Privacy

Why we'll never ask for your broker login

A lot of portfolio apps open with the same ask: connect your broker. Hand over credentials or OAuth access, and your trades sync automatically. Convenient. Worth being honest about what's traded away, though.

This is not a fringe concern. For many people, the account behind that login holds the largest pool of money they will ever control outside their house. The decision to wire a third-party app into it deserves more thought than the two seconds the onboarding screen budgets for it. So here is the longer version: what "connecting" actually involves, what the failure modes look like, and why we built BullBenchmark around a duller, safer mechanism instead.

What "connect your broker" means

Best case, it's a read-only OAuth link through an aggregator, an extra company in the chain with access to your complete financial life. Worst case (still common), it's screen-scraping: the service logs in as you, with your actual credentials stored on their servers. Some brokers' terms void your protections if you share credentials. People connect anyway, because the button is right there and the alternative sounds like work.

It helps to unpack those two flavors, because they are very different animals wearing the same button.

OAuth, done properly, is the respectable version. You log in on the broker's own page, the broker issues the app a token, and that token is scoped: read-only, revocable, and it never contains your password. This is a well-established pattern, and it is genuinely better than the alternative. But "better" is doing quiet work in that sentence. A read-only token still exposes your position history, your account value, and your trading behavior to another company's servers, on an ongoing basis, for as long as the token lives. Read-only is a limit on actions, not on information.

Screen-scraping is the version nobody puts in the marketing copy. The app asks for your actual username and password, stores them, and periodically logs in pretending to be you. There is no scoping, because the broker has no idea it is happening; whatever you can do while logged in, the service can technically do too. And because you handed the credentials over voluntarily, the paperwork tends to leave the consequences on your side of the table.

The aggregator in the middle

Most tracking apps don't build broker connections themselves. They rent them from an aggregator, a company whose entire business is maintaining pipes into hundreds of financial institutions. That is rational engineering and an awkward trust arrangement. Your relationship is with the app; your data flows through a firm you have never evaluated, under a privacy policy you have never read, retained for a period you do not control. Every additional database that holds a complete picture of your net worth is one more place that picture can leak from.

None of this requires anyone to act in bad faith. It only requires the ordinary base rate of breaches, acquisitions, and quiet business-model pivots that software companies experience, applied to a dataset you would rather keep private. When a to-do app leaks, you lose your grocery list. When a financial aggregator leaks, someone gets a tidy record of what you own and where.

The household threat model

Security people talk about threat models. The household version is a single question: if this goes wrong, what is the blast radius? With stored credentials, the blast radius is your account, everything in it, and possibly your legal protections. With an OAuth token, it is your complete financial history, continuously updated. With a file you uploaded, it is that file. That is the entire argument, really. Everything below is elaboration.

Notice also who has to keep behaving well over time. A live connection is a standing arrangement: the app, the aggregator, and the broker's API all have to stay secure, solvent, and honest indefinitely. A file upload is a single transaction whose contents you inspected first. Standing arrangements are where surprises live.

The file-based alternative

The alternative is unglamorous: download your broker's export file, upload it to the tracker. Thirty seconds of work, once a month or whenever you've traded.

What you get for those thirty seconds: nothing can act on your account, an export file can't place orders, can't withdraw, can't even log in. You see exactly what's shared, open the file, it's a list of your trades, nothing more. No aggregator in the middle, one less database with your net worth in it. It always works, no broken integrations when your broker changes their API.

Each of those points deserves one more sentence. A file is inert data; there is no token to steal, no session to hijack, no standing permission to abuse, because no permission was ever granted. Transparency is not a promise in a policy document but a physical property: you can open the file in a spreadsheet before uploading it and read every line that will leave your hands. Cutting out the aggregator removes an entire party from your trust arithmetic, which is rarer than it sounds in modern finance apps. And reliability is the sleeper benefit: anyone who has used a connected tracker knows the ritual of the broken sync, the re-authentication loop, the mystery gap in the data. Files do not have outages.

"But isn't uploading a file also sharing data?"

Yes, and it is worth being precise about what kind. A transaction export describes what you bought, sold, and received in dividends. That is exactly the information a tracker needs to compute your returns, and nothing beyond it. It contains no password, no session, no ability to observe your account in the future. You choose when to share it, you can see its full contents beforehand, and if you stop uploading, the flow of information stops with you. Compare that with a live connection, where the default is that data keeps flowing until you remember to revoke something in a settings page you will never visit again. The file model puts the off switch in your hands by default.

The honest downside

Manual uploads mean your dashboard is as current as your last export. For day traders, that's a dealbreaker. For everyone tracking long-term investing, "accurate as of my last upload, prices updated daily" covers it, you need truth, not ticks.

There is a second, smaller downside: it asks something of you. Once a month, or after a batch of trades, you spend half a minute downloading a file and dropping it into the tracker. Some people find that a chore; others find it a useful ritual, the bookkeeping equivalent of checking the oil. If your broker's export screen is unfamiliar territory, our walkthroughs for DeGiro, Interactive Brokers and Trading 212 cover the clicks.

A capability we refused

There is a meaningful difference between a company that promises not to misuse access and a company that never obtained it. Promises depend on policy, personnel, and the next owner of the business. Architecture does not. A tracker that has never seen your credentials cannot leak them, cannot be compelled to use them, and cannot have them stolen, no matter how bad a week its engineers are having.

That's the trade BullBenchmark makes, permanently: daily market prices on top of your uploaded history, and we never touch your account because we never can. Security isn't a feature we added. It's a capability we refused.

If the reason you wanted a tracker in the first place is to find out whether your investing actually works, that answer lives in your transaction history, not in a live feed. Start with whether you're beating the S&P 500; the export file you download today contains everything needed to find out.

The first week of BullBenchmark is free, no card, upload the export you just downloaded and see where you stand.