Magdalena O'Doherty • HAS Wealth Management

Please verify your identity below to securely connect or refresh your external financial accounts via Plaid Link.

Install Mobile Companion (iOS / Android) →

HeldAway.io Privacy, CFPB Section 1033 Data Authorization & NIST SP 800-88 Disposal Policy (v2.4-2026-10):

1. Scope of Collection (Read-Only): HeldAway.io collects strictly read-only account metadata, balances, and up to 24 months (730 days) of transaction history via Plaid Link solely to normalize and transmit data to your designated financial advisor.
2. Non-Reseller & Zero Credential Storage: HeldAway never sees, collects, or stores your banking username or password, and never sells, licenses, or syndicates consumer financial data to third parties.
3. 90-Day Consent Lifecycle & Rolling Retention: Your authorization remains valid for 90 days under CFPB Section 1033 and may be renewed via Plaid Link Update Mode. Transaction records older than 730 days are purged daily.
4. Immediate Self-Service Revocation & Cryptographic Disposal: Clicking "Disconnect & Delete My Data" immediately invokes Plaid /item/remove, purges all associated accounts and transactions from our encrypted databases and caches in under 60 seconds, and issues a tamper-evident NIST SP 800-88 WORM Cryptographic Disposal Certificate.

Multi-Factor Authentication Required

Verify your identity to continue

To protect your financial data, HeldAway requires phishing-resistant multi-factor authentication before launching Plaid Link.

WebAuthn / FIDO2 hardware-bound biometric verification

or enter authenticator code

6-digit Authenticator Code

Protected by NIST SP 800-63B AAL2/AAL3 Code expires in 05:00

Financial Institution Connections

Pure Connection, Health & CFPB Section 1033 Consent Management

🔒 Locked until MFA verified