Is it safe to connect an AI assistant to your money? An Australian guide

Connecting an AI assistant to your money can be reasonably safe, but only if the connection is read-only by default, asks you before it changes anything, shows you what it did, and can be switched off by you at any time. The risk sits in the connection, not in the idea. This guide explains what to check, what Australian privacy law says about it, and what Finsplore Connect will and will not do when it launches. Finsplore Connect is coming soon and is not live yet.

What does it mean to connect an AI assistant to your money?

It means giving an AI assistant, such as a chat assistant or a coding tool, permission to read data from a finance app so it can answer questions about your own numbers. You might ask it where your spending went last month, or how your savings goal is tracking.

The connection is usually made once, by signing in to the finance app and approving what the assistant may see. After that, the assistant asks the finance app for data as it needs it, rather than you pasting figures into a chat.

Two things are worth separating from the start:

• What the assistant can do inside the finance app. This is access: read, or read and write.
• What happens to your data once it reaches the assistant. This is handling: where it is processed, who can see it, and how long it is kept.

Both matter, and they are controlled by different companies.

How do people use AI with their bank data?

Most people do one of four things. They download a statement or a spreadsheet (a CSV file) from internet banking and upload it with a question. They paste in a few transactions, or attach a screenshot. They use a connector, where a finance app links to the assistant so it can read their data on request. Or they give a service their internet banking login.

The first three can all be done safely, and this guide shows how. The fourth is the one to skip, because your login is what lets someone move your money.

What is the difference between read-only and write access?

Read-only access lets an assistant look at your data. Write access lets it change something. Everything else about safety follows from which of the two you grant.

Access	What the assistant can do	Main risk
Read-only	See balances, transactions, budgets and goals, and answer questions	Your data is exposed to the assistant and its provider
Read and write	Also change things, such as recategorising a transaction or editing a budget	A wrong or manipulated instruction changes your records
Destructive write	Delete records	Data loss that may be hard to reverse

A finance app that is read-only cannot move money, which removes the most serious class of harm. It does not remove the privacy question, because reading is still sharing.

Should an AI assistant need your approval before it changes anything?

Yes. A safe design makes every change a two-step process: the assistant proposes the change, you see a plain summary of it, and nothing happens until you approve.

AI systems can misread a request or produce a confident wrong answer. The OAIC notes that AI systems are known to produce inaccurate or false results, and that generative AI is probabilistic in nature. A proposal you can read and decline turns a possible mistake into a prompt rather than a change to your records.

Look for these features:

• Changes are shown to you as a preview before they are applied.
• Deleting anything needs an extra, separate permission, not just the ordinary write permission.
• The most sensitive actions, such as deleting your whole account, are not available to an assistant at all.
• Pending changes expire if you do nothing, instead of waiting indefinitely.

What data does an AI assistant actually see?

It sees whatever the connection exposes, and then whatever you type into the conversation. The connection controls the first part. You control the second.

When you ask about your spending, the assistant receives the relevant records from the finance app, such as merchant names, dates and amounts, so it can reason about them. That is personal information, and in some cases sensitive information about your life, because a spending list can show health, family or religious details.

The OAIC’s guidance for organisations says that, as a matter of best practice, personal information and particularly sensitive information should not be entered into publicly available generative AI tools because of the significant and complex privacy risks involved. The guidance is written for businesses, but the reasoning applies to individuals too. A sensible habit is to avoid pasting identifiers you do not need, such as full account numbers, tax file numbers or passwords, into any assistant.

Also check whether the assistant’s own settings allow your conversations to be retained or used to improve the service, and change them if you prefer. Those settings belong to the assistant provider, so read their privacy policy rather than assuming. If you are uploading bank statements or screenshots straight into a chat, see below for what ChatGPT, Gemini, Copilot and Claude say they do with uploads, and what to remove first.

What happens to your statement after you upload it?

The AI provider stores it and handles it under its own privacy settings, not your bank’s. Every major assistant lets you change those settings, and it only takes a minute. Here’s what each one says, at the time of writing (October 2026):

Assistant	Does it learn from your chats?	How long chats are kept	The more private option
ChatGPT	Yes by default on personal plans, until you turn off “Improve the model for everyone”	Saved chats stay in your history	Temporary chats aren’t used for training and are kept for up to 30 days for safety
Gemini	Can be, when Keep Activity is on	18 months by default; chats picked for human review are kept for up to three years	Temporary chats, or turn Keep Activity off (chats are still kept for 72 hours)
Copilot	Can be, and you can opt out	18 months by default	Opt out in Privacy settings, and delete history you don’t need
Claude	Only if you allow it in Privacy Settings	30 days, or five years if you allow training	Leave model training off

Google asks people not to share confidential information while Keep Activity is on, because trained reviewers read some chats. For anything personal, a temporary chat is the easy answer.

Timing matters too. Anthropic and Microsoft both say their opt-outs apply to future chats, so change the setting before you upload. Turning off training also doesn’t switch off every other use: Microsoft and Google both say they still use chats for things like safety and security.

Keep your own bank statements in your personal account. Work AI tools follow your employer’s rules, not yours.

These policies change from time to time, so check the provider’s privacy page before you upload.

What to take out of a statement first

A typical Australian bank statement shows your name and street address, your BSB and account number, card numbers, and the names and references of people you pay or who pay you.

Most money questions, like “how much did I spend on groceries?” or “which subscriptions renew each month?”, only need three columns: date, description and amount. A CSV export is the easiest file to clean up. Delete the top rows with your name and account details, remove any columns you don’t need, and save a fresh copy to upload.

Screenshots can show more than you expect, such as an account number or a notification in the corner. Crop them before you share.

Moneysmart’s guidance on AI and money decisions says the same: keep your personal information safe and only share what’s needed.

Why your banking password and codes stay private

Your password and one-time codes are the keys to your money. Keeping them to yourself is easy, and it’s also what keeps you protected.

Most Australian banks follow the ePayments Code, which ASIC looks after. It sets the rules for who pays when money is taken without your permission, and it says not to share your passcodes with anyone, even family. If sharing one helped cause a loss, your bank may not have to pay you back. There are a few exceptions, such as a service your own bank has approved, so check your bank’s terms if you’re unsure.

No genuine AI assistant needs your password or a code to answer questions about your money. Scamwatch also says your bank will never ask for one-time codes over the phone. If a chat, app or “bank agent” asks you for one, stop there.

A safer way to share: open banking

Some apps ask for your banking login and then copy your data. This is called screen scraping. Treasury says sharing login details this way doesn’t fit with cyber security advice.

Australia has a safer system called the Consumer Data Right (CDR), usually called open banking. The two compare like this:

	Giving an app your login	Open banking (CDR)
Your password	The app gets it	It stays with you, and your bank checks it’s you
Who can use it	Any app you give it to	Only providers accredited by the ACCC
What’s shared	Everything you can see	Only what you agree to share
How long	Until you change your password	Up to 12 months, and you can stop it any time

The OAIC says an accredited provider will never ask for your password. You can look up any provider on cdr.gov.au. Our guide to open banking and the Consumer Data Right has more detail.

Can you connect ChatGPT, Gemini or Claude straight to your bank?

Not with a built-in bank link in Australia, at the time of writing. OpenAI says its Finances feature, which links financial accounts to ChatGPT, is available in the US, and that ChatGPT can’t move money or pay bills for you. We couldn’t find a built-in Australian bank link from Google, Microsoft or Anthropic.

What you’ll see more of are connectors, which let apps you already use plug into your assistant. Many use an open standard called MCP (Model Context Protocol), so a finance app can let your assistant read your data from that app.

Before you add one, ask three questions. Where does the app get your bank data: from open banking, from files you import, or from your login? The first two keep your password private. Can it only read your data, or can it change things? Reading is enough for most questions. And is it the real thing? Add connectors from the app’s own website or the assistant’s official directory, not from a link someone sent you.

Is your financial data sent overseas, and does APP 8 apply?

Possibly. Some AI services process data outside Australia, and Australian privacy law has a specific rule for that. It is worth knowing the rule even though it protects you indirectly.

The Australian Privacy Principles (APPs) are 13 principles in the Privacy Act 1988 that apply to organisations and agencies the Act covers. The OAIC states that a breach of an APP is an interference with the privacy of an individual and can lead to regulatory action and penalties.

APP 8 deals with cross-border disclosure. According to the OAIC, before an APP entity discloses personal information to an overseas recipient, it must take such steps as are reasonable in the circumstances to ensure the recipient does not breach the APPs in relation to that information. The entity can also be accountable for acts or practices of the overseas recipient that would breach the APPs, and there are exceptions to both requirements.

What this means in practice:

• A business covered by the Privacy Act that sends your information to an overseas service has obligations, rather than being free of them.
• Whether APP 8 applies to a specific data flow depends on the facts. The OAIC’s chapter on APP 8 sets out what counts as a disclosure and who is an overseas recipient.
• The rule binds covered organisations. It does not guarantee how an overseas AI provider treats data once you have chosen to use it, so ask where processing happens and read the policy.

APP 11 is also relevant. The OAIC says an APP entity must take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure.

What does the Privacy Act say about AI and personal information?

The OAIC’s guidance says privacy obligations apply to any personal information input into an AI system, as well as to output that contains personal information. It also says the Privacy Act applies to all uses of AI involving personal information.

The guidance is directed at organisations deploying AI, and it makes several points that help you judge a provider:

• Organisations should update their privacy policies and notices with clear information about their use of AI.
• Public-facing AI tools should be clearly identified as AI.
• Due diligence should cover who will have access to personal information put into or generated by the product.
• Where personal information is used for a purpose other than the one it was collected for, APP 6 generally requires consent or a reasonable expectation that the use would happen.

If a provider cannot tell you plainly how it handles these things, treat that as information.

How to remove access later

You stay in control, and removing access is usually quick. To clear an upload, delete the chat, and the file too if the provider lets you. Some assistants remember things about you between chats, and you can review and clear these in settings. Microsoft notes that clearing Copilot’s memory doesn’t delete your chat history, so clear both.

For a connector, remove it in your assistant’s settings and in the finance app. For open banking, stop sharing any time from the provider’s dashboard; the OAIC says every accredited provider must give you one. And if you’ve ever shared your banking login, change your password and call your bank if anything looks unusual.

What should you check before you connect? A checklist

Use these questions for any assistant and any finance app, including ours.

1. Is the connection read-only by default? Write access should be a separate choice you make on purpose.
2. Are changes previewed and approved by you? Nothing should change on the assistant’s say-so alone.
3. Is there a separate permission for deleting? Destructive actions should need extra consent.
4. Can you see what the assistant did? Look for an activity log with each request recorded.
5. Can you revoke access yourself, instantly? Find the setting before you grant access.
6. Do you sign in without sharing your password with the assistant? Sign-in should happen with the finance app, with the assistant receiving a limited permission, not your credentials.
7. Are your password, PIN and codes still private?
8. If it’s a connector, is it read-only and from an official source?
9. For anything that says open banking, is the provider listed on cdr.gov.au?
10. Do you know where data is processed? Check both the finance app’s and the assistant’s privacy policies for overseas processing.
11. Does the provider say how long data is kept and whether it is used for training? Change the settings you are able to change.
12. Is training turned off, or are you in a temporary chat?
13. Are you using your personal account?
14. Is the data minimal? Share only the accounts and categories you need answered questions about.
15. Could rough figures answer your question instead of the full statement?
16. Have you taken out your name, address, BSB, account and card numbers?
17. Do you know who to complain to? The OAIC says that if you believe your information has been mishandled, you generally complain to the organisation first, and can then go to the OAIC. See its privacy complaints page.

Treat answers from an assistant about your money as general information. They do not consider your objectives, financial situation or needs and are not financial advice, and an assistant can be wrong.

What will Finsplore Connect do, and what will it not do?

Finsplore Connect is the planned way for an AI assistant you already use to work with your Finsplore data, with your consent. It is coming soon and is not live. Nothing in this section describes a feature you can use today, and details may change before launch.

Here is the design Finsplore is working to:

• Sign-in through OAuth. You approve the connection inside Finsplore. The assistant does not receive your Finsplore password.
• Scoped permissions. You choose what the assistant may do. Reading is the default request.
• Writes need your approval by default. A change is first proposed with a summary and preview, and applied when you confirm it. Pending proposals expire. Destructive actions always need your approval.
• Deleting needs an extra permission. Destructive actions require a separate scope on top of ordinary write access.
• Account deletion is never exposed. An assistant cannot delete your Finsplore account or purge your data.
• An activity log. Each request an assistant makes is recorded, and you can review it in your settings.
• Revoke at any time. You can disconnect an assistant, and its access ends on its next request.

Finsplore is read-only in the sense that it cannot move your money. It is not a bank or lender, and it does not give personal financial advice. For the product’s wider approach to your data, see security and privacy, and for the connection feature see Finsplore Connect.

What if you decide not to connect an assistant?

That is a fine choice. You can use a finance app on its own and keep AI assistants out of it. If you do want help from an assistant, you can ask general questions without sharing your records, for example how a type of account works, and enter your own figures yourself only where you are comfortable.

If you want to see your money in one place without a live connection, Finsplore works from statements you import. Our guide to how to work out your net worth is a good starting point.

If you want help deciding what is right for your situation, consider speaking with a licensed financial adviser.