Where the Data Is Stored

The records stay with the banks, credit unions, and brokerages that issued them, and move only as far as the account holder’s authorization allows. Civil Rule 26 keeps a copy of only what an attorney ordered, and only until the date they set.

The bank keeps the records

Every statement and transaction stays with the institution that issued it, wherever in the world that institution sits.

Financial InstitutionHolds all account statementsand transaction historyNo copies exist outside the institution until access is granted.
All financial data resides at the financial institution that issued it.

The account holder grants permission

The username and password are entered only at the institution’s own login page. Plaid, the attorney, and Civil Rule 26 never see them. What the approval creates instead is a permission record — held and managed by Plaid, and tied to one specific attorney.

provides securitycredentialsprovidesapprovalprovidesaccess tokenAccount HolderFinancialInstitutionPlaidAttorney
The account holder’s credentials and approval stay with the bank, which lets Plaid issue the attorney a permission record.

The attorney reads, and only reads

The attorney uses that permission to retrieve the authorized records from Plaid, and from nowhere else. Those records are used for the matter at hand and are not passed on to anyone else.

AttorneyViews data viathe access tokenpresents access tokenreturns financial informationPlaidAggregates financial datafrom the account holder's banksand holds it in one place
The attorney uses that permission to view the financial information Plaid retrieves.

A copy, kept only as planned

Civil Rule 26 copies the records the attorney ordered and keeps them, the statements encrypted, for the attorney to download. Each institution is then disconnected, at the end of the calendar month it was linked in or after the months the attorney chose, and the copy is deleted on the date the attorney set when ordering, at most a year after it was made. The account holder can delete it sooner from their own portal.

Plaid is the financial data network that makes this possible — it connects banks, brokerages, and financial apps under a shared set of agreements. See who uses Plaid on Plaid’s own site.

How it works · 3 of 3 Next: How Permission Works → The account holder signs in at their own bank and approves one request. No password changes hands.