3

When a user connects their financial institution (e.g. bank) with Plaid for a fintech app or service, what type of authorization to one's transactions does that connection provide? Is it a one-time inquiry (e.g. recent transactions / account status), or similar to continuous access via an API key/secret, including future transactions? In the latter case, how can the user revoke the access? Would changing the password be sufficient?

Their End User Privacy Policy states that,

in general, we collect the following types of identifiers, commercial information, and other personal information from your financial product and service providers:

  • Account information, including financial institution name, account name, account type, account ownership, branch number, IBAN, BIC, account number, routing number, and sort code;
  • Information about an account balance, including current and available balance;
  • Information about credit accounts, including due dates, balances owed, payment amounts and dates, transaction history, credit limit, repayment status, and interest rate;
  • Information about loan accounts, including due dates, repayment status, balances, payment amounts and dates, interest rate, guarantor, loan type, payment plan, and terms;
  • Information about investment accounts, including transaction information, type of asset, identifying details about the asset, quantity, price, fees, and cost basis;
  • Identifiers and information about the account owner(s), including name, email address, phone number, date of birth, and address information;
  • Information about account transactions, including amount, date, payee, type, quantity, price, location, involved securities, and a description of the transaction; and
  • Professional information, including information about your employer, in limited cases where you’ve connected your payroll accounts or provided us with your pay stub information.
  • The data collected from your financial accounts includes information from all accounts (e.g., checking, savings, and credit card) accessible through a single set of account credentials.

When you use your device to connect to our services through a developer’s application, we receive identifiers and electronic network activity information about that device, including internet protocol (IP) address, timezone setting and location, device location

We may use the information we collect about you to derive inferences. For example, we may infer your location or your annual income based on the information we have collected about you from you or other sources.

But it's still not clear if they have an ongoing authorization to future transaction data.

2

Plaid has helpful information on their website: "How it works for consumers".

what type of authorization to one's transactions does that connection provide?

The type of authorization depends on the "fintech" app or service. If the service is using Plaid's API for account verification (e.g., Venmo) then it is simply a "one shot" login to make sure the account is real and active. However, Plaid may still hold on to some small artifact of your information for future use. If you are using something like a budgeting app (e.g., YNAB) then they will need constant access in order to automatically import new transactions. The service that uses Plaid should tell you what kind of connection it is wanting to set up.

how can the user revoke the access?

Plaid offers a login portal where you can manage all your connections. As of October 2021 they have it marked as "in beta". Other options include contacting Plaid support or submitting a "user data protection rights" form.

Would changing the password be sufficient?

Depending on how the app has implemented the API, changing your password may or may not revoke access. If you want to be sure that Plaid no longer has access you should both change your password and exercise one of the above options.

1
  • Good find! I don't think the portal really works yet. I've signed up using my phone number, which I use with all my banks, and Plaid said "We didn’t find apps or accounts connected to ...", despite their Orwellian privacy policy clearly stating they slurp your phone number. Nov 10 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.