Is it safe to connect your finances to ChatGPT?

This is the biggest difference and the least explained.

Apps that connect your bank need your banking credentials, directly or through an intermediary. Giving an AI access there extends a chain that already started at your bank.

Apps with manual entry, like Neto, have no banking credentials to pass on, because they never ask for them. What the assistant sees is data you typed yourself.

That does not make it harmless: a hand-typed, categorised spending history is, if anything, more revealing than a bank statement. It says where you eat, when you travel and how you spend your time. The difference is not that it matters less, it is that there is no door to your bank for anyone to push.

One fact that illustrates it: since October 2026 several large banks have started blocking or limiting AI agents' access to their customers' accounts, and at least one rewrote its contract to make clear that using an agent is at the customer's own risk. That debate does not exist when no bank is connected.

Reading is not the same as writing. Before accepting, look for answers to these:

• Can it only look things up, or also add, change and delete?
• Can I grant read-only if I want to?
• Can it touch my password or delete my account?
• Can it move real money, or only record entries?

A permissions screen that does not clearly tell you what the assistant cannot do is a bad sign. And that is exactly what almost no app spells out.

If you give write access to a system that sometimes gets things wrong, what protects you is not a promise that it will not. It is being able to go back.

Ask two things:

• Is there a log of what the assistant did, visible to you?
• Can a change be undone, and for how long?

There are well known apps with AI connectors that grant write access and offer neither. It is the clearest line between a product that was thought through and one that was rushed.

This sentence gets repeated a lot and is worth reading slowly. They are two different promises:

• Not training means your data does not feed the model.
• Not storing means it is not kept.

A company can honour the first and not the second. And there is a third nuance: the setting may be on or off by default, and it is not the same across assistants.

When you connect your finances to an assistant, the data leaves for the company behind it, which decides on its own what to do with it. Whatever happens there is not controlled by the app that gave you the connector. It is worth opening your settings with that assistant and checking yourself.

It is called prompt injection. The idea is simple: an assistant that reads data and can also act may be fooled if something that looks like an instruction is slipped into that data. This is not a laboratory theory: Spain's data protection authority, the AEPD, devotes a section to it in its February 2026 guidance on agentic AI, alongside data exfiltration and zero-click attacks.

What reduces the risk in practice:

• Grant read-only while you do not need more.
• Ask it to show you what it is about to change before it changes it.
• Have undo and a log, which turn a mistake into an annoyance instead of a problem.
• Disconnect when you stop using it.

A short checklist to decide in two minutes:

1. 1. The official address of the connector, published by the company. If you got it from a forum, do not use it.
2. 2. A permissions screen that says what it can and cannot do.
3. 3. Read and write separated.
4. 4. Undo, with a stated time limit.
5. 5. An activity log you can read yourself.
6. 6. A privacy policy saying what leaves, who receives it and how long it is kept.
7. 7. Immediate disconnection, from the app and from the assistant.
8. 8. Knowing that disconnecting does not delete what the assistant already received.

We spell this out so you can compare it with any other app, not because it is the only right way:

• Neto does not connect to any bank, so there are no banking credentials in play.
• The assistant cannot change your password, delete your account or move real money: what it records are entries in your own books.
• Write access is a separate permission that you grant.
• You can undo for 30 days and read the log for 90.
• The connection expires after 90 days and is cut off immediately when you remove it.
• Neto does not train any model on your data.
• It is all written down in the privacy policy, section 10e.

If you want the detail of what you can ask it, see connecting Neto to your AI, and the exact steps in how to connect Neto to Claude.

• Spanish Data Protection Agency: guidance on agentic artificial intelligence (PDF, February 2026, in Spanish).
• MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers (arXiv).