Is it safe to upload bank statements to ChatGPT or Claude?

By Jake Marsh6 min read
Direct answer: It is reasonably safe if you change the settings first, but it exposes more than most questions need. A statement gives OpenAI or Anthropic your name, address, account number and every transaction. Turn off model training, use a temporary or incognito chat, and upload a transactions-only CSV. Deleted chats leave their systems within about 30 days.

What a statement gives away

Uploading a statement doesn't give an AI assistant any access to your bank. It can't sign in or move money from a file. What changes is who holds a copy of your information. A typical statement includes:

  • Your full name and mailing address
  • Your account number
  • Every transaction in the period, including rent, medical charges and paychecks
  • Names of people you pay or who pay you

That file now sits with OpenAI or Anthropic under your account's settings, and with anyone who can open your AI account. Most questions, such as "what did I spend on groceries?", don't need any of the identifying details.

ChatGPT and Claude compared

For individual plans, from OpenAI's and Anthropic's help pages, read November 6, 2026:

ChatGPTClaude
Used for training?May be, unless you opt outOnly if you allow it, or the chat is flagged for safety review
Where to change itSettings, Data controls, Improve the model for everyoneSettings, Privacy, Help Improve our AI models
Private chatTemporary chat: no training, out of history, a copy kept up to 30 days for safetyIncognito chat: not used to improve Claude
When you delete a chatPermanent deletion scheduled within 30 daysRemoved from back-end storage within 30 days
What outlasts deletionCopies saved separately in Library or Space; security or legal holdsDe-identified training data up to 5 years if training is on; flagged chats up to 2 years; legal holds

On both, the thumbs up and down buttons change things. OpenAI says that feedback lets it use the entire conversation for training even after you opt out, and Anthropic stores the related conversation for up to 5 years. Skip those buttons in any chat that holds a statement.

Before you upload

  • Change the training setting. It applies to new chats, so do it first.
  • Use a temporary or incognito chat. Don't save a temporary ChatGPT chat afterward: saving turns it into a regular chat under your normal settings.
  • Upload a transactions-only CSV. It usually leaves out your name, address and full account number. ChatGPT and Claude both read CSV files, and they tend to read them more reliably than PDFs.
  • Send the shortest period that answers the question. One month is less to expose than a year.
  • Protect the AI account. Turn on two-factor authentication, and stay out of accounts you share with other people.

After you're done

  • Delete the chat. Content from a file can stay in the conversation until you do.
  • In ChatGPT, also delete any saved copy in Library or Space. OpenAI says deleting a chat doesn't remove those.
  • Don't leave statements in a project or custom GPT, where files stay until you remove them or delete the project or GPT.
  • Don't create a share link for that chat.

Uploading vs a read-only connector

A connector such as BankBridge shares your data differently. Neither option keeps your data away from the AI company, since what the assistant reads still enters the conversation. The difference is how much it reads.

Statement uploadBankBridge
Identity detailsName, address, full account numberAccount name and last 4 digits
Amount of dataThe whole fileWhat each question requests
Companies involvedThe AI companyThe AI company, BankBridge and its bank-connection provider
To stopDelete each chat and fileRemove the connector, and delete past chats you don't want kept

Anthropic's training page adds a point for Claude: training data doesn't include raw content from connectors, including remote MCP servers, unless it's copied directly into your conversation. A file you upload has no such exception.

BankBridge is read-only, doesn't keep a copy of your transactions, and never sees your bank password. It costs $5 a month per connected bank, so uploads remain the better fit for a one-time question or if you'd rather not connect a bank at all. If you ask every month, the connector safety checklist covers what to look for, and you can connect your bank in about five minutes.

Statements that belong to a business or a client

OpenAI says it doesn't use ChatGPT Business, Enterprise or Edu content to improve models by default, and Anthropic says the same of its commercial products, apart from feedback you choose to send. Use one of those workspaces for company statements. If you hold a client's statements, check your engagement terms and any rules that apply to your profession before uploading them to any AI tool.

FAQ

Does ChatGPT train on bank statements I upload?

On Free, Plus and Pro it may, unless you turn off Improve the model for everyone under Settings, Data controls. Temporary chats aren't used for training while they stay temporary. OpenAI doesn't train on ChatGPT Business, Enterprise or Edu content by default.

Does Claude train on bank statements I upload?

On Free, Pro and Max, only if you allow it, or if a chat is flagged for safety review. Check Settings, Privacy, Help Improve our AI models. Incognito chats aren't used to improve Claude. Commercial plans aren't used for training by default.

How long does ChatGPT keep an uploaded statement?

A regular chat stays until you delete it, and OpenAI then schedules permanent deletion within 30 days unless it must keep it longer for security or legal reasons. A copy saved to Library or Space is separate, so delete that as well.

Can someone take money using my bank statement?

A statement upload gives the assistant no access to your bank, and it can't move money from a file. The risk is exposure: account numbers and personal details sitting in a chat history, which anyone signed in to your AI account can read. Use two-factor authentication on that account.

Should I remove my account number first?

Yes, if you can. A CSV export of transactions usually leaves out your name, address and full account number. If you only have a PDF, a redaction tool works, as long as it removes the text itself and doesn't just draw a box over it.

BankBridge shows you your own account data. Nothing on this page is financial, tax or legal advice; check anything that matters with a qualified professional.

This guide shows how to work with your own account data using AI tools. It is general information, not financial, tax or investment advice. For decisions about your money, check with a qualified professional.