I'm concerned because you don't really answer the question, which suggests the answer to the question is probably yes.Hi Willnot, thanks for asking about this. The answer is "no."
So the definitive answer to your question is that the systems we employ, both as an independent organization and one which utilizes the services of other organizations, not only prevent human access to your information (the "can a yodlee/mint/whoever employee see my login & pw" part), but also prevent data access through security equalling, if not exceeding, that of your own banks' websites.From a process point of view we’re constantly audited by all of our customers to ensure that we have the utmost security policies and practices, including:
- We encrypt everything between your browser and our servers using industry standard 128bit SSL encryption.
- After it gets to our side, it is protected by multiple layers of firewalls - the number of which I cannot tell you for security reasons, nor the vendors, but we use many and many vendors.
- All sensitive field data is encrypted and stored in our databases encrypted internal to the tables with multiple rotating keys.
- All databases are protected from employee access both physically and logically.
- All databases are encrypted physically, and all drives and tapes are encrypted with different keys.
- No employee can put any content on any unsecure machine (i.e., nothing can be taken from the database and put on a laptop).
- All servers are customized and utilize an ultra locked down version of linux.
- Multiple layers of intrusion detection systems both software and people running 24×7.
- Automated software auditing of our source code to check for problems in the code.
- Background checks for all employees.
- Auditing of all servers.
- Continuous security training.
- Dedicated security office with the authority to shutdown any system to investigate a breach.
- Systematic engagement of ethical hackers to attempt to break into our systems.
Aside from background checks for your employees, what do you do to protect my information from the threat of a rouge employee?We don't discriminate on the basis of skin color. But any employee, even a rouge one, does not have access to sensitive information, including login and password, any of your accounts. If you can clarify the question, I can be more help...otherwise it's covered in the previous posts and the yodlee blockquote above.
What would be great is if there was a way for the bank accounts to assign read-only account access that I could give to services like Mint in the same way they will let me generate one-time use credit card numbers. Are you guys working on anything like that? I bet that would seriously improve your new account numbers.We don't comment on future plans, so I can't confirm or deny that. Maintaining customer trust is a priority for us, and perceived security probably comprises 95% of that trust. To me, personally, there is no bigger user experience barrier than the perceived loss of control (or total freakout) when allowing a 3rd party access to your financial information. People are content with giving their social networks enough info to open credit cards in their names, but we're held to a higher standard. What I can say is that we'll continue to introduce new technologies, practices, and systems that further alleviate customer concerns and keep your data extremely safe.
posted by ishotjr at 7:10 AM on May 27, 2009