Access control tower
Systems, methods, and apparatuses for providing a customer a central location to manage permissions provided to third-parties and devices to access and use customer information maintained by a financial institution are described. The central location serves as a central portal where a customer of the financial institution can manage all access to account information and personal information stored at the financial institution. Accordingly, the customer does not need to log into each individual third-party system or customer device to manage previously provided access to the customer information or to provision new access to the customer information. A user additionally is able to have user data and/or third-party accounts of the user deleted from devices, applications, and third-party systems via a central portal.
1 . A method comprising:
receiving, by a service provider computing system, a first application programming interface (API) call from a third-party computing system, the first API call identifying a customer;
in response to receiving the first API call from the third-party computing system, transmitting, by the service provider computing system, to the third-party computing system, customer information corresponding to the customer;
presenting, via a graphical user interface of a service provider client application running on a computing device of the customer, an option to delete the customer information stored in a database of the third-party computing system;
receiving, by the service provider computing system, via the service provider client application running on the computing device of the customer, a selection of the option to delete the customer information;
in response to receiving the selection, generating, by the service provider computing system, a scrub command identifying a third-party account of the customer with the customer information to be deleted from the database of the third-party computing system;
transmitting, by the service provider computing system, the scrub command in a second API call to the third-party computing system to cause the third-party computing system to delete, from the database of the third-party computing system, the third-party account with the customer information stored in the database of the third-party computing system; and
presenting, via the graphical user interface of the service provider client application running on the computing device of the customer, a status indicator indicating that the third-party account was deleted.
2 . The method of claim 1 , further comprising allowing the customer, via the service provider client application, to place restrictions on what customer information is accessible to the third-party computing system.
3 . The method of claim 1 , further comprising allowing the customer, via the service provider client application, to place restrictions on how the accessible customer information may be used by the third-party computing system.
4 . The method of claim 1 , further comprising transmitting, by the service provider computing system, to the computing device of the customer, for presentation via the service provider client application running on the computing device, status information indicating whether a link with the third-party account is active or inactive.
5 . The method of claim 1 , wherein the scrub command instructs the third-party computing system to delete all the customer information stored at the third-party computing system.
6 . The method of claim 1 , wherein the graphical user interface (i) identifies the third-party account, and (ii) provides a toggle for selection of the option.
7 . The method of claim 6 , wherein the toggle is a first toggle, wherein the selection is a first selection, and wherein the scrub command is a first scrub command, the method further comprising:
presenting, via the graphical user interface, a second toggle corresponding to the third-party account, wherein the second toggle visually indicates that the customer can select to delete a specified type of third-party account with the customer information of the customer stored in the database of the third-party computing system;
receiving, via the service provider client application running on the computing device of the customer, a second selection of the second toggle to delete the specified type of third-party account;
in response to receiving the second selection, generating, by the service provider computing system, a second scrub command identifying the specified type of third-party account; and
transmitting, by the service provider computing system, the second scrub command in a third API call to the third-party computing system to cause the third-party computing system to delete, from the database of the third-party computing system, the specified type of third-party account.
8 . The method of claim 7 , wherein the status indicator is a first status indicator, the method further comprising presenting, via the graphical user interface of the service provider client application running on the computing device of the customer, a second status indicator indicating that the specified type of third-party account was deleted.
9 . The method of claim 1 , wherein the first API call is received via a first API between the service provider computing system and the third-party computing system, and wherein the second API call is transmitted to the third-party computing system via the first API or a second API between the service provider computing system and the third-party computing system.
10 . The method of claim 1 , wherein the third-party account is linked to the service provider computing system.
11 . A service provider computing system having a processor and memory with instructions which, when executed by the processor, cause the service provider computing system to:
receive a first application programming interface (API) call from a third-party computing system, the first API call identifying a customer;
in response to receiving the first API call from the third-party computing system, transmit, to the third-party computing system, customer information corresponding to the customer;
receive, via a service provider client application running on a computing device of the customer, a selection of an option to delete the customer information stored in a database of the third-party computing system;
in response to receiving the selection of the option, generate a scrub command identifying a third-party account of the customer with the customer information to be deleted;
transmit the scrub command in a second API call to the third-party computing system via the first API or a second API to cause the third-party computing system to delete, from the database of the third-party computing system, the third-party account with the customer information stored in the database of the third-party computing system; and
provide, to the computing device of the customer for presentation via a graphical user interface of the service provider client application running on the computing device of the customer, a status indicator indicating that the third-party account was deleted.
12 . The service provider computing system of claim 11 , wherein the instructions further cause the service provider computing system to allow the customer, via the service provider client application, to place restrictions on what customer information is accessible to the third-party computing system.
13 . The service provider computing system of claim 11 , wherein the instructions further cause the service provider computing system to allow the customer, via the service provider client application, to place restrictions on how customer information may be used by the third-party computing system.
14 . The service provider computing system of claim 11 , wherein the scrub command instructs the third-party computing system to delete all the customer information stored at the third-party computing system.
15 . The service provider computing system of claim 11 , wherein the selection is a first selection, wherein the scrub command is a first scrub command, and wherein the instructions further cause the service provider computing system to:
receive, via the service provider client application running on the computing device of the customer, a second selection to delete a specified type of third-party account;
in response to receiving the second selection, generate a second scrub command identifying the specified type of third-party account; and
transmit the second scrub command in a third API call to the third-party computing system to cause the third-party computing system to delete, from the database of the third-party computing system, the specified type of third-party account.
16 . The service provider computing system of claim 11 , wherein the first API call is received via a first API between the service provider computing system and the third-party computing system, and wherein the second API call is transmitted to the third-party computing system via a second API between the service provider computing system and the third-party computing system.
17 . A non-transitory computer readable medium having machine instructions stored thereon, the instructions being executable by a processor of a service provider computing system to cause the processor to perform operations comprising:
receiving a first application programming interface (API) call from a third-party computing system, the first API call identifying a customer;
in response to receiving the first API call from the third-party computing system, transmitting, to the third-party computing system, customer information corresponding to the customer;
receiving, via a service provider client application running on a computing device of the customer, a selection of an option to delete the customer information stored in a database of the third-party computing system;
in response to receiving the selection of the option, generating a scrub command identifying a third-party account of the customer with the customer information to be deleted;
transmitting the scrub command in a second API call to the third-party computing system to cause the third-party computing system to delete, from the database of the third-party computing system, the third-party account with the customer information stored in the database of the third-party computing system; and
provide, to the computing device of the customer for presentation via a graphical user interface of the service provider client application running on the computing device of the customer, a status indicator indicating that the third-party account was deleted.
18 . The non-transitory computer readable medium of claim 17 , wherein the instructions further cause the processor to allow the customer, via the service provider client application, to place restrictions on at least one of: (i) what customer information is accessible to the third-party computing system, or (ii) how the accessible customer information may be used by the third-party computing system.
19 . The non-transitory computer readable medium of claim 17 , wherein the scrub command instructs the third-party computing system to delete all the customer information, or a subset thereof, stored at the third-party computing system.
20 . The non-transitory computer readable medium of claim 17 , wherein the selection is a first selection, wherein the scrub command is a first scrub command, and wherein the instructions further cause the processor to:
receive, via the service provider client application running on the computing device of the customer, a second selection to delete a specified type of third-party account;
in response to receiving the second selection, generate a second scrub command identifying the specified type of third-party account; and
transmit the second scrub command in a third API call to the third-party computing system to cause the third-party computing system to delete, from the database of the third-party computing system, the specified type of third-party account with the customer information that is specified in the first API call and that was stored in the database of the third-party computing system.