To know what an AI investment platform can access, inspect the specific permissions on the connection you are about to authorize—not just the words “connect,” “secure” or “read-only.” Check which records it can see, whether it can change anything or place trades, what information may be sent to AI providers, and how to revoke access and delete retained data. The checklist below helps you assess a particular connection before sharing brokerage, fund or private research data.
What can the platform see and do?
Start with the actual consent screen, API scopes and documentation for the connection you will use. Make two inventories: the data it can reach and the actions it can take. A broad product description does not establish that an account connection is read-only.
As an Amazon Associate I earn from qualifying purchases.
- Data: holdings, balances, transactions, fund or LP records, private documents, research notes and exports.
- Actions: view, edit, share, export, delete, trade or transfer.
Look for permission names that distinguish reading from writing. Carta documents scope names using read_ and readwrite_ patterns, which indicate different endpoint capabilities in its API. Trading 212 says users can choose API-key permissions that may include read-only access or placing orders. Those examples show why the specific scope matters; they do not establish the permissions of another vendor or of every connection offered by these services. See Carta’s OAuth scopes and Trading 212’s API-key guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
Whose access does the connection inherit?
Confirm whether the integration acts with the permissions of the person who authorized it, whether it is scoped to an individual account or an organization, and what happens when that person’s role changes or they leave. A connection should not silently grant access to records the authorizing user could not otherwise view.
#1 Best Overall
Carta says an application’s access matches the granting user’s permissions and checks the user’s current role. It notes that an endpoint can return 403 Forbidden if a role change removes access. AngelList says its MCP uses the same authentication and authorization infrastructure as its web app and can reach only data the user could see there. These are vendor descriptions of their own systems; verify how the specific account and configuration behave. See Carta’s OAuth scopes and AngelList’s MCP documentation.
How are team, tenant and document boundaries enforced?
For a team or institutional account, ask how the platform separates organizations and checks permissions when a user opens or downloads a document. Determine whether roles, tenant boundaries and document-level permissions apply consistently across the web app, API, exports and AI features. If the product has investor-facing portals, verify that those users cannot reach management tools or other investors’ records.
Rank #2
Prism describes authenticated document delivery and portal access linked to LP records, as well as tenant isolation, role controls, document permissions and auditability. Treat these as claims to validate against your own configuration and the current security materials, not as independent confirmation. Its trust centre and security page identify relevant controls to examine.
What happens to information used by AI features?
“Read-only” describes what the connection can do to source records; it does not tell you what happens to the information after the platform reads it. Ask which prompts, documents, holdings and derived outputs are sent to model providers, whether that information is retained, whether it may be used to train models, and which subprocessors receive it. Check whether data is automatically included in every query or only used when you select it, and whether the answers vary by plan or account tier.
Kimpton’s security overview says users control when vault documents and portfolio information are used as AI context. Its materials also describe revocable connections and deletion associated with disconnecting a portfolio. These are vendor statements, so verify them in the current privacy terms, contract and configuration. In particular, do not treat a “not used for training” statement as a complete retention or sharing policy. See Kimpton’s security overview.
Can you revoke access, and what is deleted?
Find the exact steps to disconnect the integration and revoke its tokens. Then ask what happens to imported copies, AI-session data, exports, logs and backups. Clarify whether revocation takes effect immediately, whether deletion is automatic or requires a separate request, and what data may remain after disconnection under the applicable contract.
Rank #4
AngelList describes a scoped token that can be revoked. Kimpton says connections are revocable and data associated with a disconnected portfolio is deleted. Those descriptions do not establish operational timing or the treatment of every copy, log or backup. Get a specific answer for the account and agreement you are evaluating. See AngelList’s MCP documentation and Kimpton’s security overview.
What security and monitoring evidence should you request?
Request current materials that let you evaluate the platform for your use case and organization’s requirements. A trust-centre landing page is a starting point, not a substitute for reviewing the underlying evidence.
Best Value
- Current security report or other independent assurance materials, and the scope and date they cover.
- Data-processing agreement, subprocessors, retention schedule and deletion terms.
- Role and administrator controls, audit-log coverage, and how OAuth grants and permission changes are monitored.
- Incident notification process and the route for reporting a security concern.
- Documentation showing which controls apply to your plan, deployment and integration.
Prism describes a trust centre and security layers that can help identify what to request, but review the actual materials before relying on them. The Cloud Security Alliance’s 2026 research note recommends limiting maximum OAuth scopes for AI SaaS tools and monitoring OAuth-related events; apply that guidance to the controls your organization can configure. See Cloud Security Alliance research, Prism’s trust centre and Prism’s security page.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to compare platforms consistently
When assessing more than one service, use the same questions and record whether each answer is documented, contractual or only verbal. That makes gaps visible without treating marketing language as evidence.
| Compare | What to establish |
|---|---|
| Permission granularity | Which scopes are granted, and whether read, write, trade, transfer or other actions are separately controlled. |
| Data and account boundaries | Which records and accounts are reachable, whose permissions govern access, and whether organization and document boundaries are enforced. |
| AI data handling | What is sent to model providers or subprocessors, how long it is retained, and whether it can be used for training. |
| User and administrator controls | Who can authorize integrations, manage roles, review activity and change access. |
| Revocation and deletion | How to revoke tokens and disconnect, what deletion covers, and what remains in logs or backups. |
| Auditability and assurance | Which events are logged and monitored, and what current independent assurance applies to the product and deployment. |
A pre-connection checklist
- Read the authorization screen and documentation for the exact integration; record its data scopes and allowed actions.
- Confirm whose permissions apply, what account or tenant the grant covers, and how access changes when a user’s role changes.
- For organization use, verify tenant separation, document-level checks, portal limits and auditability.
- Ask what information AI features send, retain or use as context, including provider, subprocessor and training terms.
- Test or obtain written instructions for revoking access and deleting data, including expected timing and exceptions.
- Review current security, privacy and contractual materials against your requirements, and keep a record of unresolved answers.
Vendor pages and API documentation describe what each company says its controls do; they are not independent proof that the controls operate as described. Recheck the live consent scopes and applicable terms for the exact product, region, plan and deployment you intend to use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
