Trust model
Let your agent work on your finances without giving Candor control of your money.
Candor keeps connected accounts, evidence, plans, and past decisions organized. Your agent uses that picture to show what changed, recommend what fits, and prepare action only under the authority you grant it.
$0 today · card required · cancel anytime
- Chase Everyday Checking •• 4410Read-only
- Ally High-Yield Savings •• 2291Read-only
- Fidelity 401(k) •• 8830Read-only
- Chase Freedom Visa •• 7713Read-only
ClaudeApproved Sep 12 · Last read today, 7:31 AM
ChatGPTApproved Sep 3 · Last read yesterday
Recorded, with the agent's reason
- 7:31 AMClaude · Keep the house goal on pace this month
- YesterdayChatGPT · Monday check-in: what's worth talking through
Illustrative example of the controls in your account.
Six boundaries Candor keeps
How Candor handles your data, credentials, and access.
Read-only outside Candor
Candor does not move money, trade, pay bills, open accounts, cancel subscriptions, file taxes, or change external accounts. It only keeps the financial context and follow-through your agent needs inside Candor.
Tokens stay backend
Provider access credentials stay in Candor-controlled backend systems. They are not stored in the CLI, local files, browser local storage, or agent prompts.
Local credentials stay protected
On macOS and Linux, the CLI keeps its OAuth sign-in in a credential file only your user can read, so scheduled runs work unattended; set CANDOR_CLI_CREDENTIAL_STORE=keyring to use the system keyring instead. Windows uses its native credential store. Bank logins never reach the CLI.
Scoped client authorization
Candor authorizes an OAuth client grant or browser session, not each individual agent process. Any agent that can use an authorized CLI or remote MCP client under that grant can access the financial data in its scopes.
Audited, redacted reads
Financial reads are audited at a high level: who or what accessed which kind of data, when, and roughly how much was returned. Audit records are designed not to become raw financial-data dumps.
User-owned controls
You can disconnect institutions, revoke authorized client access, export organized Candor data, and delete Candor data from account controls.
You approve anything your agent does outside Candor
Candor can surface facts like duplicate charges, subscription changes, avoidable fees, idle cash yield gaps, common options, and missing context. Those are decision inputs, not permission to act. If your agent drafts a message, opens a browser, cancels a service, moves money elsewhere, trades, files paperwork, or makes any external change, that happens outside Candor under the permission model you gave that agent.
See it with your own accounts.
Read-only from the first day. Disconnect an account or revoke an agent anytime.
$0 today · card required · cancel anytime