{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"7f520876-dff7-41c0-8948-6b7a521c14f6","screeningDate":"2026-07-06T22:09:09.385Z","publicationGate":"published","company":{"id":"51f8db0f-3aef-472e-91d7-da30b3ceec4d","name":"Plaid","slug":"plaid","industry":"FinTech"},"policy":{"id":"27d27c1e-b79f-4db4-828c-d79bfa690210","name":"End User Services Agreement","type":"terms","jurisdiction":"US","sourceUrl":"https://plaid.com/legal"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T09:39:08.879Z","retrievalChannel":"other","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":null,"current":{"version":1,"sha256":"2a9ca0b926c6909aabdf0ab62feab4aac8a4b0e0bb5d710d4fa70cad871f7e19","capturedAt":"2026-07-06T22:09:09.381Z"}},"assessment":{"summary":"This agreement limits Plaid's liability, grants them broad termination rights, and refers data use details to separate privacy policies.","overallRisk":"High","overallScore":8,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"alert","textEn":"Plaid disclaims all warranties, providing the platform \"AS IS\" and \"AS AVAILABLE.\"","textIt":"Plaid declina tutte le garanzie, fornendo la piattaforma \"COSÌ COM'È\" e \"COME DISPONIBILE\".","deltaScore":-2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"alert","textEn":"Liability is capped at $100 or amount paid, severely limiting user recourse for damages.","textIt":"La responsabilità è limitata a $100 o all'importo pagato, limitando il ricorso dell'utente.","deltaScore":-3,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"alert","textEn":"Plaid can terminate your service without notice or reason, with no liability to you.","textIt":"Plaid può terminare il servizio senza preavviso o motivo, senza alcuna responsabilità per te.","deltaScore":-3,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Plaid connects your financial accounts to third-party apps, but explicitly disclaims responsibility for those apps.","textIt":"Plaid collega i tuoi conti finanziari ad app di terze parti, ma declina esplicitamente la responsabilità per tali app.","sentiment":"neutral"},{"textEn":"Your financial data usage details are found in a separate Privacy Policy, not fully covered here.","textIt":"I dettagli sull'uso dei tuoi dati finanziari si trovano in una Politica sulla Privacy separata, non completamente coperta qui.","sentiment":"negative"},{"textEn":"Plaid has broad rights to terminate your service and significantly limits its own liability for damages.","textIt":"Plaid ha ampi diritti di terminare il servizio e limita significativamente la propria responsabilità per i danni.","sentiment":"negative"},{"textEn":"You must follow a multi-step negotiation process to resolve disputes before pursuing legal action.","textIt":"Devi seguire un processo di negoziazione in più fasi per risolvere le controversie prima di intraprendere azioni legali.","sentiment":"neutral"},{"textEn":"Plaid can change terms anytime; your only recourse if you disagree is to stop using the service.","textIt":"Plaid può modificare i termini in qualsiasi momento; l'unico rimedio se non sei d'accordo è smettere di usare il servizio.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Medium risk. While B2B contracts allow more flexibility, data protection (GDPR) and digital operational resilience (DORA) still apply to financial data. Enterprises must ensure their use of Plaid aligns with these regulations.","complianceNoteEn":"GDPR, DORA (for financial entities)"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"High risk due to broad disclaimers and liability limits which may conflict with strong EU consumer protection laws. Data processing details are referred to external policies, potentially complicating GDPR compliance.","complianceNoteEn":"GDPR, Consumer Rights Directive"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Medium risk. Enterprises must assess local regulatory compliance for financial data and service provider agreements across all operating regions. Due diligence is crucial for managing third-party risks.","complianceNoteEn":"International contract law, data transfer regulations"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"High risk. Users globally face significant disclaimers and limited recourse, especially where local consumer protection laws are weaker or less clear. Reliance on external privacy policies adds complexity.","complianceNoteEn":"Varies by jurisdiction, general consumer protection"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Medium risk. Standard B2B terms, but financial data handling requires due diligence to comply with state and federal regulations. Liability limits are generally enforceable in commercial agreements.","complianceNoteEn":"State contract law, financial regulations"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"High risk. The \"AS IS\" and limited liability clauses are common in US law but offer minimal consumer protection. Data privacy is referred to other policies, requiring users to seek out additional information.","complianceNoteEn":"CCPA/CPRA, State consumer protection laws"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]}]},"humanReviewQuestions":["Does the original End User Services Agreement source still match the recorded public snapshot version 1?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/7f520876-dff7-41c0-8948-6b7a521c14f6","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"27f7453544187dc78e1c32fec3202ee8a6587c113136ce478dff1ab067260e03"}