Does Plaid provide snapshot or ongoing access to your financial data?

Question

When a user connects their financial institution (e.g. bank) with Plaid for a fintech app or service, what type of authorization to one's transactions does that connection provide? Is it a one-time inquiry (e.g. recent transactions / account status), or similar to continuous access via an API key/secret, including future transactions? In the latter case, how can the user revoke the access? Would changing the password be sufficient?

Their End User Privacy Policy states that,

in general, we collect the following types of identifiers, commercial information, and other personal information from your financial product and service providers:

• Account information, including financial institution name, account name, account type, account ownership, branch number, IBAN, BIC, account number, routing number, and sort code;
• Information about an account balance, including current and available balance;
• Information about credit accounts, including due dates, balances owed, payment amounts and dates, transaction history, credit limit, repayment status, and interest rate;
• Information about loan accounts, including due dates, repayment status, balances, payment amounts and dates, interest rate, guarantor, loan type, payment plan, and terms;
• Information about investment accounts, including transaction information, type of asset, identifying details about the asset, quantity, price, fees, and cost basis;
• Identifiers and information about the account owner(s), including name, email address, phone number, date of birth, and address information;
• Information about account transactions, including amount, date, payee, type, quantity, price, location, involved securities, and a description of the transaction; and
• Professional information, including information about your employer, in limited cases where you’ve connected your payroll accounts or provided us with your pay stub information.
• The data collected from your financial accounts includes information from all accounts (e.g., checking, savings, and credit card) accessible through a single set of account credentials.

When you use your device to connect to our services through a developer’s application, we receive identifiers and electronic network activity information about that device, including internet protocol (IP) address, timezone setting and location, device location

We may use the information we collect about you to derive inferences. For example, we may infer your location or your annual income based on the information we have collected about you from you or other sources.

But it's still not clear if they have an ongoing authorization to future transaction data.

Answer 1

Plaid has helpful information on their website: "How it works for consumers".

what type of authorization to one's transactions does that connection provide?

The type of authorization depends on the "fintech" app or service. If the service is using Plaid's API for account verification (e.g., Venmo) then it is simply a "one shot" login to make sure the account is real and active. However, Plaid may still hold on to some small artifact of your information for future use. If you are using something like a budgeting app (e.g., YNAB) then they will need constant access in order to automatically import new transactions. The service that uses Plaid should tell you what kind of connection it is wanting to set up.

how can the user revoke the access?

Plaid offers a login portal where you can manage all your connections. As of October 2021 they have it marked as "in beta". Other options include contacting Plaid support or submitting a "user data protection rights" form.

Would changing the password be sufficient?

Depending on how the app has implemented the API, changing your password may or may not revoke access. If you want to be sure that Plaid no longer has access you should both change your password and exercise one of the above options.

Answer 2

I went through Plaid'd access request procedure to see what data they had on me, and the result was completely useless - Plaid only sent me minimal information my own bank accounts, which I obviously knew. What I wanted to know was what other apps had learned about me through Plaid.

In the process, they said that Plaid doesn't have a concept of you as a "user".

The way Plaid works means the only data we would have, if we have any, is information about your financial accounts, which is specific to each individual app connection you've made via Plaid. That data we access depends on the app you're connecting to, as well as what's available from your financial institution -- which means we don't know everything about you or your financial accounts! The only thing that's guaranteed information for all connections, is what you supply to connect your accounts in the first place -- so that's why we ask for the financial institution + username.

I also asked specifically this question:

Me: I've read the help center page about credentials handling. Since I gave Plaid, not my financial institutions, my username & password, I'll be in the first group of users mentioned on that page ("In many cases, when you link a financial institution to an app via Plaid, you provide your login credentials to us and we securely store them."). With that in mind, what sort of access do apps that use Plaid have to my bank accounts? One-time when the connection was made, or ongoing? Since Plaid stores my credentials, I imagine the apps can request data from my banks, such as new transactions, on an ongoing basis at any time in the future, and whether they do so or not, is outside of Plaid's control. Can you please confirm/correct my understanding?

Plaid's answer was:

Plaid never shares your credentials, so applications can only request data from Plaid -- they do not communicate directly with your financial institution. Apps only have access to the data that you've shared via Plaid, which corresponds to the Plaid products that they use and which have been approved and vetted by our security and compliance team. I think your question relates to how frequently that data is updated, and if an application can "request" for Plaid to update or fetch information from your financial accounts. How often Plaid updates data also depends on the products in use, but in general, yes, as long as there is an active, available connection Plaid could update (or attempt to update) data, but again only the data that was shared in the first place. With regard to the transactions product specifically, Plaid updates that data on a set schedule -- not at the request of an application. Again, if the application has not requested the use of transactions data -- and you've not provided permission -- then Plaid isn't going to access that data in the first place. Apps can't just decide to ask for whatever data they want at any time; the data accessed it set with your permission at the time you connect your accounts, and if an application wanted to increase or change that, they would need to request for your permission, via Plaid, to do so.