Consent at the point of trust.
Customers authenticate and approve access inside their bank or mobile wallet’s trusted channel. DataLink never receives their password, PIN or OTP secret.
The permission contract
Every request must make six things unambiguous before authorization.
Security boundaries
DataLink manages
- Permission state and evidence
- Canonical financial models
- Partner scopes and access
- Audit and lifecycle events
The provider manages
- Customer authentication
- Account selection
- Final consent presentation
- Signatory and security policy
Least data by design
DataLink retrieves and returns only what an active permission requires. Verification results are preferred over raw data where raw transaction details are unnecessary. Access after expiry or revocation is rejected.
Credentials never stored
Banking passwords, wallet PINs, OTP secrets, security answers and biometric templates remain outside DataLink.