[dml2135]

Sorry, maybe “third party” isn’t the correct term. Let me try to lay out my point a bit more clearly:

Plaid’s business model is — Company A needs a consumer’s data from Bank B. Plaid takes the consumer’s banking credentials, gets the data, and sells it to Company A.

At no point in this process does Plaid go and sell this data to another unrelated Company C. The lawsuit cited was about Plaid not sufficiently explaining its position between Company A and Bank B to the consumer. It was not about Plaid going and selling the data to the highest bidder.

[salawat]

How do you think they made money? It certainly wasn't from licensing their SDK that intentionally spoofed 3rd patry banks in a way that deliberately misled users into assuming they were logging in with the bank directly instead of handing Plaid an access token that allows them to exfiltrate arbitrary transaction histories.

Any time you hear yourself utter the words "Wouldn't x be f'd if word got out that y"... You need to stop and consider that there is an entire industry around reputation management, and PR crisis management that is leverageable by the deep pocketed in order to keep their name out of news items, and that the favorite acquisition of the absurdly deep pocketed is the media outlet/platform.

Think. The world is full of scummy people looking to make a buck, and a much more pauce number eho worry about doing so honestly. Until you meet one of the rare ones who falls on their sword for their ideals, never assume the guy on the other side of the table is one until proven through deed.

[dml2135]

They make money through the fees they charge companies that pay for their service, so that they can get banking data from their consumers. Those fees are not cheap, so I do imagine they are doing most of the work to sustain the business right now.

I’m not saying “you should trust Plaid with your data” — absolutely, 100% not that. I imagine that’s how I’m being interpreted, hence all the downvotes.

What I’m saying is that at the present time, it does not seem to me that Plaid would be incentivized to do something that they explicitly say they are not doing. Plaid’s business model is, trust us to get your customers data and deliver it to you, and only you, safely. Selling it to Bob down the street on top of that would threaten their primary business model. And today, that primary business model is doing very well! So why threaten it?

Now, someday in the future, maybe that business model has stagnated, and line still needs to go up, so someone may get greedy and that may change. In fact, this is even likely to happen! But there will be signals that it is coming.

Even re: the issue of misleading users that they are not their bank — after they got slapped down on that one, their strategy changed. There is a new set of regulations around disclosure around these things, and Plaid is pushing them pretty hard. My guess is they had some hand in drafting these regs and are hoping to use a higher regulatory burden to build a moat against competitors.

But honestly, I’m kind of surprised at the lack of nuance in understanding how Plaid works, especially here on HN.

[mike22]

The value prop of Plaid, Yodlee, et al is that they can do this with one(-ish) API surface for tens of thousands of financial institutions. In their efforts to ensure Bob down the street won’t be sold any data, they do treat each customer (of the API, not the end users they pull data on behalf of) as an isolated tenant.