Members can securely connect their brokerage account(s) to track their securities on My Portfolio. Broker integration is provided via the Plaid network.
What is Plaid, and is it a reputable company?
Plaid is a secure, reputable financial technology platform (SOC 2 Type II certified) trusted by thousands of leading financial institutions that enables apps like the AAII Investor Hub to connect to users' brokerage accounts, allowing safe data syncing (like portfolio holdings) without ever handling or exposing login credentials. It powers these connections through an encrypted, OAuth-based authentication flow with independently audited infrastructure.
Can users control or limit what data is shared when connecting their brokerage through Plaid?
Yes, users have direct control at two levels:
Where is synced portfolio data stored, and how long does AAII retain it?
Portfolio data (holdings, quantities, values) is stored securely in AAII's SQL Server database. Plaid access tokens are stored encrypted. The portfolio data itself lives in AAII's own servers—not Plaid's—once imported. As soon as users unlink a brokerage account, all data is deleted.
What happens to a user's data if they disconnect their account—does AAII delete it, anonymize it or keep historical records?
When a user disconnects their brokerage account, they are given two explicit choices:
In both cases, Plaid's access token is immediately revoked and removed—AAII can no longer access the user's brokerage data.
How often does data sync, and how does AAII plan to communicate delays or discrepancies?
Syncing is user-initiated, meaning that data only updates when the user clicks the Sync button. There is no automatic background syncing. A sync cooldown period applies (once per 24 hours per portfolio under normal operation).
How does AAII use Imperva for site security, and what other safeguards are in place?
AAII's Investor Hub is protected by Imperva, an enterprise-grade web application firewall (WAF) and distributed denial-of-service (DDoS) protection platform. Imperva monitors all incoming traffic in real time, blocking malicious requests, SQL injection, cross-site scripting (XSS) and other attacks before they reach AAII's servers. All data transmitted between users and the AAII Investor Hub platform is encrypted in transit using TLS/HTTPS.
Does Imperva provide real-time threat detection and automated blocking?
Yes, Imperva provides real-time, automated threat detection and blocking. Suspicious traffic, known attack signatures and bot activity are identified and blocked automatically without manual intervention. The AAII team tunes rules to adapt to emerging threats.
