Is it safe to connect your finances to an AI?

The honest answer is “it depends on what’s between the AI and the bank”. Three questions decide it.

1. Where does my bank login go?

With Plaid (what ChatGPT, Truenote and most finance apps use), you type your bank login into Plaid’s own window. The app never sees it. The app receives an access token that can only read. Truenote seals that token with AES-256-GCM before it touches the database, keeps the keys outside the database, opens it only in memory right before a Plaid call, and never returns it through any endpoint, tool, export or log.

2. Can anything move money?

Ask the app directly, because it’s a code question, not a policy one. Truenote’s integration uses only Plaid’s read products: transactions, balances, investments, liabilities, recurring. There is no transfer, payment or “auth for payments” endpoint anywhere in it, so an AI couldn’t move money even if asked to.

What an AI can write in Truenote: the spending plan, buckets (a ledger inside Truenote; nothing moves at your bank), rules, goals, notes, plans, categories. Rows it writes say which agent wrote them.

3. What does the AI actually see, and can I prove it?

Here’s where connections differ most. In Truenote each agent gets a grant: which kinds of data it may read (accounts, transactions, investments, liabilities, context, documents), which accounts or businesses it must never see, and whether it may write. Exclusions are applied inside the database query, totals included, so an agent hidden from the brokerage can’t infer it from net worth. New connections start read-only.

And every call, allowed or refused, lands in an append-only audit log: the agent, the tool, a summary of what it asked, how many rows came back. If you ever wonder what Claude looked at, the answer is on one page. Revoke applies to the agent’s very next call.

What can still go wrong

• Prompt injection. A transaction description could carry instructions (“ignore previous instructions and…”). The agent might follow them, but it can only read what it’s allowed and write Truenote’s own records; you’d see the calls in the log and could undo the rows.
• Leaky text. A visible transaction can name a hidden account in its description (“TRANSFER TO SAV …7730”). Truenote says so on the consent screen.
• The AI provider’s side. Whatever an agent reads, it reads into its own context under its provider’s terms. Truenote never sends data to a provider; the agent fetches it.
• Your own device. A stolen signed-in laptop is a stolen session. Passkeys and 14-day sessions help; so does signing out.

A careful setup

1. Connect accounts read-only through Plaid. Hide the ones the AI has no business seeing.
2. Give each agent its own connection with only the scopes it needs. Keep writing off until you want it.
3. Read the Activity log the first week. It’s quick, and it’s how you learn what the assistant actually does with a question.
4. Revoke anything you stop using.

More detail: Security.

Questions

Does the AI get my bank password?

No. You sign in at your bank inside Plaid Link. The app gets a read-only access token; Truenote seals it with AES-256-GCM and never returns it to anyone, including the AI.

Can an AI move my money?

Not through Truenote. It uses only Plaid's read products and has no transfer or payment code at all. An agent can write Truenote's own records (a note, a plan line, a bucket move in Truenote's ledger), never a bank.

What if the AI misbehaves or gets prompt-injected by a transaction description?

It can read only what its grant allows and write only Truenote's records; every call is in an audit log; revoking it takes one click; rows it wrote say which agent wrote them.