Plaid CTO here. This is not accurate. On 1. We do not (and have never) sell data to third parties. On 2. We have been a proponent of open authentication standards like OAuth and App2App and today, a majority of our bank connections run via bank APIs - in fact, as Zach pointed out, we’ve helped many financial institutions move towards OAuth. We don’t want to handle credentials in the long-term. However it will take years for a full transition to APIs to happen with more than 11k banks in the United States and we feel that it's important to support the tens of millions of Americans who bank at those institutions.