{"id":14571,"date":"2026-10-19T21:42:51","date_gmt":"2026-10-19T19:42:51","guid":{"rendered":"https:\/\/say-digital.io\/blog\/pennylane-claude-connector-protect-client-data\/"},"modified":"2026-10-19T22:30:01","modified_gmt":"2026-10-19T20:30:01","slug":"pennylane-claude-connector-protect-client-data","status":"publish","type":"post","link":"https:\/\/say-digital.io\/blog\/pennylane-claude-connector-protect-client-data\/?lang=en","title":{"rendered":"Pennylane and Claude: how can you connect AI without exposing client files?"},"content":{"rendered":"
\n

Pennylane and Claude: how can you connect AI without exposing client files?<\/h1>\n

Consider a scenario: an employee connects their personal Claude Pro subscription to Pennylane to prepare for a client meeting, without adding any restriction to the client files available under their existing permissions. Without additional access segregation, that scope may be too broad for the assignment. It does not give Claude unlimited access to Pennylane: the assistant remains bound by the user\u2019s permissions and authorised tools. The connector is read-only, but retrieved data is then processed outside Pennylane by the external assistant.<\/p>\n

Connecting Pennylane to Claude can speed up analysis preparation. Protecting client files requires the accounting firm to control four things: the Claude account, Pennylane permissions, the data actually transmitted and who checks the results. A paid subscription, including a business plan, does not settle those questions on the firm\u2019s behalf.<\/strong><\/p>\n

Before approving the connection, the firm needs to answer: which client file can be queried, from which Claude workspace, for what task and under which safeguards?<\/p>\n

Documentation checked on 19 October 2026. Plans, features and terms may change. This article is a decision framework, not a compliance certification or legal opinion.<\/small><\/p>\n

What does the Pennylane Claude connector actually do?<\/h2>\n

Pennylane provides an MCP server. MCP, short for Model Context Protocol, lets an assistant request data from another tool. Pennylane documents an OAuth connection to Claude: the user authenticates with Pennylane and authorises tools. This does not mean handing their Pennylane password to Claude.<\/p>\n

At the time of our check, Pennylane says its MCP is available to accounting firms and to businesses on the Essentiel plan or above. It is read-only<\/strong>: it can retrieve data but cannot create, modify or delete it in Pennylane. Write access is described as work in progress, not an existing capability. Source: Pennylane connection documentation, in French.<\/a><\/p>\n

Anthropic makes remote MCP connectors available on Free, Pro, Max, Team and Enterprise; Free is limited to one custom connector. Technical access to a connector therefore does not tell you whether someone is using a personal account or a firm-managed workspace. Pennylane\u2019s own eligibility requirements still apply.<\/p>\n

Existing user permissions may still be too broad for the task<\/h2>\n

Pennylane says the assistant inherits the user\u2019s permissions: it does not gain access to additional client files. Enabled tools also limit what it can request. That prevents access to a file the user cannot already open in Pennylane. It does not decide whether data from an authorised file should be sent to Claude for this particular task.<\/p>\n

Consider a fictional example. An engagement manager works across several clients but is preparing a cash forecast for just one. Their normal permissions may be appropriate for the job and excessive for that analysis. Telling the assistant \u201conly look at this client\u201d is an instruction, not a system-enforced access restriction.<\/p>\n

The firm must align three scopes: what the staff member can see, what the connector can retrieve and what the assignment actually needs. If those do not match, reduce permissions or enabled tools, exclude the affected files, or work with data prepared outside the live connection.<\/p>\n

Read-only does not mean the data stays inside Pennylane<\/h2>\n

An invoice does not have to be edited for confidential information to leave the accounting system. Pennylane\u2019s security FAQ describes the route: the assistant sends a request, Pennylane returns authorised data, and the external assistant processes it under its provider\u2019s terms. Pennylane\u2019s European hosting does not automatically extend to that processing.<\/p>\n

Anthropic also states that remote MCP connections run through its cloud infrastructure, including when used through Claude Desktop. Installing the desktop app on a firm\u2019s computer does not make this a local processing arrangement.<\/p>\n

The review must cover the conversations, summaries and exports produced afterwards. An overdue-invoice report can reveal client identities, amounts and cash-flow difficulties without any attachment. For the separate question of preparing accounting files before analysis, our guide to sending raw accounting files to AI<\/a> explains why reducing the information transmitted still matters.<\/p>\n

Pseudonymise before analysis without losing useful accounting data<\/h2>\n

To prepare a cash-flow analysis, Claude may not need a client\u2019s name, an employee\u2019s contact details or bank references. Where the task allows it, the firm can use a prepared copy with identifiers replaced while keeping the amounts, due dates, periods and accounting categories needed for the analysis. Information that does not help answer the question should not be sent.<\/p>\n

Pseudonymisation is not anonymisation.<\/strong> Data remains personal where someone can be reidentified, including by combining it with other information. An unusual amount, transaction description, date or comment can still reveal an identity. File names, attachments and metadata also need checking. The GDPR and confidentiality obligations continue to apply; removing names does not remove those responsibilities.<\/p>\n

A pseudonymised copy offers no such protection if the assistant can retrieve the original identities through another route. Access must be segregated, and the data actually reaching the model must be checked. Do not assume that the Pennylane\u2013Claude connector pseudonymises data by default.<\/strong> If this protection is needed, the firm must approve a suitable processing arrangement before transmission\u2014not send raw files and ask the AI to mask them after it has received them.<\/p>\n

Personal Claude Pro, Team or Enterprise: what actually changes?<\/h2>\n

Anthropic distinguishes its consumer products\u2014Free, Pro and Max\u2014from commercial products, including Claude for Work, which covers Team and Enterprise. For the latter, its documentation describes the customer organisation as the controller and Anthropic as the processor for data submitted in that context. The data processing addendum, or DPA, is incorporated into its commercial terms.<\/p>\n

Anthropic says it does not use commercial-product inputs or outputs to train its models by default. Voluntary data-sharing and feedback mechanisms still need checking because different rules can apply. Team provides organisation-level administration and currently starts at two members<\/strong>, according to the official page checked. That is a plan requirement, not a compliance threshold.<\/p>\n

\u201cPro\u201d is not shorthand for a business contract. Paying personally, claiming expenses or using a work email address does not establish which terms govern a conversation. Check the actual workspace and its relationship to the organisation.<\/p>\n

A personal account does not mean every connected file is automatically used for training<\/h3>\n

Anthropic\u2019s consumer documentation says model improvement depends in part on the user\u2019s choice, with separate provisions for safety and feedback. Crucially, the data described for that improvement does not include raw connector content, including remote and local MCP servers<\/strong>. Data may, however, be included if it is directly copied into the conversation.<\/p>\n

It would therefore be inaccurate to claim that a Claude Pro account necessarily trains the model on every Pennylane file. Excluding raw connector content does not mean there is no processing, retention or transfer. Review connector data, information copied into the chat and resulting outputs separately. Source: Anthropic\u2019s consumer data-use rules.<\/a><\/p>\n

Why is a business subscription not enough?<\/h2>\n

A DPA and a no-training commitment answer important questions. They do not establish that the firm needed to send the data, that retention fits the assignment or that the safeguards meet its professional confidentiality obligations.<\/p>\n

Before approving a connection, the business owner and those responsible for data protection should be able to document:<\/p>\n