61–70 of 141 posts
I don't really get this; could just use Plaid and have your own transaction/net worth site/app in a few hours with Claude Code and it'd be much more consistent.
It's amazing to me how little people care about their data. Giving it to an AI company for non-training purposes is OK now? Was it okay before?
Dear company who has extensive military contracts and is founded in stealing data from people here is every single financial transaction I have ever made! Please don't use it for surveillance pricing tee hee.
At least apple credit cards give you money for that rather then the other way around.
Earlier quoted context omitted.
Actually, it's deterministic -- our product doesn't move money, so when the user gives us access through Plaid, we're only getting read-level permissions. We actually don't even get full account numbers. A company working with Plaid has to request separate product "scopes" through Plaid in order to be able to move money.
I'm not that familiar with Plaid, but if it works like Yodlee, users have to hand over their credentials so there's no real security, it's just that their scraper is designed to be look not touch.
Earlier quoted context omitted.
It's read only, we can't move money. And I totally hear you -- we had this happen in our family as well, and it was really sad. Security is a massive priority for us, but it's always going to be a cost-benefit analysis for each person. Happy to share more about our infra in a follow-up post.
What makes it read-only? You told the AI "don't"?
I seriously hope this doesn't happen by the way but yea. This is not for me.
- Backend & CLI are both strictly linted Rust. The webapp runs on Axum (Rust web framework), and connects to Postgres via sqlx.
- Financial read-only. There's no transfer, pay, or send tool in the product. Nothing in the AI surface can move money.
- We request transactions, investments, and liabilities from Plaid. We don't request auth, transfer, or payment_initiation, so we never receive full account numbers or routing numbers — just the last-4 mask Plaid returns by default.
- Bank usernames and passwords go to Plaid Link, not us. We only hold a per-institution access token.
- Plaid access tokens live in a separate database behind a single custody Cloud Run service, encrypted at rest by Cloud KMS. The broker calls KMS's encrypt/decrypt endpoints — the root key material never leaves Google's HSM boundary and the broker's service account is the only one with encrypt/decrypt permissions. The web app doesn't have permission to read that database.
- Every encryption and decryption call passes the Plaid item ID as AAD (additional authenticated data). A ciphertext from one item cannot be swapped in and decrypted as another item's token.
- Each Cloud Run service (including our web app) runs under its own cloud identity and with its own DB role.
- Internal calls between services are authenticated: the caller presents a short-lived identity token from the cloud provider, and the receiver verifies it.
- The prod databases have no public IP. Secrets live in managed secret storage, not in source or container images.
- The AI connector is OAuth 2.1 + PKCE, scoped per user, revocable from the UI. Every tool call records the tool name, sanitized args, calling client, and the reason the agent supplied, so you can see what your LLM asked on your behalf.
- There are no fetch-URL, shell, or general I/O tools in the AI surface. Tools return structured financial data and nothing else.
- Networking, IAM, and DB grants are all in Terraform. All infra changes go through that path.
- Infra access is gated by 2fa and security keys.
Maybe my net worth is too low but I just don't see a value proposition. I don't want daily emails from LLMs and if I need updates on my investments any more often than quarterly (at most), I should probably seek safer investments. I am a bit interested in budgeting tools, but I want them to be completely deterministic. For me at least, financial planning is pretty uneventful and time spent optimizing expenses more th…
Earlier quoted context omitted.
What makes it read-only? You told the AI "don't"?
It's read only until they get hacked like dozens of other ai start ups are... I seriously hope this doesn't happen by the way but yea. This is not for me.
It's amazing to me how little people care about their data. Giving it to an AI company for non-training purposes is OK now? Was it okay before?
I was just thinking the same thing. Dear company who has extensive military contracts and is founded in stealing data from people here is every single financial transaction I have ever made! Please don't use it for surveillance pricing tee hee. At least apple credit cards give you money for that rather then the other way around.
I’m Canadian and have been using https://lunchmoney.app/ for tracking with Plaid integrations. They have an api and I got llm to write a CLI for it. That way agent can pretty much pull the data it needs or wants. One thing I also had it do is build up a series of rules for tagging which then I run a cron for once a day. Every once in a while I just ask it to look over the rules and make new ones for uncategorized tra…
Nice! What are your main use-cases?
The other use case funnily enough was to ask how much I’m spending on hobby dev.
Make sure I’m not getting carried away across llm subscriptions, as well as cloud costs.
I think the nice part is once you have the cli you just use the agent in your ide as your chat interface.