Ever asked an AI assistant to summarise a bank statement or explain a payslip? It's a natural use, and it can be genuinely helpful. But you're handing over sensitive information, so do it deliberately. Here are simple principles that let you enjoy the benefits without opening a door you didn't mean to open.

What to share and what not to

Usually fine to share

  • Amounts and categories, without identifying details.
  • A statement or payslip after masking your name, ID number and account numbers.
  • General questions: 'how do management fees work?'
  • Data from an account you connected with defined, read-only permissions.

Never share

  • Passwords for your bank, an app or your email.
  • One-time codes (OTP) and authentication methods.
  • A full credit card number, CVV and expiry date.
  • Documents with your full ID number and account details, unmasked.

Permissions, scopes and read-only

Instead of pasting data by hand, you can connect an AI assistant to a data source through a defined connection. In Shavve this works through MCP, a protocol that lets an AI client such as Claude or ChatGPT read data from your account. The key principles:

  1. 1

    A personal key

    You create a personal key just for this connection, and never share a password.

  2. 2

    Choose scopes

    You define what the assistant may read: transactions, pensions, insurance, net worth or debts. You can grant only some.

  3. 3

    Read-only

    The assistant can read. It cannot change anything, and there is no write tool.

  4. 4

    An audit log

    Every call to every tool is recorded, so you can see what was done and when.

  5. 5

    Revoke in one tap

    You can revoke the key at any moment, and access closes.

For illustration. Actual scopes depend on your settings and the permissions you grant.
ScopeWhat the assistant can readWhen to grant it
TransactionsTransactions and balances in accounts and cardsWhen you want to analyse spending or recurring charges
PensionsPension, study and provident fund productsWhen you want to check fees and deposits
InsuranceInsurance policiesWhen you want to check overlaps and cover
Net worthSummarised assets and liabilitiesWhen you want the overall picture
DebtsLoans and balancesWhen you want to plan repayment

Red flags and judgement

  • They ask for a password or one-time code. A legitimate service won't ask for these in a chat.
  • Broader permissions than needed. If one question gets a request for all your data, grant less.
  • No clear way to revoke. Don't enable a connection when it isn't clear how to end it.
  • The ability to act on your account. An assistant that can move money calls for a completely different level of care. Prefer read-only.
  • Pressure to act fast. 'Now or never' is a signal to stop.

Before connecting an AI assistant to your financial data

0 of 7 checked

Your ticks are saved on this device only.

Frequently asked questions

Not with Shavve. The connection is read-only and there is no write tool, so a connected assistant cannot change data or move money.

Pasting hands over everything in the document, including details you don't need. A scoped connection limits what is read, and you can see in the log what was read and revoke at any time.

Revoke the personal key in settings. In Shavve you can do it in one tap, and the assistant loses access.

You can, if you follow the rules: share little, grant narrow permissions, read-only, and check against the source.

Revoke the key immediately, check the audit log to see what was read, and create a new key if you want to continue.