Pennylane and Claude: how can you connect AI without exposing client files?

Consider a scenario: an employee connects their personal Claude Pro subscription to Pennylane to prepare for a client meeting, without adding any restriction to the client files available under their existing permissions. Without additional access segregation, that scope may be too broad for the assignment. It does not give Claude unlimited access to Pennylane: the assistant remains bound by the user’s permissions and authorised tools. The connector is read-only, but retrieved data is then processed outside Pennylane by the external assistant.

Connecting Pennylane to Claude can speed up analysis preparation. Protecting client files requires the accounting firm to control four things: the Claude account, Pennylane permissions, the data actually transmitted and who checks the results. A paid subscription, including a business plan, does not settle those questions on the firm’s behalf.

Before approving the connection, the firm needs to answer: which client file can be queried, from which Claude workspace, for what task and under which safeguards?

Documentation checked on 19 October 2026. Plans, features and terms may change. This article is a decision framework, not a compliance certification or legal opinion.

What does the Pennylane Claude connector actually do?

Pennylane provides an MCP server. MCP, short for Model Context Protocol, lets an assistant request data from another tool. Pennylane documents an OAuth connection to Claude: the user authenticates with Pennylane and authorises tools. This does not mean handing their Pennylane password to Claude.

At the time of our check, Pennylane says its MCP is available to accounting firms and to businesses on the Essentiel plan or above. It is read-only: it can retrieve data but cannot create, modify or delete it in Pennylane. Write access is described as work in progress, not an existing capability. Source: Pennylane connection documentation, in French.

Anthropic makes remote MCP connectors available on Free, Pro, Max, Team and Enterprise; Free is limited to one custom connector. Technical access to a connector therefore does not tell you whether someone is using a personal account or a firm-managed workspace. Pennylane’s own eligibility requirements still apply.

Existing user permissions may still be too broad for the task

Pennylane says the assistant inherits the user’s permissions: it does not gain access to additional client files. Enabled tools also limit what it can request. That prevents access to a file the user cannot already open in Pennylane. It does not decide whether data from an authorised file should be sent to Claude for this particular task.

Consider a fictional example. An engagement manager works across several clients but is preparing a cash forecast for just one. Their normal permissions may be appropriate for the job and excessive for that analysis. Telling the assistant “only look at this client” is an instruction, not a system-enforced access restriction.

The firm must align three scopes: what the staff member can see, what the connector can retrieve and what the assignment actually needs. If those do not match, reduce permissions or enabled tools, exclude the affected files, or work with data prepared outside the live connection.

Read-only does not mean the data stays inside Pennylane

An invoice does not have to be edited for confidential information to leave the accounting system. Pennylane’s security FAQ describes the route: the assistant sends a request, Pennylane returns authorised data, and the external assistant processes it under its provider’s terms. Pennylane’s European hosting does not automatically extend to that processing.

Anthropic also states that remote MCP connections run through its cloud infrastructure, including when used through Claude Desktop. Installing the desktop app on a firm’s computer does not make this a local processing arrangement.

The review must cover the conversations, summaries and exports produced afterwards. An overdue-invoice report can reveal client identities, amounts and cash-flow difficulties without any attachment. For the separate question of preparing accounting files before analysis, our guide to sending raw accounting files to AI explains why reducing the information transmitted still matters.

Pseudonymise before analysis without losing useful accounting data

To prepare a cash-flow analysis, Claude may not need a client’s name, an employee’s contact details or bank references. Where the task allows it, the firm can use a prepared copy with identifiers replaced while keeping the amounts, due dates, periods and accounting categories needed for the analysis. Information that does not help answer the question should not be sent.

Pseudonymisation is not anonymisation. Data remains personal where someone can be reidentified, including by combining it with other information. An unusual amount, transaction description, date or comment can still reveal an identity. File names, attachments and metadata also need checking. The GDPR and confidentiality obligations continue to apply; removing names does not remove those responsibilities.

A pseudonymised copy offers no such protection if the assistant can retrieve the original identities through another route. Access must be segregated, and the data actually reaching the model must be checked. Do not assume that the Pennylane–Claude connector pseudonymises data by default. If this protection is needed, the firm must approve a suitable processing arrangement before transmission—not send raw files and ask the AI to mask them after it has received them.

Personal Claude Pro, Team or Enterprise: what actually changes?

Anthropic distinguishes its consumer products—Free, Pro and Max—from commercial products, including Claude for Work, which covers Team and Enterprise. For the latter, its documentation describes the customer organisation as the controller and Anthropic as the processor for data submitted in that context. The data processing addendum, or DPA, is incorporated into its commercial terms.

Anthropic says it does not use commercial-product inputs or outputs to train its models by default. Voluntary data-sharing and feedback mechanisms still need checking because different rules can apply. Team provides organisation-level administration and currently starts at two members, according to the official page checked. That is a plan requirement, not a compliance threshold.

“Pro” is not shorthand for a business contract. Paying personally, claiming expenses or using a work email address does not establish which terms govern a conversation. Check the actual workspace and its relationship to the organisation.

A personal account does not mean every connected file is automatically used for training

Anthropic’s consumer documentation says model improvement depends in part on the user’s choice, with separate provisions for safety and feedback. Crucially, the data described for that improvement does not include raw connector content, including remote and local MCP servers. Data may, however, be included if it is directly copied into the conversation.

It would therefore be inaccurate to claim that a Claude Pro account necessarily trains the model on every Pennylane file. Excluding raw connector content does not mean there is no processing, retention or transfer. Review connector data, information copied into the chat and resulting outputs separately. Source: Anthropic’s consumer data-use rules.

Why is a business subscription not enough?

A DPA and a no-training commitment answer important questions. They do not establish that the firm needed to send the data, that retention fits the assignment or that the safeguards meet its professional confidentiality obligations.

Before approving a connection, the business owner and those responsible for data protection should be able to document:

• Purpose: preparing a cash summary, for instance, rather than opening all client files to AI without a defined task.
• Minimum necessary data: aggregated figures, masked identifiers or excluded information where the task does not require it. Pseudonymisation does not automatically take data outside the GDPR.
• Supplier arrangements: applicable terms, a DPA where required, subprocessors, processing locations and safeguards for any transfers outside the EU.
• Data lifecycle: retention of conversations and outputs, internal sharing, feedback, staff departures and withdrawal procedures.
• Accountability: who approves the use, who verifies the figures and who can suspend the connection.

If one of these remains unknown, a trial using fictional or prepared data may be the right next step—not an immediate connection to client files. Pennylane explicitly warns that using a paid or enterprise assistant does not remove the user’s responsibility for these checks.

How do you start without opening up the whole firm?

Choose one question, such as preparing expected customer receipts for a meeting. Give the pilot an owner, one authorised client file, a defined period and a reviewed output. Start with fictional or minimised data; move to a real scope only after the necessary approvals.

A useful test proves more than the quality of an answer. A prohibited file must remain inaccessible, and unnecessary tools must be disabled. Amounts and periods must reconcile to the source; missing data must be flagged. Withdrawing access must block new requests. Keep enough evidence to justify the use without unnecessarily duplicating sensitive records.

Pennylane documents administrator controls to suspend MCP access for a firm or specific client files. Check the scope carefully: suspending a firm’s access to a file does not necessarily disable a client’s own connection. And disconnecting does not delete data already sent to the assistant. Revoking future access and dealing with existing data are separate jobs.

For this pilot, Say Digital starts with the question to answer and evidence that access restrictions work, before integrating and testing for a controlled rollout. Changes to permissions or tools need review and retesting; custom automation can use a versioned testing and deployment pipeline. Measure preparation time and required corrections before claiming a productivity gain. When a summary needs to become a management tool, our AI financial dashboard guide explains which rules and responsibilities the indicators need.

What is Hermes, and how could an agent help an accounting firm?

Hermes Agent is open-source software developed by Nous Research that lets an AI assistant carry out tasks using tools and procedures. It is not a language model. A large language model, or LLM, generates responses and proposes actions; agent software organises the assignment and executes authorised tools. Our business guide to Hermes Agent explains that distinction and where human control belongs.

For an accounting firm, the value is repeatable preparation: following a documented procedure, calling only the tools selected for the assignment, drafting a summary and requesting approval before a sensitive action. Access restrictions and denied operations must be configured in the tools and environment, then tested. A written instruction in a chat is not enough. Reusable procedures can be corrected after review without allowing the agent to rewrite the firm’s rules on its own.

If the agent can access client files, read untrusted external content and send information out, those permissions need reviewing together: our guide to the AI assistant risk triangle explains how that combination can create a path for data to leave the firm.

Hermes Agent can coordinate protected document preparation if that workflow has been designed for the purpose. The product name guarantees neither pseudonymisation, a document vault nor private hosting. Those are architectural choices and components that Say Digital must configure, test and have the firm approve. Adding an agent does not change the cloud processing route of the Claude connector described above.

AI prepares; the accountant validates

Claude can draft a summary, flag apparent inconsistencies or suggest questions. The accountant remains responsible for validating accounting judgements, advice and sensitive client-facing material. A proposed payment reminder, tax treatment or payment decision is not authorised simply because an assistant suggested it.

A firm can approve a specific Pennylane AI task when it has an approved account, limited data, verifiable results and a working way to withdraw access. Where those conditions are missing, keep the test away from client files.

When should you consider a local model with an AI agent?

If a client file’s constraints make external processing unsuitable, the firm needs to assess a different workflow, not simply change its Claude subscription. A local LLM runs the model on equipment under your control. Hermes Agent can organise tasks around a compatible local model, subject to its tool-use capabilities and available computing resources. Connectors, supporting services, logs and access still need checking: running a model locally does not automatically keep the entire system closed.

Our LM Studio guide to local AI explains how local model execution works; our Hermes Agent guide explains how an agent organises the work. Combining the two does not replace data minimisation or the accountant’s review.

Want to use Pennylane data without sending whole client files? Say Digital can help your firm define a limited assignment, identify the required protections and test a prototype before rollout. Depending on the actual constraints, that may mean a controlled Claude connection, prepared data or a local workflow. The aim is useful, verifiable preparation that remains under the firm’s control.

Sources and checked resources

Sources consulted on 19 October 2026. Relative update labels in help centres are not contractual dates.

• Pennylane — MCP connection, eligibility, permissions and suspension (French).
• Pennylane — MCP security and privacy FAQ, dated 28 August 2026 (French).
• Anthropic — remote MCP connectors, supported plans and cloud infrastructure.
• Anthropic — Team plan and minimum membership.
• Anthropic — controller and processor roles in Claude for Work.
• Anthropic — DPA incorporated into commercial terms.
• Anthropic — training, commercial products and feedback.
• Anthropic — training, consumer products and exclusion of raw connector content.
• Anthropic — commercial terms.
• Kounty — its Gold partnership statement and legal notice identifying Ariel Zini.
• CNIL — anonymisation, pseudonymisation and reidentification risk (French).
• Nous Research — official Hermes Agent documentation.