How Permission Works
You have almost certainly done this before. When a website offers “Sign in with Google,” you sign in at Google — never at the website — and Google vouches for you without handing over your password. Banks use that same mechanism, called OAuth2, to let an account holder approve access to their own records.
Civil Rule 26 never asks for or stores an online banking username or password. The handshake runs between the account holder, their bank, and Plaid , which passes the result to the requesting attorney.
Three Agreements, Not One
The attorney asks, and the account holder consents. The account holder authorizes their bank to work with Plaid. Plaid issues the attorney a limited permission. All three have to be in place before any data moves, and no party can shortcut the other two.
The Password Never Leaves the Bank
The account holder enters their username and password on their bank’s own login page. That key moves in one direction only — account holder to bank — and is never shared with Plaid, the attorney, or Civil Rule 26.
The Attorney Gets Permission, Not a Login
Once the bank approves, Plaid issues the attorney a permission that works for this one request and nothing else. It allows a read-only, time-limited pull of the records the account holder agreed to share — not standing access to the account — and the account holder can withdraw it at any time.