financial BFFSECURITY OVERVIEW
Identity, workspace data, bank connectivity, infrastructure, monitoring, and recovery are separated so no single control carries the whole burden.
Amazon Cognito verifies email and enforces a minimum 14-character password with uppercase, lowercase, number, and symbol requirements. Authenticator-app MFA is mandatory. OAuth uses authorization code flow, PKCE, nonce, one-time state, and browser binding.
After authentication, the app issues a random opaque session in a Secure, HttpOnly cookie. Only a one-way digest is stored server-side. Sessions expire and can be revoked.
The server selects the workspace for every request. PostgreSQL row-level security is forced for tenant tables, and the runtime role cannot bypass it. Permission checks run on the server.
Cloudflare, CloudFront, and AWS WAF protect the edge. Origins are private, direct API calls are rejected, and the database has no public access or inbound rules. KMS protects databases, secrets, tokens, and backups.
HOW PLAID CONNECTIONS WORK
You select an institution and authenticate in Plaid or the institution’s OAuth page. You choose the accounts to share. Financial BFF receives authorized account data and a revocable access token—not your bank username or password.
The platform Plaid secret remains encrypted in AWS Secrets Manager. Each customer access token is encrypted again using AWS KMS with a workspace-bound encryption context. Tokens never go to the browser.
You can disconnect a source in Financial BFF and may manage supported connections through Plaid Portal. Plaid’s processing is governed by its End User Privacy Policy.
A short-lived token identifies the approved use and return URL.
Plaid or your bank handles the credentials.
A temporary token is exchanged server-to-server.
Only backend services in that workspace can use it.
DEFENSE AND RECOVERY
Least privilege, MFA, secure headers, validation, origin checks, webhook signatures, and encrypted secrets.
CloudTrail, GuardDuty, Security Hub, Config, Access Analyzer, audit events, and operational alarms.
Aurora backups, DynamoDB point-in-time recovery, versioned storage, deletion protection, and retained keys.
Protect email, MFA, devices, and bank access; review connections; and report suspicious activity promptly.
No online service can guarantee that unauthorized access, outages, data errors, or third-party incidents will never occur. These layered safeguards are designed to reduce likelihood and impact.
Report concerns to [email protected]. Never email passwords, MFA codes, full account numbers, or access tokens.