Your bank: the specification.
Today, the assistant reads your bank's CSV export. API access is set up only if your bank meets the conditions below. sme luxembourg decides, bank by bank. And you decide what it sees and what it can do.
The seven conditions
Read-only, through an official interface
The bank's API, or a provider licensed for account-information access (PSD2). Never your login credentials, never a robot logging in as you.
A scope chosen by you
The accounts, and the period. Nothing else.
Revocable without going through us
Consent is withdrawn from your bank's interface, at any time.
An access log
Every read is dated and viewable, on your premises.
No credentials stored
Neither at the assistant nor at the publisher. The access token stays on your machine.
Never a payment
The access cannot initiate a transfer. If the bank does not separate reading from paying, we stay with CSV.
An intermediary licensed in the European Union, if any
Licensed by an EU authority, servers in the EU, written contract.
What you decide
- What it sees: which accounts, which period.
- What it can do: read. Never pay.
- When it stops: you revoke, from your bank, without asking us.
How we review a bank
- We read its access documentation.
- We test with a read-only account.
- We check revocation and the log.
- We decide: API access, or CSV for now. The answer is written in your file.
Status on 21/10/2026
| Bank | CSV export | Read-only API access |
|---|---|---|
| Revolut Business | Export verified | The bank's own API, documented read-only scope. Demonstration in progress. |
| BGL BNP Paribas, BIL, Banque Raiffeisen | Export verified at setup | PSD2 API published on each bank's site, reserved for licensed providers: goes through a licensed intermediary. Review in progress. |
| Other banks | CSV or Excel export, verified at setup | Reviewed at a client's request |
Questions
Is CSV reliable?
Are you permanently connected to my bank?
My bank is not on the list.
A partnership with my bank?
What it never does without you
It doesn't pay. It doesn't send. It doesn't sign. It doesn't commit your company.
Draft mode
Every e-mail, every request waits for your approval.
Log
Every action is traced, dated, readable.
Kill switch
One gesture, and all sending stops.
Sending cap
A maximum number of sends per day, and a copy to you every time.