Plaid also must reduce the amount of data it stores and give customers more information about its security practices.