The short version
- Look for read-only access to money.
- Look for approval before anything is sent.
- Look for encryption, and a way to disconnect.
It can be, with the right guardrails
Connecting AI to your accounts is as safe as the rules around it. The question isn’t whether to use AI; it’s what the AI is allowed to do on its own.
The checklist
Money should be read-only: the AI can see balances and transactions but can’t move a dollar. Anything that sends, posts or changes something should wait for your approval. Keys to your accounts should be encrypted and never reach your browser. You should be able to disconnect any account, or delete everything, at any time. And your data shouldn’t be sold or used to train AI.
Red flags
Tools that ask for your actual password. Vague “full access” permissions. Agents that act on their own by default. No record of what was done.
Where NOVA fits
NOVA can’t move money, place trades or sign anything. It asks before sending, booking or posting, and every action keeps a receipt: what, where, from which account. Account keys are encrypted, bank connections go through Plaid with two-step verification, and your data isn’t sold or used to train AI. Details are on the Privacy & Security page.