net worth is one more place that picture can leak from.

None of this requires anyone to act in bad faith. It only requires the normal rate of breaches, acquisitions and business-model changes that software companies go through, applied to a dataset you would rather keep private.

When a to-do app leaks, you lose your grocery list. When a financial aggregator leaks, someone gets a record of what you own and where.

What is exposed if it goes wrong

Security people call this a threat model. The household version is one question: if this goes wrong, what is exposed? With stored credentials, it is your account, everything in it, and possibly your legal protections. With an OAuth token, it is your complete account history, continuously updated. With a file you uploaded, it is that file.

There is also the question of who has to keep behaving well over time. A live connection is a standing arrangement in which the app, the aggregator and the broker's API all have to stay secure and solvent for as long as it exists. A file upload is a single transaction whose contents you inspected first.

The file-based alternative

The alternative is to download your broker's export file and upload it to the tracker. That is thirty seconds of work, once a month or after you have traded. Those thirty seconds give you four things.

Nothing can act on your account. An export file cannot place orders, cannot withdraw and cannot log in.
You see what is shared. Open the file and you find a list of your trades, nothing more.
No aggregator in the middle. That is one less database with your net worth in it.
It always works. There is no broken integration when your broker changes its API.

A file is inert data. There is no token to steal, no session to hijack and no standing permission to abuse, because no permission was granted. You can open the file in a spreadsheet before uploading it and read every line that will leave your hands.

Leaving out the aggregator removes one party from the chain. Reliability is the benefit people notice last. Anyone who has used a connected tracker knows the broken sync, the re-authentication loop and the unexplained gap in the data. Files do not have outages.

Isn't uploading a file also sharing data?

Yes. A transaction export describes what you bought, sold and received in dividends. That is the information a tracker needs to calculate your returns, and nothing beyond it. It contains no password, no session and no way to observe your account in the future.

You choose when to share it, you can see its full contents beforehand, and if you stop uploading, the flow of information stops. With a live connection, data keeps flowing until you revoke the access in a settings page you rarely visit.

The downside

Manual uploads mean that your transaction history is as current as your last export. For a day trader that rules the method out. For long-term investing, accurate as of the last upload is enough. Prices refresh every hour while markets are open and settle on the official closing prices after the US close, and dividends and exchange rates update daily.

The second, smaller downside is that it asks something of you. Once a month, or after a batch of trades, you spend half a minute downloading a file and dropping it into the tracker. If your broker's export screen is unfamiliar, the guides for DeGiro, Interactive Brokers and Trading 212 cover the clicks.

Access we never obtained

There is a difference between a company that promises not to misuse access and a company that never obtained it. A promise depends on policy, on staff and on the next owner of the business. A tracker that has never seen your credentials cannot leak them, cannot be compelled to use them, and cannot have them stolen.

That is the trade BullBenchmark makes: hourly market prices during trading hours on top of your uploaded history, and no access to your account, because we never asked for it.

If the reason you wanted a tracker is to find out whether your investing works, the answer is in your transaction history rather than in a live feed. The export file you download today contains everything needed to check whether you're beating the S&P 500.

BullBenchmark reads the transaction export from your broker and shows your return next to the S&P 500 and the Nasdaq 100, fed with the same deposits on the same dates, in your own currency. The first two weeks are free and no card is needed.