What Delegate sees, stores, and never touches.

When you connect your bank, you do that inside Plaid Link — a flow operated by Plaid Inc., not by Delegate. Plaid is the open-banking provider used by Robinhood, Wealthfront, Venmo, and most modern fintechs.

• Plaid handles authentication. You enter your bank username and password into Plaid Link, or — at banks that support it — you authenticate via your bank's own OAuth screen. Either way, you authenticate at the bank, not at Delegate.
• Delegate never sees your bank credentials. Your bank username, password, MFA code, and any device-trust prompts pass between you, Plaid, and your bank. They do not pass through Delegate's servers and are not logged by us.
• OAuth where supported. For banks on Plaid's OAuth network (Chase, Capital One, Wells Fargo, USAA, and others), Plaid Link redirects you to your bank's own login screen, where your bank issues the authorization directly. Delegate has no visibility into what you type there.
• What Delegate receives. After you finish, Plaid issues a token. Delegate exchanges it server-side for a read-only access token used to read the specific account data we need to score (account type, balance, transaction summary, account-holder name).

We retain the minimum needed to produce, justify, and audit a verification verdict. We do not collect or store more than this.

The seven-year window matches the standard fraud-investigation retention period and what regulated financial-services partners require of their vendors. Customers can delete an individual end-user's record at any time on request; see "Data deletion" below.

• At rest: AES-256, applied at the volume level by our managed Postgres host. Backups are encrypted with the same scheme.
• In transit: TLS 1.2+ (TLS 1.3 in practice) on every leg — between your browser and Plaid, between Plaid and Delegate's backend, between Delegate's backend and the database, and between Delegate's backend and customer integrations.
• Field-level encryption for sensitive bank fields: Plaid access tokens and persisted account identifiers are wrapped with AES-256-GCM before being written to the database, so a database-level read does not expose them. rolling out
• Key management: encryption keys are held in the deployment platform's secrets store, never in source control, and rotated on a documented schedule.

You can revoke Delegate's read-only access to your bank account at any time, directly from Plaid — no email required.

• Already-recorded verdicts stay. Revoking access stops further reads; it does not erase the verification record that was already produced. To remove the verification record itself, request data deletion (next section).
• Continuous monitoring stops. If your account was being monitored on an ongoing basis, that stops the moment you disconnect in Plaid's portal.
• Per-bank revocation. If you connected more than one account, you can disconnect them independently in the same portal.

You have the right to request deletion of your data. Two paths, depending on what you want removed.

• If you connected your bank via a Delegate customer (e.g. an investment platform that uses Delegate to verify users): contact that company directly. They can delete your record via the Delegate API — that's the cleanest path because your relationship is with them.
• If you'd rather email Delegate directly: write to privacy@testdelegate.com. Include the email address you used to authenticate, the approximate date of verification, and the name of the company that asked you to verify. We will confirm receipt within one business day, complete the deletion within 30 days, and propagate it to backups within the following 30 days.
• What gets deleted: the verification record, all stored fields listed in "What Delegate stores" above, and any cached Plaid identifiers. The hash-chained audit log retains an entry recording that a deletion occurred (without the deleted contents) — this is required to keep the log's integrity property and is a standard pattern for audit-grade systems.
• Plaid-side data: deletion of records held by Plaid is governed by Plaid's own portal at my.plaid.com/portal. We can confirm we have asked Plaid to delete on our side, but the Plaid relationship is between you and Plaid.

Plaid is the only third party that touches your bank data. No marketing-tech, no advertising, no data brokers, no analytics-with-PII partners are involved in the bank-verification pipeline.

For full transparency, here is the complete list of sub-processors Delegate uses — including ones that touch infrastructure or billing but not bank data — so you can see the whole picture:

We update this list and notify customers at least 30 days before adding any new sub-processor that processes user data.

We try to be precise about what is in place versus what is in progress. Calling something "certified" before an auditor has signed a report would be misleading — so we don't.