SimpleFIN Bridge – Securely provide your bank transaction data to apps

I'm glad you're suspicious. There should be more poeple with questions like the ones you've asked. We are still very early-stage, but here's my best quick answers:

1. Yes, unfortunately. See my answer to evolve2k

2. We ought to publish our privacy policy, but as a principle, we have no interest in selling or mining data.

3. Losses caused by misreporting?

4. No

5. None yet

Sorry those are probably unsatisfactory, but they're honest.

thinkcomp is that you?

1. What are you actually doing to secure this? Are you encrypting persistent data? What data do you retain and for how long?

2. Who's in charge of your application security? Do you have a full-time security person on staff? Can we see who they are?

3. Have you retained a security consultancy to review your code? Are you doing it on a regular basis, or as a one-shot thing?

4. Do you have a security page somewhere we can see? What's your policy with regards to outsiders/strangers testing your application for vulnerabilities? Have you provided permission to do that?

5. What stack are you running on? A PHP site would be more worrisome than a Rails site, which is in turn more worrisome than a microframework Java site or Scala site.

6. If you were compromised tomorrow, how quickly would you be able to ascertain exactly which users had their data compromised?

7. What provisions do you have to lock down your system (sacrificing availability for security) in the event of a confirmed compromise where you don't know the vector the attacker used?

8. Do you have administrative applications of any sort? Do admins access your server by SSH'ing into them? How are administrative channels exposed to the Internet? How many people are on your staff, and how many of them have any access to admin functionality?

9. Are all of your internal applications and system access (VPN, SSH, Github, &c) two-factor enabled, and all your users audited to ensure they're actually using two-factor?

10. Where do you get your email? Is everyone on your team two-factor enabled for their mail accounts? A sizable chunk of all compromised go [random app]->[employee email]->[password reset]->[whole system].

Hopefully this is helpful; this is the off- the- top- of- my- head list of questions I'd want to be able to answer if I was doing something that had the words "secure" and "financial" in its headline.

Looks interesting. I tried to do the same thing. I built an OAuth2 service that FI's could implement for building apps and I built a PFM that they could send data to (in realtime using Push/Webhook). I even have a client, but I've kind of given up on the idea of making a living doing this. I have zero sale/marketing skills, not to mention the fact that the competition is now way ahead, though mine still does a few things theirs doesn't.

This is helpful; I'll get you a good response when I have a good moment.