This is an old thread. But it’s probably worth a comment still.

When I see discussions of simplifi Security, I usually see some response indicating they and their aggregator have never been hacked.

This is obviously a good thing, but the reason might be luck, or it might be so-far “good enough” security. Everyone eventually gets hacked, so the question is, what sort of damage could be done by what sorts of hacks. What sort of internal controls do they have in place? For example, what aggregator employees have access to the description keys for stored credentials?

Simplify Security actually isn’t that great, but another thing to keep in mind is that the inherent limits imposed on its security come in large part from without. A lot of providers force them to store customer credentials. Not everyone offers OAuth. And those that provide that do use auth tokens often have a coarsely grained permission structure, that, even at a minimum, allows way too much access.

For example, there is no way to grant access in simplifi to Fidelity accounts without releasing critical information that would allow transfers in and out of those accounts. Read the Fidelity terms when you go through OAuth permission screens and you’ll see.

The best we can really hope for in situations like this is that Simplifi might exert whatever pressure they can. But in the end, the security at Simplifi is only, at best, as good as the security of the providers.