It varies by bank but for all mine you have to use the username and password unfortunately. My understanding is that it’s just how the underlying bank APIs work in general, because that’s what I have to do when I link accounts for my banks elsewhere too, not just in SimpleFIN. I don’t think they actually store your credentials though, I think it proxies it to the bank login and then caches a token. You can probably ask their support about the details if you’re concerned, they have been pretty responsive to me and willing to answer technical questions.

It does support investment accounts, I have my retirement and investment accounts in there. It supports just about every account I have, actually, credit cards included which is super handy. I think it’s all read-only access through, so you can only use it to import data not make new transactions.