You give them read only access, the financial API ecosystem is extremely well defined and provides advanced access control. I'm pretty sure you just log in to your bank account and they establish read only access. I would be shocked if Mint stored these logins, I don't think they can do that.