Skip to main content
Most of what makes Fin useful runs on your machine and sends nothing. The parts that need a model take one of two roads, and you choose which.

​
What never leaves

Categorising by hand, categorising with the rules you have saved, reconciling, reports, tax export, the asset register — all of it runs against the SQLite database in your own folder. No request is made, so there is nothing to send.

See it for yourself

Turn on Airplane mode from the device chip and do a full day’s work — import, categorise, run a report. The outbound record stays empty.

​
When you ask Fin to think

Asking Fin’s intelligence to categorise a batch, answer a question, or read a receipt is the one thing that needs a model. On the desktop that happens one of two ways.

Through Fin's relay

The rows you asked about go to a stateless relay, are processed, and are not kept — no chat history, no cached copy, nothing written to any database. Fin records a count for your allowance, never the content.

Straight to your own provider

Connect your own AWS Bedrock, Anthropic or OpenAI key and the request goes from your machine to your provider directly. Fin’s servers are not in the path at all — a packet capture shows only your provider’s address.

​
The order Fin chooses

1

Your own key wins

If you have connected a provider key, every intelligence request uses it and goes straight to your provider.
2

Otherwise, a paid plan uses the relay

With no key connected, a Pro plan (or above) sends the request to the stateless relay. Free plans get a monthly chat allowance the same way the web app does; categorising, summaries and receipt reading are Pro features.
3

Otherwise, Fin says so

With no key and no paid plan, intelligent features are switched off and Fin tells you exactly how to turn them on — rather than failing silently.

​
Bring your own key

This is the strongest privacy posture the product offers: AI2Fin’s cloud never sees your content, because it is never in the path.
1

Open the data panel

Click the device chip in the header to open Where your data lives.
2

Choose a provider and paste your key

Under Where intelligence requests go, pick AWS Bedrock, Anthropic or OpenAI and enter your credentials. For Bedrock you can paste temporary (STS) credentials, not only a long-lived key pair.
3

Save & test

The test sends one tiny request through the same guarded path real calls take. When it succeeds, it is the newest line in your outbound record — named as your provider, marked as going straight to them.
Your key is sealed on this machine (AES-256-GCM) and never sent to AI2Fin. It is not stored in the database — so it does not travel when you back up or copy your data folder.
Bring-your-own is a paid-plan feature, and every BYO request still respects Airplane mode: a key you connected is a connection you can pause, not an exception to the boundary.

​
What each request carries

Only the rows involved — merchant, amount, date, the fields needed to classify. Processed and not retained. Your allowance counter goes up by a count; the content does not.
That one image, as a vision request. Processed and not retained. On a BYO key it goes straight to your provider.
Your message and the context Fin assembled locally to answer it. Chat history lives in your local database, never on Fin’s servers.
Send anything you did not ask for. Train a model on your data. Keep a copy of a relayed request. Bill an arbitrary model — the relay picks the model, so a modified client cannot run up a bill against Fin’s account.

​
Verify the claim

Everything above is checkable, and checking it is the intended reaction.

Run a packet capture

With Airplane mode on, nothing leaves. With a BYO key, the only destination is your own provider. With the relay, one destination per request, matching the line in Fin’s own outbound record. The record and the capture agree — which is what makes the record worth trusting the rest of the time.