Data Authority

Data security and privacy are becoming common discussion topics in our country. In the wake of hacking scandals related to the last election, Big Bank data leaks, and numerous other breach events, people are realizing that these concepts affect them every day in real ways. Given all of that, we thought it appropriate to share our stance.

In our view, data security and privacy are strongly related to concepts of authority and control. Having authority over data means being able to control who can access that data and what they can do with it. Security is a requirement of establishing and retaining control. When it comes to personal information, especially the extremely sensitive information generated by or collected by financial or medical systems, data authority matters to people in a big way.

At Final, we view our customers as authorities over their data and we see ourselves as responsible stewards of that data. In a nutshell, our philosophy around customer data is: It’s your information, we protect it.

This stance is a direct result of how vulnerable we founders felt after the Target breach, and it strongly informs the way card number generation works in the Final products. With a traditional payment card, giving out your number is tantamount to giving out your username and password. The only difference in privilege between you and the merchant you give it to, is that they can’t pay your bill. That effectively makes you a custodian of that number and your account, not a real owner, which seems pretty messed up. Final’s multiple numbers, and the associated ability to cancel or restrict them with ease, dramatically changes that. The multiple numbers provide convenience and peace of mind, but they aren’t really about that. The multiple numbers are about data authority; they are about turning our customers into the true owners of their accounts.

This core philosophy informs all of our feature development and all of our security practices. It influences our password policy, is the reason for our insistence on using secure authentication for our customers, and is pretty evident to anyone who’s ever spoken to our support team. Pretty soon, we’ll show that it’s central to how we look at enabling customers to securely share their accounts with family, and with other helpful services.

The latter of these, sharing with other helpful services, represents an entirely new class of feature: third party integrations. Over the last year, many customers have requested the ability to use things like Mint or Expensify with their Final accounts. Given the potential utility and potential risk of exposing customer data to third parties, we’ve spent a while thinking about how to do it right.

When we roll out integrations, Final customers will be able to easily grant and rescind account access permission to individual services, much like they can already grant and rescind the ability for a merchant to charge them with multiple card numbers.

To start, integrations will enable read-only access to a very limited set of account data, and only when a customer explicitly grants it. Over time, we’ll expand the types of data customers can share (or not!) with integrators.

We hope that integrations will grow to be a powerful and extensible part of Final’s offering and that it demonstrates, as all of our features should, our dedication to the idea that customers must be in control of their data.

If you like our approach and want to help us build amazing financial products that protect customer data sovereignty, or if you just have something to say, email us at security@getfinal.com. We welcome your thoughts.