You don’t need to hand over your broker login to track your portfolio. There are three ways trackers get your data: sharing your credentials (riskiest), read-only API connections (safer, but patchy coverage for UK investment accounts), and statement upload (most private — you export the file, and nothing else connects to your account). Each trades convenience against exposure; here’s the honest comparison.
Every portfolio tracker faces the same problem: your data sits inside your broker. How a tracker solves that problem tells you almost everything about its privacy model — and it’s worth understanding before you type a password into anything.
Key Takeaways
- Credential sharing is the one to avoid: a third party holding your actual broker password often breaches the broker’s own terms — and it can’t be partially revoked.
- API connections are genuinely safer — read-only and revocable — but UK investment platforms are patchily covered, and your data still flows through the aggregator’s servers.
- Statement upload keeps you in control: you choose what to export and when; there is no standing connection to your account at all.
- The question that cuts through marketing: “can this service move my money, and where is my file parsed?” Read-only + local parsing is the strictest answer.
Why do trackers ask for your broker login?
Because automatic syncing needs a way in — and your credentials are the bluntest key. Early aggregators worked by “screen-scraping”: you gave them your username and password, and their servers logged in as you to copy your positions. It works, but the trade-offs are severe: a third party holds credentials that can do anything your account can do, many brokers’ terms of use prohibit sharing them, and when the broker changes its login flow, the sync silently breaks.
The three ways, compared honestly
| Method | What you hand over | What can go wrong | Revocable? |
|---|---|---|---|
| Credential sharing (screen-scraping) | Your actual username & password | Full-access exposure; usually breaches broker terms; breaks when login flows change | Only by changing your password |
| API connection (Open Banking-style) | A read-only, tokenised connection | Patchy coverage of UK investment platforms; data flows through aggregator servers; standing connection | Yes — revoke the token |
| Statement upload | One exported file, chosen by you | Manual refresh — you re-export on your own schedule | Nothing to revoke — no connection exists |
Fair credit where due: regulated API connections are a real improvement over password sharing — read-only by design and revocable. Their honest limits are coverage (built around payment accounts; many UK investment platforms and wrappers sit outside it) and architecture: your holdings still transit and rest on someone else’s servers, continuously.
Statement upload: the method that needs no trust
Every UK broker can already export your history as a file — so the most private tracker is the one that simply reads that file. You log into your broker yourself, export the statement (our one-page cheat-sheet covers the exact clicks for 8 UK platforms), and upload it. No credentials shared, no standing connection, nothing to revoke — and if the parsing happens locally in your browser, your holdings never touch a server at all.
The honest trade-off is cadence: an uploaded statement is a snapshot, not a live feed. In practice, a monthly or quarterly export ritual covers what a long-term investor actually needs — and it doubles as your record-keeping habit, which UK capital gains rules quietly demand anyway.
Five questions to ask any tracker before you sign up
- Can it move money or place trades? The only acceptable answer is no — read-only by design, not by settings.
- Where is my data parsed? Locally in your browser, or on their servers? Ask where the file rests, not just how it travels.
- Is there a standing connection to my account? If yes — who can see it, and how do you revoke it?
- What happens when I delete my account? Data deletion should be stated plainly, not buried.
- What’s the business model? If the product is free and the company sells “insights”, your portfolio may be the product.
Whatever tool you choose: never share broker credentials with a service whose terms you haven’t read, and check your broker’s own terms first — many prohibit credential sharing outright. Avex AI provides software and educational content, not financial advice. Capital at risk.
Want to see the statement-first approach on your own broker? Start with the guides for Trading 212 and eToro — both walk through exactly what leaves your account (one file) and what never does (your login).
It’s the riskiest option available. A third party holding your credentials can do anything your account can do, many brokers’ terms prohibit sharing them, and the only way to revoke access is changing your password. Read-only alternatives exist — use them.
They’re a genuine improvement: regulated, read-only and revocable. Their limits are coverage — many UK investment platforms and wrappers aren’t included — and the fact that your data still flows through, and rests on, the aggregator’s servers.
Statement upload with local parsing: you export the file yourself, nothing else ever connects to your account, and if parsing runs in your browser, your holdings never reach a server. The trade-off is manual refresh — monthly or quarterly works for most long-term investors.
It’s a ten-minute ritual, and it produces something the automatic methods don’t: a permanent evidence trail of your transactions, which UK capital gains record-keeping quietly requires anyway.
No — that’s what read-only means: no trading permissions, no withdrawal rights, no custody of assets. Confirm the wording in the tool’s own security or privacy page before trusting the label.
