HundoStart free

Blog7 min read

Is it safe to connect an AI to your finances?

Two questions get run together - can the AI change your records, and where does your data go once it has read it. They have different answers, and only one of them is up to the app you connect.

The Hundo teamUpdated

Whether it is safe to connect an AI to your finances depends on two separate questions: can the AI change your records, which is mostly up to the finance app you connect, and where does your data go once the AI has read it, which is mostly up to the AI provider. Hundo offers read-only and confirm-first connections and never direct write, and no finance app, Hundo included, can promise anything about what an AI provider does with your data after reading it.

"Is it safe to connect ChatGPT to my finances" is really two questions, and they get run together constantly.

  1. Can the AI change my records? And if it can, what stops it doing so wrongly?
  2. Where does my data go? Once the AI has read your numbers, who else has them?

They have different answers. The first is mostly up to the finance app you connect. The second is mostly up to the AI provider, and no finance app can promise you anything about it - including us.

We build one of these apps, so this is written from inside one. We have tried to be specific about what we control and plain about what we do not. If you are not sure what an MCP server is, this plain explanation covers it first.

Part 1: can the AI change your records?Link to this section

There are three designs, and the marketing rarely tells you which one you are getting.

  • Read-only. The AI can look and never touch. Safe by construction. It also means "log that coffee" is not something you can ask for.
  • Direct write. The AI calls a tool and your ledger changes. Fast, and it trusts the model to have understood you.
  • Confirm-first. The AI drafts a change, you approve it, and only then is anything written.

We compared how six finance MCP servers handle this, and they genuinely differ. It is the single most important thing to find out before you connect one.

Can an AI change your records in Hundo?Link to this section

Hundo offers the first and third, and never the second.

Confirm-first is the default. Nine tools can draft a change - a transaction, an edit, a transfer, a trade, a budget - and each one returns a proposal and a preview while writing nothing. One separate tool, confirm_proposal, commits a specific proposal. A proposal that is never confirmed expires on its own.

Read-only is one setting away. Turn it on in Settings and the drafting tools are not offered to your AI at all. That matters more than it sounds: an AI that was given change tools and told "no" still knows they exist and will offer to use them. One that was never given them cannot suggest it.

Can Hundo tell whether you approved a change?Link to this section

Here is the part most apps would leave out.

Hundo cannot see your conversation. When your AI calls confirm_proposal, Hundo has no way to check that you actually said yes - the "yes" happened in Claude or ChatGPT, not here. What stands between a draft and your ledger is:

  • the AI following its instructions, which tell it to confirm only a proposal you explicitly approved, and
  • your AI app asking you. confirm_proposal is marked as a destructive tool, so a well-behaved client stops and asks before running it.

So confirm-first is exactly as strong as your client's approval prompt. If you tell your AI app to always allow Hundo's tools without asking, you have turned confirm-first back into direct write. Some apps offer that setting, and it is convenient. For a tool that writes to your financial records, leave it off - or switch Hundo to read-only and keep the convenience without the risk.

That is not a flaw we can engineer away from our side. Any server that lets an AI write depends on the conversation it cannot see. The honest version is to tell you which setting on your side decides it.

Part 2: where does your data go?Link to this section

This has two halves: what leaves the finance app, and what happens to it after.

What data leaves Hundo?Link to this section

When your AI asks a question, only the answer to that question leaves. There is no bulk export and no background sync to the AI provider.

  • Only your data. Every request is scoped to the account that authorised it.
  • Only finance data. The query tool runs as an unprivileged database role that can reach an allowlist of finance tables - accounts, transactions, assets, budgets, categories, prices and rates. Not authentication data, not billing, and not the raw text of receipts you forward.
  • No bank credentials. Hundo does not connect to banks, so there are none in the system for a connected model to reach. The most it can read is what you recorded yourself.

What does Hundo record when your AI calls a tool?Link to this section

When your AI calls a tool, we record that it happened: which tool, whether it succeeded, how many rows came back, how long it took. We do not record what it asked or what came back. If a tool fails, we keep the type of error and not its message, because error messages can contain your data.

That goes to analytics we host ourselves, not to a third-party analytics company.

What does the AI provider do with your data?Link to this section

Once your AI has read your numbers, they are part of your conversation with that provider, and that provider's policy governs them, not ours. This is the half no finance app can promise you anything about, and you should be suspicious of one that tries.

The setting that matters most is whether your conversations are used to train the provider's models. It lives in your account with them:

  • Claude. Anthropic's 2025 update to its consumer terms asks Free, Pro and Max users to choose whether their chats are used for training. If you allow it, Anthropic keeps that data for up to five years; if you do not, the retention period is 30 days. The choice is in Claude's Privacy Settings. Claude for Work (Team and Enterprise), the API, and Claude through Amazon Bedrock or Google Cloud are excluded.
  • ChatGPT. The control is Settings → Data Controls → "Improve the model for everyone". OpenAI states that its Business, Enterprise and Edu plans and its API are not used for training by default. OpenAI's own explanation is the place to confirm what applies to your plan.

Whichever you use: go and look at that setting before you connect a finance app to it. It takes a minute, and it is the only control over this half that you actually have.

Can text you did not write steer your AI?Link to this section

One more, because it is real and rarely mentioned.

An AI reads whatever text it is shown, and text can contain instructions aimed at the AI rather than at you. If a document someone else wrote ends up in front of your AI - a receipt, say - it could in principle carry a line designed to steer the model.

On Hundo specifically, the exposure is small. Forwarded receipts are not readable by your AI at all; they are turned into proposals that you review before anything reaches your ledger. So any text your AI can read from your records is text you approved. But the general point holds for anything you connect: the more an AI reads from sources you did not write, the more its approval prompt matters - which is the same setting as in Part 1.

A short checklistLink to this section

Before you connect any finance app to any AI:

  1. Find out which design it uses. Read-only, direct write, or confirm-first. Its tool list will tell you faster than its landing page. Ours is here.
  2. Leave your AI app's approval prompts on for anything that writes. "Always allow" on a write tool is direct write with extra steps.
  3. Check your AI provider's training setting. It is the only control you have over what happens after the data is read.
  4. Ask whether it holds your bank login. If it does, a breach is an account problem, not just a privacy one.
  5. Prefer read-only if you are unsure. You can always turn writing on later. You cannot un-write a wrong entry you did not notice.

Common questionsLink to this section

Can an AI connected to Hundo change my records without asking?Link to this section

Hundo's drafting tools write nothing, and a change is committed only when your AI calls confirm_proposal, which a well-behaved AI app stops and asks you about first. If you tell your AI app to always allow Hundo's tools without asking, confirm-first becomes direct write, so leave that off or switch Hundo to read-only.

Can Hundo see my conversation with the AI?Link to this section

No. Hundo cannot see your conversation, so it has no way to check that you said yes before your AI calls confirm_proposal.

Will Claude or ChatGPT train on my financial data?Link to this section

That is governed by your AI provider's policy and your settings with them, not by the finance app. In Claude the choice is in Privacy Settings, and in ChatGPT it is Settings → Data Controls → "Improve the model for everyone", so check it before you connect a finance app.

What data can my AI read from Hundo?Link to this section

Only your own finance data, and only the answer to each question it asks. The query tool can reach an allowlist of finance tables - accounts, transactions, assets, budgets, categories, prices and rates - and not authentication data, billing, or the raw text of receipts you forward.

Checked 11 September 2026 against Anthropic's and OpenAI's own published terms, and against Hundo's code. Providers change these settings; where this page and their current terms disagree, theirs win.