Security and privacy at Shavve
Shavve is a financial information service licensed by the Israel Securities Authority, with read-only access: it shows only what you approve, and cannot move money or take actions in your accounts. Data is encrypted in transit and at rest, and you can revoke access and delete your account at any time.
Last updated:
Read-only
Shavve cannot move or withdraw money or take actions in your accounts. It shows, explains and compares.
Banks and credit cards connect through open banking: you instruct your bank to share specific information with Shavve, with your consent. You identify yourself to the bank, and Shavve does not receive your password.
Licence and supervision
Shavve holds a financial-information-service licence, supervised by the Israel Securities Authority, and the activity is governed by the Financial Information Service Law. You can check the licence yourself in the list of financial information service providers that the Israel Securities Authority publishes on its website, rather than relying on what an app says about itself.
How data is protected
According to the privacy policy, Shavve works by Privacy-by-Design and Security-by-Design principles and applies, among others:
- Encryption in transit and at rest, and encrypted backups
- Access controls, segregation and access logging
- Secure development and periodic security testing
- Monitoring, logs and anomaly detection
- Infrastructure hardening, environment separation and patch management
- Data processing agreements (DPAs) with vendors and sub-processors
- A security incident response procedure, with notification as the law requires
No security is absolute, so it is worth knowing how to revoke access and delete data (next section).
You stay in control
- You choose what to connect: each source connects only after your approval.
- You can revoke access in two places: in the app, and in the consents area of your bank's website or app.
- You can delete your account from inside the app. Deletion requests are handled under the privacy policy: the aim is up to 30 days, and up to 90 days in complex cases.
Open banking explained: what it allows, what it doesn't, and how to revoke
Connecting an AI assistant (MCP)
- You can connect Claude, ChatGPT or any MCP client to your own Shavve data.
- A personal key with scopes you choose: transactions, net worth (including pensions, insurance and debts) and forecast.
- Read-only: nothing can be changed, and no write tool exists.
- An audit log for every call to every tool, and revocation of the key with one tap.
What Shavve does not do
- Shavve does not move money or take actions in your accounts.
- Shavve shows, explains and compares. It does not replace a licensed adviser, and points you to a professional when one is needed.
- No estimated numbers: what isn't connected isn't guessed.
- No "AI" inventing numbers: insights are rule-based.
Security FAQ
- Is Shavve regulated?
- Yes. Shavve holds a financial-information-service licence, supervised by the Israeli Securities Authority. The activity is governed by the Financial Information Service Law.
- Can Shavve move money or take actions in my account?
- No. Access is read-only: Shavve cannot move or withdraw money or take actions in your accounts. It shows, explains and compares.
- Is Shavve safe?
- Shavve is a financial information service licensed by the Israel Securities Authority, with read-only access. Data is encrypted in transit and at rest, and you can revoke access and delete your account at any time. No security is absolute, so connect only what you need to see.
- Do I give Shavve my bank password?
- No. Banks and credit cards connect through open banking: you approve your bank sharing specific information, you identify yourself to the bank, and Shavve does not receive the password.
- How do I revoke Shavve's access to my bank account?
- In the app, or in the consents area of your bank's website or app. After revoking, check that the connection no longer shows as active.
- What happens to my data when I delete my account?
- You delete the account from inside the app, and deletion requests are handled under the privacy policy: the aim is up to 30 days, and up to 90 days in complex cases. A minimum of data needed for legal compliance may be kept.
