https://www.law.cornell.edu/cfr/text/31/part-363/subpart-B
From a brief reading, having a third party access your TreasuryDirect account does seem problematic:
https://www.law.cornell.edu/cfr/text/31/363.22
https://www.law.cornell.edu/cfr/text/31/363.17