11 of 11 Plaid attestations signed

  1. Vulnerability management2 of 2 met
    • ✓

      Patches identified vulnerabilities within a defined SLA

      Written vulnerability-management policy defines patching cadence: Critical 72h, High 14d, Medium 30d, Low 90d. Continuous scanning via Dependabot, pip-audit, and unattended-upgrades.

      Vulnerability mgmt →2026-04-17
    • ✓

      Vulnerability scanning performed

      Continuous automated scanning via Dependabot (dependency CVEs), pip-audit (Python package advisories), and unattended-upgrades (OS patches).

      Scanning details →2026-04-17
  2. Authentication & tokens3 of 3 met
    • ✓

      MFA on internal systems that store or process consumer data

      MFA enforced on all operator-facing third-party accounts (domain registrar, DNS, email, GitHub, VPS vendor, cloud console). Covered by the access control policy.

      Access control →2026-04-17
    • ✓

      MFA on the consumer-facing application where Plaid Link is deployed

      Consumer MFA via TOTP authenticator apps and WebAuthn passkeys. Available to every account holder; optional by default.

      Authentication →2026-04-17
    • ✓

      Secure tokens and certificates for authentication

      JWT access tokens with 15-min expiry. Rotated refresh tokens with database-backed replay detection. WebAuthn/FIDO2 passkeys. TLS 1.2 minimum (TLS 1.3 preferred) with HSTS.

      Encryption & auth →2026-04-17
  3. Access control3 of 3 met
    • ✓

      Zero trust access architecture implemented

      Every request independently authenticated and authorized at middleware. No trusted network perimeter. Short-lived JWT access tokens with refresh rotation and replay detection.

      Zero trust →2026-04-17
    • ✓

      Defined and documented access control policy

      Published access control policy. Tier-based RBAC enforced at middleware with a least-privilege default.

      Policy →2026-04-17
    • ✓

      Automated de-provisioning for employees

      offboarding.py script revokes all tokens, disables MFA, deletes passkeys, disconnects Plaid, and clears passwords. Single-operator today; policy applies on team growth.

      Access revocation →2026-04-17
  4. Policy & data3 of 3 met
    • ✓

      Information Security Policy (ISP) created

      Published ISP covering scope, information classification, control domains, roles, exceptions, and review cadence.

      View ISP →2026-04-17
    • ✓

      Data deletion and retention policy implemented

      Soft delete with 30-day recovery window via account settings. GDPR Article 17 hard-delete available on request via [email protected]. Retention rules defined per data type.

      Retention →2026-04-17
    • ✓

      Published privacy policy

      Public privacy policy covering collection, processing, subprocessors, retention, user rights, GDPR Article 17/20, and CCPA.

      Privacy policy →2026-04-13