HundoBetaStart free

Blog6 min read

Is it safe to connect an AI to your finances?

Two questions get run together - can the AI change your records, and where does your data go once it has read it. They have different answers, and only one of them is up to the app you connect.

The Hundo team

"Is it safe to connect ChatGPT to my finances" is really two questions, and they get run together constantly.

  1. Can the AI change my records? And if it can, what stops it doing so wrongly?
  2. Where does my data go? Once the AI has read your numbers, who else has them?

They have different answers. The first is mostly up to the finance app you connect. The second is mostly up to the AI provider, and no finance app can promise you anything about it - including us.

We build one of these apps, so this is written from inside one. We have tried to be specific about what we control and plain about what we do not.

Part 1: can it change your records?Link to this section

There are three designs, and the marketing rarely tells you which one you are getting.

  • Read-only. The AI can look and never touch. Safe by construction. It also means "log that coffee" is not something you can ask for.
  • Direct write. The AI calls a tool and your ledger changes. Fast, and it trusts the model to have understood you.
  • Confirm-first. The AI drafts a change, you approve it, and only then is anything written.

We compared how six finance MCP servers handle this, and they genuinely differ. It is the single most important thing to find out before you connect one.

What Hundo doesLink to this section

Hundo offers the first and third, and never the second.

Confirm-first is the default. Nine tools can draft a change - a transaction, an edit, a transfer, a trade, a budget - and each one returns a proposal and a preview while writing nothing. One separate tool, confirm_proposal, commits a specific proposal. A proposal that is never confirmed expires on its own.

Read-only is one setting away. Turn it on in Settings and the drafting tools are not offered to your AI at all. That matters more than it sounds: an AI that was given change tools and told "no" still knows they exist and will offer to use them. One that was never given them cannot suggest it.

The limit worth understandingLink to this section

Here is the part most apps would leave out.

Hundo cannot see your conversation. When your AI calls confirm_proposal, Hundo has no way to check that you actually said yes - the "yes" happened in Claude or ChatGPT, not here. What stands between a draft and your ledger is:

  • the AI following its instructions, which tell it to confirm only a proposal you explicitly approved, and
  • your AI app asking you. confirm_proposal is marked as a destructive tool, so a well-behaved client stops and asks before running it.

So confirm-first is exactly as strong as your client's approval prompt. If you tell your AI app to always allow Hundo's tools without asking, you have turned confirm-first back into direct write. Some apps offer that setting, and it is convenient. For a tool that writes to your financial records, leave it off - or switch Hundo to read-only and keep the convenience without the risk.

That is not a flaw we can engineer away from our side. Any server that lets an AI write depends on the conversation it cannot see. The honest version is to tell you which setting on your side decides it.

Part 2: where does your data go?Link to this section

This has two halves: what leaves the finance app, and what happens to it after.

What leaves HundoLink to this section

When your AI asks a question, only the answer to that question leaves. There is no bulk export and no background sync to the AI provider.

  • Only your data. Every request is scoped to the account that authorised it.
  • Only finance data. The query tool runs as an unprivileged database role that can reach an allowlist of finance tables - accounts, transactions, assets, budgets, categories, prices and rates. Not authentication data, not billing, and not the raw text of receipts you forward.
  • No bank credentials, ever. Hundo has no bank connection at all, so there is nothing of that kind anywhere in the system to leak. The worst case for this connection is a model reading numbers you typed in yourself.

What Hundo records about itLink to this section

When your AI calls a tool, we record that it happened: which tool, whether it succeeded, how many rows came back, how long it took. We do not record what it asked or what came back. If a tool fails, we keep the type of error and not its message, because error messages can contain your data.

That goes to analytics we host ourselves, not to a third-party analytics company.

What happens after: not our callLink to this section

Once your AI has read your numbers, they are part of your conversation with that provider, and that provider's policy governs them, not ours. This is the half no finance app can promise you anything about, and you should be suspicious of one that tries.

The setting that matters most is whether your conversations are used to train the provider's models. It lives in your account with them:

  • Claude. Anthropic's 2025 update to its consumer terms asks Free, Pro and Max users to choose whether their chats are used for training. If you allow it, Anthropic keeps that data for up to five years; if you do not, the retention period is 30 days. The choice is in Claude's Privacy Settings. Claude for Work (Team and Enterprise), the API, and Claude through Amazon Bedrock or Google Cloud are excluded.
  • ChatGPT. The control is Settings → Data Controls → "Improve the model for everyone". OpenAI states that its Business, Enterprise and Edu plans and its API are not used for training by default. OpenAI's own explanation is the place to confirm what applies to your plan.

Whichever you use: go and look at that setting before you connect a finance app to it. It takes a minute, and it is the only control over this half that you actually have.

Text that is not yoursLink to this section

One more, because it is real and rarely mentioned.

An AI reads whatever text it is shown, and text can contain instructions aimed at the AI rather than at you. If a document someone else wrote ends up in front of your AI - a receipt, say - it could in principle carry a line designed to steer the model.

On Hundo specifically, the exposure is small. Forwarded receipts are not readable by your AI at all; they are turned into proposals that you review before anything reaches your ledger. So any text your AI can read from your records is text you approved. But the general point holds for anything you connect: the more an AI reads from sources you did not write, the more its approval prompt matters - which is the same setting as in Part 1.

A short checklistLink to this section

Before you connect any finance app to any AI:

  1. Find out which design it uses. Read-only, direct write, or confirm-first. Its tool list will tell you faster than its landing page. Ours is here.
  2. Leave your AI app's approval prompts on for anything that writes. "Always allow" on a write tool is direct write with extra steps.
  3. Check your AI provider's training setting. It is the only control you have over what happens after the data is read.
  4. Ask whether it holds your bank login. If it does, a breach is an account problem, not just a privacy one.
  5. Prefer read-only if you are unsure. You can always turn writing on later. You cannot un-write a wrong entry you did not notice.

Checked 11 September 2026 against Anthropic's and OpenAI's own published terms, and against Hundo's code. Providers change these settings; where this page and their current terms disagree, theirs win.