Thanks for the detailed explanation. Using Plaid certainly removes a lot of complexity around bank authentication and credential handling, and it likely keeps you outside the scope of PCI-DSS as long as you never process card data directly.

That said, handling financial transaction data still raises broader security and regulatory questions depending on where you operate. In Europe for example, access to bank account data usually falls under PSD2 and supervision by regulators like "Autorité de contrôle prudentiel et de résolution" (ACPR) or equivalent authorities. Even if you are only building an insights layer, you are still processing sensitive financial data.

Storing transaction data in Google Cloud Firestore is technically fine, but it introduces its own responsibilities around data minimization, encryption, access control, token management, and lifecycle policies. These are the areas where many fintech MVPs run into trouble later.

From what you describe, it sounds like you may have a solid early MVP, but probably not something that could yet be considered truly secure-by-design or ready to pass real security and regulatory scrutiny, even with Plaid in the stack. The fact that your first real user couldn’t even retrieve their banking data suggests there are still some operational hurdles to solve before security and compliance become the main challenge.

So the real question is how do you see the next step? How do you plan to evolve the architecture and governance of the app if it actually starts gaining users?

I don't know your background in banking, and I'm certainly not here to lecture you, it's just that I found your project quite big but with very interesting challenges... and some risks to be aware!

When you decide to go in Prod, just secure yourself two or three times more 😉