security & trust

Security & trust at Quiltt

Quiltt is the open banking infrastructure layer that connects fintech applications to bank data through a single API, routing across multiple aggregators like Mastercard Open Finance (Finicity), MX, Akoya, and Plaid. Because we sit between your product and your users' financial institutions, how we're built matters as much as how compliant our practices are.

This page describes both. For engineering documentation, our SOC 2 Type 2 report, penetration test results, and completed security questionnaires, visit our Trust Center
Visit the Trust CenterSee attestations
Architecture

You own your aggregator credentials

When you integrate Quiltt, we provision dedicated production API keys for every aggregator you use. Those keys belong to you. They aren’t pooled or shared with other Quiltt customers.
This has three consequences that matter in a security review:
Isolation
Your aggregator traffic authenticates under credentials issued to you alone. Another Quiltt customer's activity, incident, or rate limit cannot reach your data, because it does not transit your credentials.
Blast radius
A compromise scoped to one tenant's credentials is scoped to one tenant. There is no shared production key whose exposure would affect every customer on the platform simultaneously.
Portability
You own your keys, your users, and your data. If you stop using Quiltt, you take the keys and keep the connections. There is no re-authentication event forced on your users and no data you have to leave behind.
Some vendors in this category operate the opposite way — a single set of production credentials shared across their entire customer base. That model makes the vendor the account holder of record for your users, which turns migration into a full re-permissioning of every connection. Ask any provider you evaluate whether the aggregator keys are issued to you or to them.
Source: Fathom — Natansh Bhamba call, 2026-06-10, 03:43. Mark: "we give you dedicated production keys for every single aggregator you're going to be using. You own those keys… you get to keep your users in your data."
01
Credential flow
Quiltt is never in the credential flow
We do not receive, process, or store your end users' bank credentials.

When a user connects an account, Quiltt renders a single institution search across every provider you've enabled. Once the user selects their bank, authentication happens with the institution or the underlying aggregator directly:
Direct bank OAuth:
The user is handed off to their bank's own site or mobile app and authenticates there. Credentials never leave the bank's domain.
Aggregator-hosted flow:
Where a bank offers no OAuth endpoint, credentials are entered into the aggregator's own hosted interface.
In neither path does a credential pass through Quiltt infrastructure. This is a structural property of the integration, not a policy we enforce on ourselves — there is no code path in which we hold one.
Source: Fathom — Natansh Bhamba call, 2026-06-10, 00:06.
02
Routing
Direct bank connections are preferred over screen scraping
We do not receive, process, or store your end users' bank credentials.
When a user connects an account, Quiltt renders a single institution search across every provider you've enabled. Once the user selects their bank, authentication happens with the institution or the underlying aggregator directly:

25,000

login portals across enabled providers

9,000+

of those served over OAuth connections
Every connection served over OAuth is one fewer set of credentials in circulation anywhere in the chain.
03
Audit surface
One integration, one audit boundary
Running aggregators directly means a separate contract, a separate integration, a separate set of stored credentials, and a separate vendor security review for each one. Consolidating through Quiltt collapses that into one integration to defend, one credential set to rotate, and one vendor to diligence — while still giving you multi-aggregator coverage and redundancy underneath.
04
Data model
Account and routing numbers are tokenized across every provider
Account and routing numbers are tokenized uniformly across all providers, normalized into a single data model regardless of which aggregator served the connection. Raw account and routing numbers are available where your use case requires them — ACH origination, for example — as an explicit request rather than a default.
You also receive the underlying provider's raw response unmodified alongside the normalized model, so you are never dependent on our transformation layer to audit what a provider actually returned.
05
Brand
Quiltt is invisible to your users
The connection experience carries your branding, not ours. Your logo, your configuration. Beyond brand consistency, this means Quiltt introduces no third-party name into the moment your user is deciding whether to trust the connection.

25,000+

login portals reachable across enabled providers

9,000+

of those served over direct bank OAuth

1

integration, one contract, one credential set to rotate

0

code paths where Quiltt holds a user credential
COMPLIANCE

Attestations and controls

Quiltt maintains a SOC 2 Type II attestation. The full report, penetration test results, and completed security questionnaires are available under NDA through our Trust Center.
Request Trust Center access
SOC 2 Type II
Attested. Report available under NDA via the Trust Center.
Encryption in transit
TLS
Encryption at rest
AES-256
Identity verification (KYB/KYC)
AES-256
Penetration testing
GDPR / CCPA
DPA availability and posture
ISO 27001
Quiltt maintains a SOC 2 Type II attestation. The full report, penetration test results, and completed security questionnaires are available under NDA through our Trust Center.
data handling

Data Handling

What we touch
Account balances
Account owners
Transactions
Account and routing numbers
Investment holdings and liabilities
Scoped to the data products you explicitly enable in your admin dashboard. Products you have not enabled are not retrieved.
Data residency
United States
Canada
U.S. and Canadian consumer financial data is stored in the U.S. or Canada as applicable. If your infrastructure runs outside North America, U.S.-region hosting or proxying is required; we'll review your architecture with you during onboarding.
Retention and deletion
Hosting
Internal tenancy model
subprocessors

Data aggregation, enabled per customer

Each customer chooses which providers are active on their account.
Full subprocessor list including infrastructure and enrichment providers.

Reporting a vulnerability

We welcome reports from security researchers. Email security@quiltt.io [VERIFY address exists and is monitored]. We commit to acknowledging reports within [VERIFY] businessdays. Please do not test against production data belonging to other customers.
Report a vulnerability

Frequently asked questions

Visit the Trust Center
Does Quiltt store end users' bank credentials?
-
No. Users authenticate directly with their bank via OAuth, or with the underlying aggregator's hosted flow. Credentials do not pass through Quiltt infrastructure.
Is Quiltt SOC 2 compliant?
-
Quiltt maintains a SOC 2 Type II attestation. The full report is available under NDA through the Trust Center.
Does Quiltt share API keys between customers?
-
No. Each customer receives dedicated production keys for every aggregator they use, and owns those keys. Keys are never pooled across customers.
Can we migrate off Quiltt without losing our users' connections?
-
Yes. Because the aggregator keys are issued to you, you retain your keys, users, and data if you leave — with no forced re-permissioning of end users.
Can we use our own Plaid account?
-
Yes. Plaid runs on a bring-your-own-keys model under your own Plaid agreement. MX, Finicity, and Akoya are available through Quiltt as a reseller.
Is Quiltt an aggregator?
-
No. Quiltt is a routing and normalization layer over multiple aggregators, and a reseller of them — not an aggregator itself.
How do we request your SOC 2 report or a completed security questionnaire?
-
Through the Quiltt Trust Center, where access is granted under NDA.
TRUST CENTEr

Need deeper documentation?

Our Trust Center hosts the SOC 2 Type II report, penetration test results, security policies, and completed vendor questionnaires, available under NDA. For architecture review with our engineering team, contact us.
Visit the Trust CenterContact Us