Is it safe to share financial data with AI? A practical checklist

In May 2026 OpenAI started letting ChatGPT connect directly to users' financial accounts. Within days, security researchers were publicly listing reasons to think twice. They are not wrong, and they are also not saying "never". The useful question is not "is AI safe for financial data?" but "is this specific tool built to handle it?". That question has a checklist.

Why this stopped being theoretical

Two things happened in the last year. First, AI assistants got the plumbing to reach real accounts: MCP connectors, bank integrations, and in May 2026 ChatGPT's own financial accounts feature, launched for Pro subscribers with wider rollout planned. Second, adoption ran ahead of hygiene: a TD Bank survey in March 2026 found 55% of Americans using AI in financial decisions, while a Stanford study of chatbot privacy (October 2025) showed how much sensitive detail leaks into ordinary conversations.

When The Record asked security experts about the ChatGPT rollout, the concerns were specific. Diana Kelley of Noma Security pointed out that one compromised ChatGPT account now yields "a consolidated picture of your balances, spending, investments, debts, goals and financial history". Ram Varadarajan of Acalvio called the concentration a high-value target for account takeover. Ridhi Shetty of the Center for Democracy and Technology noted the tool "doesn't abide by the obligations that professional financial advisors have".

Notice what nobody said: that AI reading your transactions is inherently dangerous. The danger lives in implementation details. So interrogate the details.

The six questions

1. Is my data used to train models?

The single biggest divider. Consumer chat products historically default to training on conversations unless you opt out. A purpose-built finance tool should be able to say plainly: your records are never training data. If the answer takes a lawyer to parse, treat it as "yes".

2. What lands in server logs?

Breaches usually leak logs and backups, not primary databases. Ask whether amounts, merchant names and descriptions appear in operational logs. Most vendors have never been asked this question, which is itself an answer. (This is a design decision we made early in MyFinance MCP: server logs carry tool names and latency, never amounts or merchants. Blind logs cost us debugging convenience and are worth it.)

3. Where does the data live, and under which law?

EU residency puts your records under GDPR: deletion rights, breach notification duties, purpose limitation. US-hosted consumer apps sit under a patchwork. Not a dealbreaker either way, but you should know which regime applies before an incident, not after.

4. Can I leave with my data, and can I truly delete it?

Two commands to test on day one, while you have nothing to lose: full export (CSV counts, a proprietary backup does not) and full deletion. If deletion is a support ticket instead of a button or a tool call, the real answer is no.

5. Can anyone audit the code?

Open source is not automatically secure, but it makes claims checkable. When a vendor says "encrypted at rest" or "receipt photos never reach the server", open code turns marketing into a verifiable statement. Closed tools can be fine; they just require more trust with less evidence.

6. If it touches my bank, is the access read-only?

Open banking consents in the EU and UK are read-only by construction: an aggregator can list transactions but cannot move money. A tool that asks for your actual banking credentials, rather than a redirect to your bank's own consent screen, fails this question instantly. Also check that bank tokens are stored encrypted, not plaintext in a database column.

The paste-into-chat baseline

Here is the counterintuitive part: the popular "safe-feeling" habit of pasting a statement into a chat window is often the worst option. The full text of your statement enters conversation history, subject to retention, human review programs, and training defaults of whatever chat product you use. A structured tool that stores records in a database and returns computed totals actually exposes less: the model sees your question and a summary, not a scrolling wall of raw transactions.

Rule that survives every tool choice: account numbers, passwords, and government IDs never belong in any chat, with any vendor, under any setting. No budgeting question needs them.

What we still cannot promise you

Honesty section. No vendor, us included, can promise you zero breach risk; the honest claims are about blast radius (what a breach would expose) and recovery (how fast you can delete and leave). Beta software carries beta risk. And the June 2026 Journal of Financial Planning study showing AI advice varying by user demographics is a reminder that even with perfect data handling, the advice layer deserves human judgment. Safety is not a property you buy once; it is a posture.

Do this before connecting anything

1. Run the six questions against your candidate tool. Written answers or code links, not vibes.
2. Test export and delete first, while your account is empty.
3. Enable MFA on the AI account itself. Per Kelley's warning, it is now a financial account.
4. Start with one month of data, not your full history, and see how the tool behaves.

If you want our own answers to all six questions in one place, they are on the security section of the homepage, with the code on GitHub to check them against.

Fear is not a privacy strategy, and neither is convenience. A checklist is both.

Sources

• The Record, May 18, 2026: Experts warn of privacy risks as AI firms connect to financial accounts
• Stanford Report, October 2025: privacy risks of AI chatbot conversations
• TD Bank survey, March 2026
• CNBC, July 2026, on the Journal of Financial Planning study

Last updated: July 20, 2026. Product names are trademarks of their respective owners. MyFinance MCP is an independent open-source project by Rteam.