This service will log in to your bank on your behalf to scrape the site, since not all banks have APIs. This means they will store your bank login and password somewhere. Store in a way that they can decrypt it so they ... you know ... can login on your behalf occasionally to scape the latest data. If they can decrypt it, so can whoever steals their database.