Is it safe to connect your brokerage to an app? What read-only access means

Connecting your brokerage to an app is reasonably safe when the access is read-only, the brokerage login goes through an established aggregator rather than the app itself, and you can revoke the connection whenever you like. Read-only access lets an app see your positions and balances. It can't place trades, withdraw money or change your settings.

That's the core of it. The rest of this post explains what to check, what risks remain, and how to back out.

Why people are nervous, and why that's healthy

Your brokerage account holds real money. Handing any access to a third party should make you pause. Some of that caution comes from older practices, like apps that asked for your username and password and logged in as you. That approach gave the app far more power than it needed.

Modern read-only connections are narrower. But "modern" isn't a guarantee, so it's worth knowing what to look for.

Read-only vs trading access

Not all brokerage connections are equal. The permission level is the most important thing to understand.

For tracking, research and asking an AI assistant questions about your holdings, read-only is all you need. If an app asks for more than its job requires, that's a reason to stop.

How aggregators work

Most apps don't connect to each brokerage themselves. They use an aggregator, a company that specialises in securely linking to many brokerages and passing data along with limited permissions.

When you connect through an aggregator, you typically:

1. Pick your brokerage from a list.
2. Sign in through the aggregator's connection screen or your brokerage's own login page, not a form inside the app.
3. Approve the access being requested.
4. Return to the app, which now receives your data through the aggregator.

The benefit is separation. The app you're using doesn't need to handle or store your brokerage password.

Bywell uses SnapTrade to connect brokerages such as Wealthsimple, Questrade, TD Direct Investing and Interactive Brokers. The connection is read-only. Bywell can't place trades, move money or see your password.

Questions to ask before you connect any app

Run through this list with any investing app, not just ours.

1. What access level is it asking for? Look for "read-only" stated plainly.
2. Who handles the brokerage sign-in? It should be an aggregator or your brokerage, not a form in the app.
3. What data does it store, and for how long? The privacy policy should answer this in plain language.
4. Can you delete your account and data? There should be a clear way to do it.
5. Who runs the company? Look for a real company name, a location and a way to contact them. Bywell is made by Kunolu, in Toronto.
6. What happens if the app connects to other services? If it passes data to an AI assistant, understand what the assistant receives and when.

What about connecting to an AI assistant?

Adding a brokerage connector to ChatGPT, Claude or another assistant adds one more link in the chain. It's worth being clear about what flows where.

• The assistant only receives data when it calls one of the connector's tools, usually because your question needs it.
• A read-only connector gives the assistant the same limits it has: see, not act. There's no tool for trading, so no chat message can turn into an order.
• What the assistant does with your conversation is governed by that assistant's own privacy settings and policies. Review them, especially any options about using chats for training.

Never paste your brokerage password, security codes or full account numbers into a chat. A proper connector never needs them. The setup is covered in How to connect your brokerage account to ChatGPT or Claude.

What risks remain with read-only access?

Read-only removes the scariest risk, someone trading or withdrawing from your account through the app. It doesn't remove every risk.

• Privacy. Your holdings and balances are personal information. If a company storing them were breached, that information could be exposed. Choose apps that store as little as they need.
• Phishing. Scammers imitate login pages. Only start a connection from inside the app you chose, and check the address before you sign in.
• Your own account security. The best protection for your brokerage is still a strong, unique password and two-factor authentication on the brokerage account itself.

It's also worth knowing what protects your account at the brokerage. In Canada, member firms of CIRO are covered by the Canadian Investor Protection Fund within its limits if a member firm becomes insolvent. In the US, SIPC plays a similar role for member brokers. Neither covers investment losses from market moves, and neither is about third-party apps, but both are useful to understand.

How to disconnect

You should always be able to undo a connection.

• In the app. Remove the brokerage or delete your account. On Bywell, you can do this from your account page.
• At your brokerage. Many brokerages list connected third-party apps in their security settings. Revoke access there too if you want to be thorough.
• In your assistant. Remove the connector from your assistant's settings if you no longer want it there.

The bottom line

A read-only connection through an established aggregator, from a company you can identify, with a clear way to disconnect, is a sensible level of risk for most people who want better information about their own investments. Anything that asks for trading or money-movement access deserves much more scrutiny.

If you're comfortable with that, you can connect a brokerage read-only with Bywell and see your holdings in the app or in your AI assistant.