THE TOOLS
What your assistant can ask for.
An assistant only sees the tools your grant covers. Without transactions:read it is never offered search_transactions at all, rather than being told no when it tries.
run_analytics_query
Totals, grouped and filtered however the question needs. Answers most questions without returning a single transaction.
category_breakdown
What a period went on, by category, with the business and personal split available as a filter.
compare_periods
This month against last. This year against the one before. Two numbers and the difference.
list_accounts
Names, currencies and types. No balances, and never a full account number.
search_transactions
The one tool that does hand back rows, for when the question really is about a specific charge.
What "it never sees your data" can honestly mean.
It cannot mean an assistant is blind to something it asked for. If a tool hands back your transactions, the assistant has your transactions. Anyone telling you otherwise is describing something they have not built.
Here is the narrower version, which is true and more useful.
- Answers, not row dumpsThe tools are built around totals. "What did I spend on groceries in Q2" is one call and one number, and no transaction leaves the server to answer it.
- You grant the scopes, and you take them backRead the analytics without reading the transactions. That is a real combination, and a useful one. Revoke it from your profile and the next call is the one that fails, not the next renewal.
- On this path, your assistant is the only modelYour assistant asks, we answer — no model of ours sits in between, so nothing goes to anyone you did not pick. (The in-app chat is the exception, and the privacy policy names it: it uses Google's Gemini API to read your rows and write the reply.)
- One write, and only oneAn assistant can import a statement. It cannot recategorise, delete, change a scope or touch your account. The worst a confused agent can do to you is waste an import.
Anyone who can bill your card can write to your agent.
A merchant name is text an attacker chooses. Whoever charges you decides what appears on the line, so a statement descriptor is an input written by someone else and read by your assistant.
So raw descriptors come back fenced as data and are never dropped into instructions, and almost the whole tool surface is read-only. The protection is that there is nothing destructive to trick an agent into doing. It is not a filter that has to catch every phrasing of an attack.