Who Is Exchanging Information

Three parties take part in every request, and each has a different worry to settle before any financial information moves.

The Attorney Needs a Complete Record

In lieu of a subpoena duces tecum — the order that commands a bank to produce records — the attorney sends a secure, one-time link asking for account statements and transaction history. Making the request is the easy part. Completeness is not: an account the other side rarely mentions is easy to miss, and a two-month gap in a stack of statements announces nothing. A discovery record is only as good as what it includes.

AttorneyEvery account. Every month.Checking — Bank ABrokerage — Bank BAnother account? Easy to overlook.A month or two of statements missing?A complete request removes the guesswork.
The attorney’s worry: an overlooked account, or a missing month or two of statements.

The Account Holder Stays in Control

Whoever receives that request needs a straightforward way to answer — grant access, and withdraw it just as easily later. Nothing about the grant is permanent or one-directional.

Attorneyrequests financial recordsAccount HolderGrant AccessRevoke Access↔The account holder can switch between these at any time.Either choice applies immediately to the attorney's access.
The account holder’s answer: grant access, or revoke it — either way, at any time.

The Bank Verifies Before It Shares

The bank wants to honor its customer’s wishes, but it cannot take a request at face value. Before any data moves, it confirms that the party asking is the one the account holder actually authorized — not merely someone who claims to be.

AttorneyHas the accountholder's tokenAnyone elseNo valid tokenVerifies the token matchesthe holder's authorizationauthorizedFinancial InstitutionWants to honor the holder's wishesData only moves once the institution confirms the requester is who theaccount holder actually authorized — not just someone who asked.
The bank’s condition: only a verified, account-holder-authorized permission unlocks the data.

One permission system settles all three concerns at once. The connection itself runs through Plaid — see Where the Data Is Stored .

How it works · 2 of 3 Next: Where Data Is Stored → The records stay at the bank. Civil Rule 26 keeps no one’s financial records.