Access control tower
Systems, methods, and apparatuses for providing a customer a central location to manage permissions provided to third-parties and devices to access and use customer information maintained by a financial institution are described. The central location serves as a central portal where a customer of the financial institution can manage all access to account information and personal information stored at the financial institution. Accordingly, the customer does not need to log into each individual third-party system or customer device to manage previously provided access to the customer information or to provision new access to the customer information. A user additionally is able to have user data and/or third-party accounts of the user deleted from devices, applications, and third-party systems via a central portal.
1. A method comprising:
receiving, by a service provider computing system, a first application programming interface (API) call via a first API between the service provider computing system and a third-party computing system, the first API call specifying customer information of a customer;
in response to receiving the first API call from the third-party computing system, transmitting, by the service provider computing system, to the third-party computing system via the first API, the customer information specified in the first API call;
presenting, by the service provider computing system, via a graphical user interface of a service provider client application running on a computing device of the customer:
a third-party account that is linked to the service provider computing system, the third-party account with the customer information, the third-party account being stored in a database of the third-party computing system, wherein the customer information is accessible to the third-party computing system; and
a toggle corresponding to the third-party account, wherein the toggle visually indicates that the customer can specify to delete the customer information stored in the database of the third-party computing system;
detecting, by the service provider computing system, via the service provider client application running on the computing device of the customer, selection of the toggle;
in response to detecting the selection of the toggle, generating, by the service provider computing system, a scrub command identifying the third-party account of the customer to be deleted from the database of the third-party computing system;
transmitting, by the service provider computing system, the scrub command in a second API call to the third-party computing system via the first API or a second API to cause the third-party computing system to delete, from the database of the third-party computing system, the third-party account with the customer information that is specified in the first API call and that was stored in the database of the third-party computing system; and
presenting, by the service provider computing system, via the graphical user interface of the service provider client application running on the computing device of the customer, a status indicator indicating that the third-party account was deleted.
2. The method of claim 1 , wherein the toggle is a first toggle, wherein the selection is a first selection, wherein the scrub command is a first scrub command, wherein the status indicator is a first status indicator, and further comprising:
presenting, by the service provider computing system, via the graphical user interface, a second toggle corresponding to the third-party account, wherein the second toggle visually indicates that the customer can select to delete a specified type of third-party accounts with the customer information of the customer stored in the database of the third-party computing system;
detecting, by the service provider computing system, via the service provider client application running on the computing device of the customer, a second selection of the second toggle to delete the specified type of the third-party accounts with the customer information of the customer stored in the database of the third-party computing system;
in response to detecting the second selection via the graphical user interface presented by the service provider client application to delete the specified type of the third-party accounts with the customer information of the customer stored in the database of the third-party computing system, generating, by the service provider computing system, a second scrub command identifying the specified type of the third-party accounts with the customer information of the customer to be deleted from the database of the third-party computing system;
transmitting, by the service provider computing system, the second scrub command in a third API call to the third-party computing system via the first API or the second API to cause the third-party computing system to delete, from the database of the third-party computing system, the specified type of the third-party accounts with the customer information that is specified in the first API call and that was stored in the database of the third-party computing system; and
presenting, by the service provider computing system, via the graphical user interface of the service provider client application running on the computing device of the customer, a second status indicator indicating that the specified type of the third-party accounts were deleted.
3. The method of claim 1 , further comprising allowing the customer, via the service provider client application, to place restrictions on what customer information is accessible to the third-party computing system.
4. The method of claim 1 , further comprising allowing the customer, via the service provider client application, to place restrictions on how the accessible customer information may be used by the third-party computing system.
5. The method of claim 1 , further comprising transmitting, by the service provider computing system, to the computing device of the customer, for presentation via the service provider client application running on the computing device, status information indicating whether the link is active or inactive.
6. The method of claim 1 , wherein the scrub command instructs the third-party computing system to delete all the customer information stored at the third-party computing system.
7. A service provider computing system having a processor and memory with instructions which, when executed by the processor, cause the service provider computing system to:
receive a first application programming interface (API) call via a first API between the service provider computing system and a third-party computing system, the first API call specifying customer information of a customer;
in response to receiving the first API call from the third-party computing system, transmit, to the third-party computing system via the first API, the customer information specified in the first API call;
present, via a graphical user interface of a service provider client application running on a computing device of the customer:
a third-party account that is linked to the service provider computing system, the third-party account with the customer information, the third-party account being stored in a database of the third-party computing system, wherein the customer information is accessible to the third-party computing system; and
a toggle corresponding to the third-party account, wherein the toggle visually indicates that the customer can specify to delete the customer information stored in the database of the third-party computing system;
detect, via the service provider client application running on the computing device of the customer, selection of the toggle;
in response to detecting the selection of the toggle, generate a scrub command identifying the third-party account of the customer to be deleted;
transmit the scrub command in a second API call to the third-party computing system via the first API or a second API to cause the third-party computing system to delete, from the database of the third-party computing system, the third-party account with the customer information that is specified in the first API call and that was stored in the database of the third-party computing system; and
present, via the graphical user interface of the service provider client application running on the computing device of the customer, a status indicator indicating that the third-party account was deleted.
8. The service provider computing system of claim 7 , wherein the toggle is a first toggle, wherein the selection is a first selection, wherein the scrub command is a first scrub command, wherein the status indicator is a first status indicator, and wherein the instructions further cause the service provider computing system to:
present, via the graphical user interface, a second toggle corresponding to the third-party account, wherein the second toggle visually indicates that the customer can select to delete a specified type of third-party accounts with the customer information of the customer stored in the database of the third-party computing system;
detect, via the service provider client application running on the computing device of the customer, a second selection of the second toggle to delete the specified type of the third-party accounts with the customer information of the customer stored in the database of the third-party computing system;
in response to detecting the second selection via the graphical user interface presented by the service provider client application to delete the specified type of the third-party accounts with the customer information of the customer stored in the database of the third-party computing system, generate, a second scrub command identifying the specified type of the third-party accounts with the customer information of the customer to be deleted from the database of the third-party computing system;
transmit, the second scrub command in a third API call to the third-party computing system via the first API or the second API to cause the third-party computing system to delete, from the database of the third-party computing system, the specified type of the third-party accounts with the customer information that is specified in the first API call and that was stored in the database of the third-party computing system; and
present, via the graphical user interface of the service provider client application running on the computing device of the customer, a second status indicator indicating that the specified type of the third-party accounts were deleted.
9. The service provider computing system of claim 7 , wherein the instructions further cause the service provider computing system to allow the customer, via the service provider client application, to place restrictions on what customer information is accessible to the third-party computing system.
10. The service provider computing system of claim 7 , wherein the instructions further cause the service provider computing system to allow the customer, via the service provider client application, to place restrictions on how accessible customer information may be used by the third-party computing system.
11. The service provider computing system of claim 7 , wherein the scrub command instructs the third-party computing system to delete all the customer information stored at the third-party computing system.
12. A non-transitory computer readable medium having machine instructions stored thereon, the instructions being executable by a processor of a service provider computing system to cause the processor to perform operations comprising:
receiving, a first application programming interface (API) call via a first API between the service provider computing system and a third-party computing system, the first API call specifying customer information of a customer;
in response to receiving the first API call from the third-party computing system, transmitting, to the third-party computing system via the first API, the customer information specified in the first API call;
presenting, via a graphical user interface of a service provider client application running on a computing device of the customer:
a third-party account that is linked to the service provider computing system, the third-party account with the customer information, the third-party account being stored in a database of the third-party computing system, wherein the customer information is accessible to the third-party computing system; and
a toggle corresponding to the third-party account, wherein the toggle visually indicates that the customer can specify to delete the customer information stored in the database of the third-party computing system;
detecting, via the service provider client application running on the computing device of the customer, selection of the toggle;
in response to detecting the selection of the toggle, generating a scrub command identifying the third-party account of the customer to be deleted from the database of the third-party computing system;
transmitting the scrub command in a second API call to the third-party computing system via the first API or a second API to cause the third-party computing system to delete, from the database of the third-party computing system, the third-party account with the customer information that is specified in the first API call and that was stored in the database of the third-party computing system;
present, via the graphical user interface of the service provider client application running on the computing device of the customer, a status indicator indicating that the third-party account was deleted.
13. The non-transitory computer readable medium of claim 12 , wherein the instructions further cause the processor to allow the customer, via the service provider client application, to place restrictions on at least one of: (i) what customer information is accessible to the third-party computing system, and (ii) how the accessible customer information may be used by the third-party computing system.
14. The non-transitory computer readable medium of claim 12 , wherein the scrub command instructs the third-party computing system to delete all the customer information, or a subset thereof, stored at the third-party computing system.
15. The non-transitory computer readable medium of claim 12 , wherein the toggle is a first toggle, wherein the selection is a first selection, wherein the scrub command is a first scrub command, wherein the status indicator is a first status indicator, and wherein the instructions further cause the processor to:
present, via the graphical user interface, a second toggle corresponding to the third-party account, wherein the second toggle visually indicates that the customer can select to delete a specified type of third-party accounts with the customer information of the customer stored in the database of the third-party computing system;
detect, via the service provider client application running on the computing device of the customer, a second selection of the second toggle to delete the specified type of the third-party accounts with the customer information of the customer stored in the database of the third-party computing system;
in response to detecting the second selection via the graphical user interface presented by the service provider client application to delete the specified type of the third-party accounts with the customer information of the customer stored in the database of the third-party computing system, generate, a second scrub command identifying the specified type of the third-party accounts with the customer information of the customer to be deleted from the database of the third-party computing system;
transmit, the second scrub command in a third API call to the third-party computing system via the first API or the second API to cause the third-party computing system to delete, from the database of the third-party computing system, the specified type of the third-party accounts with the customer information that is specified in the first API call and that was stored in the database of the third-party computing system; and
present, via the graphical user interface of the service provider client application running on the computing device of the customer, a second status indicator indicating that the specified type of the third-party accounts were deleted.