Link Security

Link lets you connect your financial accounts to the software you choose, and choose how that connection is made. This page explains how Link protects those connections, what happens to your banking credentials, and how to report a problem.

Link is a service of Maxint Inc. (“Maxint”). The protections described on the Maxint Security page apply to Link, as they do to all Maxint services. This page adds what is specific to Link. If the two pages ever appear to differ, this page controls for Link, and Maxint will correct the inconsistency.

Link is also called Maxint Link on other Maxint pages.

The short version

• You choose the route. Link names the connection provider before you approve anything: Link’s own connection (Link Direct) or a third-party provider such as Plaid, Stripe Financial Connections, Teller or GoCardless Bank Account Data, where that provider covers your bank.
• Tokens, not passwords, by default. With Link Direct, your credentials are exchanged for an access or session token, and the original credentials are not kept.
• One exception, stated up front. Some banks offer no usable way to renew access. For those banks, keeping the connection working means Link must keep your credentials. Link tells you before you connect, asks you to acknowledge it, and lets you choose another provider or not connect.
• You choose what is shared. You pick the accounts and the types of data the receiving app gets.
• You can disconnect. Disconnecting stops Link from using the connection. What happens at your bank or provider depends on what they support, and Link tells you.
• Link reads data. It does not move money. Link does not initiate payments or transfers.
• Third-party providers follow their own security practices. When you choose one, its sign-in flow and its policies apply.

1. How Link connects to your bank

A connection reaches your bank by one of these routes. You see the route before you approve anything.

Link Direct. Link connects through your bank’s own production APIs: the interfaces your bank’s app and online banking use, running on the bank’s own infrastructure. Link does not scrape web pages, and does not read your bank’s website as you.

What this means for security, stated plainly:

• You sign in within Link’s flow, with the same sign-in details you use for your bank online. Your bank checks them, just as it does when you sign in yourself.
• Data arrives as structured responses from the bank’s systems, not text read from web pages.
• Link Direct does not depend on a partnership with your bank. A Link Direct connection does not mean your bank has partnered with Link, approved Link, or endorsed it. Your bank may treat a Link Direct sign-in like a sign-in from a new device. Whether it shows you a new-device or new-sign-in alert depends on the bank.
• When a bank changes its app or online banking, Link updates its integration. Until it does, a connection may stop working and ask you to reconnect.

Open banking and bank partnerships. Where your bank offers a regulated open-banking interface, or has agreed terms with Maxint, you approve access on your bank’s own website or app. Link does not receive your credentials on this route. Today, open-banking connections are made through third-party providers, such as GoCardless Bank Account Data in the UK and EEA. Maxint is pursuing its own open-banking access and bank partnerships alongside Link Direct.

Third-party providers. Plaid, Stripe Financial Connections, Teller and GoCardless Bank Account Data each use their own sign-in flow. See section 6.

2. Your credentials, stage by stage (Link Direct)

Every connection moves through five stages. This is what happens to your credentials at each one.

Where your credentials go. Link’s sign-in screen is a page hosted by Maxint. The app you are connecting to cannot read what you type into it. Your credentials travel, encrypted, from your device to Maxint’s servers, which pass them to your bank. They are held in memory only for the exchange, and are never written to logs, error reports, analytics or backups. The only time credentials are stored is the exception below, for banks that provide no way to renew access.

The exception: when your credentials must be kept

Some banks offer no usable way to renew access once a session expires. The only way to keep the connection working is to sign in again, which needs your credentials.

For those banks only:

1. You are told before you connect. Link shows, before you enter anything, that this bank requires your credentials to be kept.
2. You must acknowledge it. Link will not keep your credentials unless you explicitly confirm that you understand.
3. You can choose otherwise. You can pick another provider that covers your bank, if one does, or decide not to connect.
4. Kept for one purpose. Link uses the kept credentials only to sign in again and keep this connection working. (This is stated for Maxint Link on the Maxint Security page.)
5. Stored encrypted. Kept credentials are stored encrypted. (Also stated on the Maxint Security page.)
6. Deleted when no longer needed. Kept credentials are deleted immediately when you disconnect in Link, when you close your Maxint account, when the app you connected ends its Link integration, or when your bank gains a way to renew access and the connection moves to it. They are also deleted after 90 days in which the connection is not used. Deleted credentials cannot be recovered, including from backups.
7. If you change your password. The kept credentials stop working. Link will ask you to reconnect, show the exception again and ask for a fresh acknowledgment before keeping the new credentials.

Specific protections for kept credentials, beyond encryption:

• Encryption keys for credentials are separate from the keys used for other data.
• Keys are held in a managed key service or hardware security module, and are rotated on a schedule.
• Credentials are decrypted only by the service that signs in to the bank, only at the moment of sign-in, and never shown to Maxint staff.
• Every decryption is recorded in an audit log, which is kept for 12 months.
• Kept credentials are covered by independent review: Link is within the scope of Maxint’s SOC 2 Type II report (see section 7).

3. Tokens and the data they reach

You choose the scope. Before connecting, you pick which accounts to share and which types of data the app receives: account and routing details, balances, transactions, account-holder identity, or investment holdings, depending on your bank and route. Link sends the app only what you chose.

Read, not move. Link retrieves information. It does not initiate payments, transfers or other changes to your accounts.

An honest note about Link Direct tokens. On open-banking routes, the bank itself limits the token to the data you approved. On Link Direct, the token your bank issues is the kind its own app uses, and the bank may not limit it to particular data. On that route, the limits you set are enforced by Link’s systems: Link uses the token only to read the accounts and data types you approved, and only to keep this connection working. Link Direct integration code can call only read operations, every integration is reviewed before release, and Link monitors for calls outside the approved scope.

How tokens are protected. Tokens are stored in Maxint’s databases, which are encrypted at rest with AES-256, and travel over connections encrypted with TLS 1.3, as described on the Maxint Security page. Link’s token store and Link Direct services sit inside these controls, and tokens are also encrypted at the application level. Connections from Link to banks are encrypted with TLS; the version on the bank’s side is set by the bank.

Tokens are never given to the app. The app you connect receives your data from Link, not your bank token.

4. Disconnecting

You can see each connection — the app, the account, the route, the data shared and the credential status — and disconnect it.

When you disconnect:

• Link stops using the connection, and the app stops receiving data through it.
• Link deletes the token immediately.
• If Link kept your credentials under the exception, they are deleted as described in section 2.
• Where your bank or provider supports it, Link also asks it to cancel the token. Whether the token is cancelled at the bank or provider depends on what they support.
• You can also review and remove connected apps in your bank’s own settings, where your bank offers this.

Data the app already received is held by that app under its own policies. Disconnecting stops new data; it does not recall data already shared.

5. Changing route

Switching a connection to a different route or provider means approving access again on the new route. Nothing moves silently. The previous route’s access is ended as described in section 4.

6. Third-party providers

When you connect through a third-party provider, you sign in through that provider’s flow, and it handles your credentials, tokens and data under its own security practices and policies. Link does not receive your bank credentials on these routes. This is true for every provider, including provider flows that open within Link’s flow.

Link shows each provider’s sign-in method before you approve, so you can read its policies first. A provider’s availability and methods vary by bank and region. Maxint reviews providers before offering them as a route.

7. How Maxint protects Link

These measures come from the Maxint Security page, which states that they apply across Maxint’s services.

Independent verification. Maxint is SOC 2 Type II verified. The Maxint trust center (https://maxint.trustshare.com/) shows which services the report covers, and you can request the report there under a confidentiality agreement. Link is within the scope of that report.

Encryption. Data in transit between your devices and Maxint’s servers uses TLS 1.3. Databases, document storage and backups are encrypted at rest with AES-256.

Least-privilege access. Internal access to production systems is limited by role, requires hardware security keys, and is logged. Systems holding Link tokens and kept credentials are limited to a smaller set of authorized staff, and each access needs approval.

Network edge. Maxint’s services run behind Cloudflare’s global network, including DDoS mitigation.

Monitoring. Automated monitoring, anomaly detection and regular vulnerability scanning.

Resilience. Data is replicated and backed up, and Maxint tests its ability to recover it.

Incident response. Maxint maintains an incident response process. If a security incident affects your personal information, Maxint will notify you and the relevant authorities as required by law. For developers and businesses that integrate Link, notice of incidents affecting personal data we process for them follows the Data Processing Addendum.

People. Maxint staff undergo background checks, sign confidentiality agreements and complete security training.

Service providers. Maxint’s service providers are listed on the Subprocessors page. For Link, these include Cloudflare (hosting, network security and DDoS protection) and useSend (email delivery), both listed there for all services, and Microsoft Azure (cloud infrastructure).

8. This website (link.maxint.com)

• Hosting. The site runs on Cloudflare. Pages are static; only the subscription form runs code on the server.
• No trackers. The site uses no analytics or advertising trackers and sets no cookies of its own. Cloudflare may set strictly necessary security cookies. The documentation stores your light or dark theme choice in your browser.
• Self-hosted fonts. Fonts are served from the site itself, so loading a page makes no requests to font services.
• Subscription form. The server checks every submission against the same rules as the form, rejects submissions sent from other websites, limits how often one network address can submit, and uses a hidden field to filter automated sign-ups. Subscriptions are stored with useSend, which also sends the confirmation email. useSend records whether our emails are opened and which links are clicked, and we use this to understand how our emails perform. See the Link Privacy Notice.
• The demo at /demo uses demo data only. Nothing you type there leaves your browser. Don’t enter real credentials.
• Security headers. Every page is served with HTTP Strict Transport Security, a Content Security Policy that allows content only from link.maxint.com itself, and headers that block framing, MIME sniffing and unneeded browser features such as camera, microphone and location.

9. For developers and businesses

Link is live at link.maxint.app, where developers manage their Receiving Apps and keys. The API reference and the security model for integrators are available to developers in their Link account. They cover:

• How your application authenticates to the Link API, and how keys and secrets are issued, rotated and revoked.
• How Link verifies that a completed connection belongs to your session, and how its webhooks are signed.
• Separate sandbox and production environments, with no real bank data in the sandbox.
• Your responsibilities for protecting the data your application receives, set out in Part B of the Link Terms.
• Security reviews and documentation available to business customers, including the SOC 2 report through the trust center, and the Data Processing Addendum, which covers Link.

Security, audit and compliance questions: security@maxint.com.

10. What Link will never do

• Ask for your banking password by email, phone or chat. The Maxint Security page states this for all of Maxint. Link asks for bank sign-in details only inside its connection flow.
• Keep your credentials without telling you first. Retention happens only under the exception in section 2, after you acknowledge it.
• Pick a provider for you without showing it. Link names the route before you approve anything.
• Switch your connection to a different route silently. A new route needs your approval.
• Scrape your bank’s website. Link Direct uses the bank’s own APIs.
• Share data you didn’t choose. The app receives only the accounts and data types you selected.

As the service works today, Link also does not initiate payments or transfers.

11. What you can do

• Check which provider and route Link shows before you approve.
• Share only the accounts and data the app needs.
• Review your connections from time to time, and disconnect the ones you no longer use.
• If your bank lets you review connected apps or devices, check that list too.
• Be wary of anyone asking you to sign in or share a code outside a connection you started yourself.
• If you think a connection was made without your permission, disconnect it and contact your bank and security@maxint.com.

12. Reporting a vulnerability

Maxint welcomes reports from security researchers. Link is covered by Maxint’s vulnerability disclosure process on the Maxint Security page, including its testing guidelines and its commitments to researchers who follow them in good faith.

If you believe you have found a vulnerability in Link, link.maxint.com or the Link documentation, email security@maxint.com with a description, the steps to reproduce it and its potential impact.

Link connects to systems Maxint does not own. When researching Link:

• Test only against Maxint’s own systems: Link, link.maxint.com and Maxint’s infrastructure.
• Do not test against banks’ systems or third-party providers’ systems through Link. Maxint cannot authorize research on systems it does not own. Report issues in those systems to the bank or provider directly.
• Use only bank accounts you own, and do not try to access anyone else’s connections, tokens or credentials.
• Do not enter real credentials in the demo, which never contacts a bank.

Our contact details are also published at link.maxint.com/.well-known/security.txt. Maxint does not offer a bug bounty.

13. Contact

Security questions, audit requests and compliance inquiries: security@maxint.com. How Link handles personal information: the Link Privacy Notice, which supplements Maxint’s Privacy Policy.

Maxint Inc.