When Plaid fails, Brook catches the statement. Crest shows the catch, live.
Brook is the failover for failed bank connections. The borrower drops a statement in a secure window, and your app gets the data back in Plaid’s exact schema, field for field, so the code you wrote for Plaid reads it unchanged. Crest is the full experience running on this page: secure capture, six deterministic analyses over the returned wire, and one result sealed with a Certificate of Provenance.
The connection fails. Brook doesn’t.
Bank-connection tools work until the account will not connect: the small credit union, the borrower who will not hand over a login, the scanned statement. Brook starts at that failure. It collects the statement in a secure window or by a link that waits for days, verifies it line by line, and returns the data in Plaid’s exact schema, field for field, so the code you wrote for Plaid does not change. Every file ships with a Certificate of Provenance: source hash, tamper check, line-level confidence. Crest is that promise, running. A crest is where the wave breaks, and a crest is the mark pressed into a seal; this page is both. The same SDK a customer installs, the full capture flow, six analyses over the returned wire, and the sealed certificate at the end. Run it, right here.
Four steps. Two keys. One sealed result.
-
1
The page opens a capture.
This page calls collect() on the published SDK with the publishable key. The borrower drops a statement in the secure window. No bank login, no account to create.
-
2
The SDK resolves with a ref.
The browser never sees statement data. It gets an exchangeRef and hands it to this app’s server. That is the whole client-side contract.
-
3
The server exchanges with the secret key.
One POST, authenticated with the secret key that never leaves the server, returns the wire in Plaid’s exact transactions schema. Existing Plaid code reads it unchanged.
-
4
Crest analyzes and seals.
Six deterministic modules read the wire: integrity, income, cash flow, obligations, revenue, assets. The result ships under a Certificate of Provenance: source hash, tamper check, line-level confidence, re-derivable from every deposit line.
Everything above, in five minutes of code.
This is not pseudocode. The demo card above runs these exact calls, and the page imports the exact package you would. Install, collect in the browser, exchange on the server. The whole app is here to read, top to bottom, when you want to take it apart.
$ npm i @multiversal-ventures/brook
import { createBrook } from "@multiversal-ventures/brook"
const brook = createBrook({ publishableKey: "pk_live_…" })
// When Plaid fails, catch the borrower with Brook.
const { exchangeRef } = await brook.collect({ onStatus: render })
// Hand the ref to YOUR server. The browser never sees statement data.
const result = await fetch("/api/result?ref=" + exchangeRef)
In React, useBrook() wraps the same client with status / error / reset state. This page uses the framework-agnostic createBrook() with no build step.
const r = await fetch(BROOK_API_BASE + "/exchange", { method: "POST", headers: { "X-Brook-Key": process.env.BROOK_PK, "Authorization": `Bearer ${process.env.BROOK_SK}`, // server-side only "Content-Type": "application/json", }, body: JSON.stringify({ exchangeRef }), }) const { data } = await r.json() // Plaid 2020-09-14 shape: { accounts, added, … }
The wire is backward-compatible with Plaid’s /transactions response, field for field. Whatever read Plaid yesterday reads Brook today.
$ git clone https://github.com/multiversal-ventures/crest && cd crest $ npm install $ cp .env.example .env # add your pk/sk — .env is git-ignored, never committed $ npm start # → http://localhost:8022
| Key | Lives | Can | Cannot |
|---|---|---|---|
| pk_live_… | Browser, safely | Open capture sessions, drive the upload window | Read statement data |
| sk_live_… | Server only, in .env | Exchange refs for Plaid-shaped data | Ever appear in a page, a repo, or a log |
Six readings of one wire.
Each module turns the capture into a report: headline metrics, a narrative, and a detail tab in the exported workbook. The result card above renders one panel per module; add a module to the registry and it appears everywhere, automatically.
Ledger Integrity
Forensics before trust. Coverage and gap checks, duplicate detection, balance-versus-flow reconciliation. Runs first; every other number is read in its light.
Bank Statement Income
Money-in lines classified; transfers and reversals excluded at the line level. Months of coverage divide the counted total: average monthly income, re-derivable from every line.
Cash Flow & Liquidity
Monthly inflows, outflows, and net. Daily balances reconstructed from the wire, negative-balance days counted, the liquidity buffer measured in months of outflow.
Obligations & Debt Service
Recurring same-counterparty outflows classified by cadence: rent, debt payments, payroll, insurance. The commitments the deposits have to clear, and what servicing them costs monthly.
Business Revenue & Positions
Revenue channels and concentration, top counterparties, owner draws separated from operating flow: the shape of the business behind the statements.
Assets & Deposit Sourcing
Account balances as of capture, and sourcing on large one-off deposits: which lines an underwriter will ask for paper on, surfaced before they ask.
The security lives in Brook.
Crest is a throwaway demo — clone it, run it, delete it. What must be trustworthy is upstream of this page: the statement, the keys, and the guarantees all belong to Brook. Here is what Brook holds to on every capture.
The browser never sees the statement
Brook hands the page an exchangeRef and nothing else. The statement and the Plaid-shaped wire are read server-side with your secret key. Your users’ financials never reach the client.
Two keys, and one can’t read
The publishable key opens capture sessions and is safe in the browser — it cannot read statement data. Only the secret key, held server-side, exchanges a ref for the wire.
Zero retention, never trained on
Brook reads the statement and lets it go — nothing is retained past the capture, and no borrower’s statement is ever used to train a model.
A Certificate of Provenance on every file
SHA-256 source hash, tamper check, and line-level confidence from structural evidence — re-derivable from the deposit lines, so every number traces back to its source.