# AI and Your Money: How to Use an AI Assistant Safely

> What to share and what never to share with an AI assistant, how permissions and scopes work, why read-only matters, how to revoke access, and which red flags to know.

- Canonical URL: https://www.shavve.io/en/articles/ai-and-your-money-safely
- Category: Tech & money
- Published: 2026-10-10 · Updated: 2026-10-13
- Reading time: 6 min
- Language: English
- Shavve - שווה — https://www.shavve.io/en

## The short version

- An AI assistant can save time, but your financial data is sensitive, so share only what is needed.
- Never share passwords, one-time codes, full card numbers or unnecessary identifying details.
- A connection with defined permissions and read-only access beats pasting documents into a chat.
- You can always revoke access: know where before you turn it on.
- AI can be wrong. Check important numbers against the source, and make big decisions with a professional.

Ever asked an AI assistant to summarise a bank statement or explain a payslip? It's a natural use, and it can be genuinely helpful. But you're handing over sensitive information, so do it deliberately. Here are simple principles that let you enjoy the benefits without opening a door you didn't mean to open.

## What to share and what not to

**Usually fine to share**
- Amounts and categories, without identifying details.
- A statement or payslip after masking your name, ID number and account numbers.
- General questions: 'how do management fees work?'
- Data from an account you connected with defined, read-only permissions.

**Never share**
- Passwords for your bank, an app or your email.
- One-time codes (OTP) and authentication methods.
- A full credit card number, CVV and expiry date.
- Documents with your full ID number and account details, unmasked.

> **Key point — One rule that never changes**
> No assistant, app or representative needs your password or one-time code to help you understand your money. If someone asks for them, that is a red flag.

## Permissions, scopes and read-only

Instead of pasting data by hand, you can connect an AI assistant to a data source through a defined connection. In Shavve this works through MCP, a protocol that lets an AI client such as Claude or ChatGPT read data from your account. The key principles:

1. **A personal key** — You create a personal key just for this connection, and never share a password.
2. **Choose scopes** — You define what the assistant may read: transactions, pensions, insurance, net worth or debts. You can grant only some.
3. **Read-only** — The assistant can read. It cannot change anything, and there is no write tool.
4. **An audit log** — Every call to every tool is recorded, so you can see what was done and when.
5. **Revoke in one tap** — You can revoke the key at any moment, and access closes.

*For illustration. Actual scopes depend on your settings and the permissions you grant.*

| Scope | What the assistant can read | When to grant it |
| --- | --- | --- |
| Transactions | Transactions and balances in accounts and cards | When you want to analyse spending or recurring charges |
| Pensions | Pension, study and provident fund products | When you want to check fees and deposits |
| Insurance | Insurance policies | When you want to check overlaps and cover |
| Net worth | Summarised assets and liabilities | When you want the overall picture |
| Debts | Loans and balances | When you want to plan repayment |

## Red flags and judgement

- **They ask for a password or one-time code.** A legitimate service won't ask for these in a chat.
- **Broader permissions than needed.** If one question gets a request for all your data, grant less.
- **No clear way to revoke.** Don't enable a connection when it isn't clear how to end it.
- **The ability to act on your account.** An assistant that can move money calls for a completely different level of care. Prefer read-only.
- **Pressure to act fast.** 'Now or never' is a signal to stop.

> **Watch out — An AI assistant can be wrong**
> Language models phrase things confidently even when they are mistaken. Don't rely on a number you haven't seen at the source, and don't make a big financial decision on an assistant's answer alone. This is general information, not advice, and for a professional decision, consult a licensed professional.

**Before connecting an AI assistant to your financial data**

- [ ] I'm not sharing passwords, one-time codes or a full card number.
- [ ] The connection is read-only, with no ability to take actions.
- [ ] I chose only the scopes I really need.
- [ ] I have a separate personal key for each assistant or tool.
- [ ] I know where to see the audit log.
- [ ] I know how to revoke access, and I've checked that it works.
- [ ] I've checked in the AI service's settings how my conversations and data are handled.

**Can an AI assistant move money out of my account?**
Not with Shavve. The connection is read-only and there is no write tool, so a connected assistant cannot change data or move money.

**What's the difference between pasting a document into a chat and a scoped connection?**
Pasting hands over everything in the document, including details you don't need. A scoped connection limits what is read, and you can see in the log what was read and revoke at any time.

**How do I revoke an AI assistant's access?**
Revoke the personal key in settings. In Shavve you can do it in one tap, and the assistant loses access.

**Should I use an AI assistant at all?**
You can, if you follow the rules: share little, grant narrow permissions, read-only, and check against the source.

**What if I connected and I'm not sure?**
Revoke the key immediately, check the audit log to see what was read, and create a new key if you want to continue.

**Your AI, your data, read-only** With Shavve you can connect Claude, ChatGPT or another MCP client to your data with a personal key, scopes you choose, an audit log and one-tap revoke. Join the waiting list.