Yodlee Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Yodlee

1. 1

   PRIORITY 1 — Infrastructure Clarification (within 14 days): Contact Yodlee's security team and request written clarification on whether ports 21 (FTP), 25 (SMTP), 3306 (MySQL), 3389 (RDP), and 9200 (Elasticsearch) represent CDN edge artifacts or Yodlee-owned infrastructure. If the latter, require a remediation plan and request the most recent penetration test executive summary. Email security@yodlee.com or your assigned account manager to initiate.

   OWASP Testing Guide
2. 2

   PRIORITY 2 — SOC 2 Type II Report (within 15 business days): Request Yodlee's current SOC 2 Type II report — contact your account manager or check whether a report is available via an NDA-gated trust portal. Ask specifically for a bridge letter if the report period ended more than 6 months ago. Retain the report with a reviewer signature and date in your vendor risk register to satisfy SOC 2 CC9.2 evidence requirements.

   SOC 2 Overview (AICPA)NIST Supply Chain Risk (SP 800-161)
3. 3

   PRIORITY 3 — Subprocessor List (within 15 business days): Formally request Yodlee's Article 28 subprocessor list in writing, citing your data processing agreement obligations. Document the request date and any response received — this is a required artifact for GDPR compliance and SOC 2 CC9.2 third-party risk management evidence.

   SOC 2 Overview (AICPA)GDPR Full TextDPA Template (GDPR Art. 28)NIST Supply Chain Risk (SP 800-161)
4. 4

   PRIORITY 4 — AI Data Usage Clarification (within 30 days): Request a written statement from Yodlee confirming whether customer financial data is used for AI model training, and whether an enterprise opt-out is available. Review the existing policy page at https://www.yodlee.com/transaction-data-enrichment/leveraging-transaction-data-for-greater-customer-insights and compare against your DPA. Escalate to your privacy counsel if a satisfactory commitment is not obtained.

   DPA Template (GDPR Art. 28)
5. 5

   PRIORITY 5 — LEI Registration Lapse (within 30 days): Note that the LEI registration for YODLEE, INC. (LEI: 5493005WCI4MXVV1KW23) is currently lapsed. While the legal entity status remains ACTIVE, a lapsed LEI registration may indicate reduced regulatory filing maintenance. Raise this with your vendor management contact and request confirmation of current corporate standing.

6. 6

   PRIORITY 6 — HTTP Security Headers (ongoing): Document the D- HTTP security scanner score (25/100) for yodlee.com in your vendor risk register. Note that this scan was conducted against the marketing site — request that Yodlee confirm the security header configuration of the application endpoint (portal.yodlee.com) separately, particularly for Content-Security-Policy and X-Frame-Options. Ask for their next scheduled remediation cycle.

   Check Security HeadersCSP Reference (MDN)NIST Supply Chain Risk (SP 800-161)
7. 7

   PRIORITY 7 — HITRUST Verification (within 30 days): A possible HITRUST directory match was identified but could not be independently confirmed. Contact Yodlee directly to ask whether they hold a current HITRUST certification, and if so, request the certificate number and expiration date for independent verification via the HITRUST Alliance directory at https://directory.hitrustalliance.net.

• Web Archive History was unavailable during this investigation, limiting the ability to independently confirm the long-term continuity and historical changes to Yodlee's public web presence.
• Certificate Transparency log data (Certificate Transparency service) was unavailable; certificate details were derived from a direct TLS handshake, which may not reflect the full subdomain inventory or certificate issuance history.
• External cyber risk scoring was not available for this assessment, preventing a quantitative cyber posture score comparison against the SaaS industry average.
• Domain reputation data from URLhaus could not be fully retrieved; manual verification via the threat intelligence engine public link is recommended as a supplementary step.
• Firmographic detail (headcount, company type, industry classification) was limited in available business intelligence data, reducing the depth of organizational context in this report.
• The HITRUST directory returned a possible match for Yodlee at 90% confidence but was not confirmed — this may represent a name collision with a different entity and requires direct manual verification with the HITRUST Alliance or the vendor.