Secure Document Sharing for Accounting Firms

TL;DR: Accounting firms move some of the most sensitive documents a client owns, including tax returns, bank statements and identity records, so attachments and open links are not good enough. Use authenticated access, named recipients, expiry and a viewing log, document the controls in a written security plan, and decide in advance how long each type of file stays available.

A single inbox can hold a client's Social Security number, a payroll register and a signed engagement letter. Firms of every size face the same practical question: how do we get these files to the right person quickly without creating a trail of unprotected copies? This guide is written from the firm's side of the table. It covers what to send, which sharing methods suit which jobs, the regulatory backdrop in the United States, and the routines that keep the system tidy once busy season arrives. It is general information, not legal advice, so confirm obligations with your own counsel or compliance adviser.

What accounting firms actually share

Mapping your document flows is the first step, because each flow calls for different controls.

A firm that treats all six identically will either over-restrict routine invoices or under-protect payroll data. Sort first, then choose tools.

Why the regulatory backdrop matters

In the United States, the FTC's Safeguards Rule applies to financial institutions under the agency's jurisdiction, and its list of examples includes tax preparation firms. Whether a particular practice is covered depends on the activities it performs, so check the rule text or ask your adviser.

Where it applies, the FTC's guidance describes a written information security program with nine elements:

1. A designated Qualified Individual to run the program
2. A written risk assessment, repeated periodically
3. Safeguards for identified risks, such as access controls, data inventories, encryption, multi-factor authentication, secure disposal and activity logging
4. Regular monitoring and testing, including vulnerability scans and penetration testing
5. Staff training
6. Oversight of service providers
7. Keeping the program current
8. A written incident response plan
9. A written report from the Qualified Individual to leadership at least once a year

The rule also requires notice to the FTC when a security breach involves the unauthorised acquisition of at least 500 consumers' unencrypted information, as soon as possible and no later than 30 days after discovery. Firms that keep information on fewer than 5,000 consumers are exempt from certain provisions, according to the FTC page. Notice how many items on the list concern the way files are shared: access controls, encryption, logging, service provider oversight and disposal.

Portals, links and email compared

Most firms use some mix of three methods. None is universally right.

Client portals. The firm hosts an account for each client, and files sit inside it. Strengths include a persistent client folder, authentication and a familiar workflow for recurring work. Weaknesses include account fatigue, since clients forget passwords, and cost when licenses scale with clients.

Secure links. The firm uploads a file, sets rules and sends a link. Strengths are speed, no account for the recipient and per-file control such as expiry, download blocking and watermarks. Weaknesses are less structure for long-running relationships unless you organise links carefully.

Email attachments. Convenient, but the file is copied to every mailbox it touches and can sit in archives long after it was needed. Even when attachments are encrypted, you lose visibility once the message leaves. Our comparison of password-protected PDFs and secure links explains why a password alone rarely solves the problem.

A sensible policy uses a portal for recurring client exchanges, links for one-off or third-party sharing such as lenders, and email only for non-sensitive messages.

Access controls that fit a firm

The ISO 27001 information access restriction control, as summarised by UpGuard, sets a useful benchmark even for firms that never seek certification: technical enforcement of access rules, role-based permissions, least privilege, authentication for anything above public, logging and regular access reviews. For an accounting practice, those principles translate into everyday settings.

• Named recipients. Restrict links to the specific email address of the client, spouse or authorised third party. See our guide on how to restrict document access to specific emails.
• Role-based internal access. Only the engagement team should see a client's workpapers. Seasonal staff and temporary contractors should get the minimum.
• Expiry. Set short expiry on returns and statements, then extend deliberately. Our guide to creating expiring links covers it.
• Download controls. Block download on draft statements so drafts do not outlive the final.
• Authentication. Require multi-factor authentication for staff accounts on any system holding client files.
• Quarterly reviews. Check who still has access to what, and remove departed staff and former clients.

Sending financial statements to third parties

Clients often ask the firm to send statements to a bank, investor or acquirer. This is where control slips, because the recipient is not your client and may forward the file.

For these flows:

1. Confirm in writing that the client authorises the disclosure and which parties may receive it.
2. Use a link restricted to those recipients, with an expiry.
3. Add a viewer watermark if the statements contain sensitive detail, so each reader's email appears on the pages.
4. Keep a record of who opened the file and when.

If a lender asks for a data pack, the process begins to resemble a data room. For larger deal work, see our guide on using a virtual data room for business sale preparation.

Receiving client documents without creating a mess

Intake is where many firms lose control. Clients email photos of documents, send zip files and text identity scans. Fix it with a standard request.

• Provide a secure upload link in your engagement letter and checklists
• Give clients a clear list of what you need, so they do not send extras
• Tell them plainly not to email identity documents or full account numbers
• Acknowledge receipt, so they know it arrived
• File received documents into the engagement folder at once

Our guide to sending tax documents to an accountant securely is written for the client side, and you can adapt it into a handout.

Choosing and testing a sharing tool

When you evaluate software, work from your own flows, not a feature list.

Check these points in a trial:

• Can a client open the file from a link without creating an account?
• Can you restrict, expire and revoke access per link?
• Does the tool show who viewed what and when, and can you export it?
• Can you block downloads and apply watermarks where needed?
• Can an administrator reassign or close a departing staff member's links?
• Does the vendor share security documentation, and how does it handle service provider requirements in your risk assessment?

SendNow is one tool that covers the secure-link approach. SendNow is our own product, so test it alongside alternatives. SendNow: secure document sharing with view tracking, NDA gating and dynamic watermarks, from $9/month. Document plans are Lite $9, Pro $17 and Business $43 per month. Our broader roundup of secure file sharing software lists other options.

Retention and deletion

Collecting less and keeping it for less time is the strongest security control available. Decide a retention period for each document type that meets your legal and professional requirements, then enforce it.

• Expire sharing links automatically at the end of each engagement phase
• Delete duplicate copies from desktops and downloads folders
• Dispose of superseded drafts
• Remove client folders from active systems according to policy

Secure disposal is a named safeguard in the FTC's list, so a documented routine helps both security and compliance.

Handling busy season

Security habits are tested hardest in the weeks before a filing deadline, when staff are tired, clients are late and shortcuts look tempting. Plan for it in advance. Brief seasonal staff on the sharing rules on their first day, pre-create the client spaces before volume peaks, and keep a standing instruction that identity documents never travel by email, however urgent the request. Review the access list once at the start of the season and once at the end, so temporary accounts do not quietly become permanent.

An incident plan you can actually use

Write a half-page plan and keep it where staff can find it.

1. Contain. Revoke the link or reset the account.
2. Assess. Check the view log to see whether anyone opened the file.
3. Notify. Tell the affected client promptly and follow any regulatory notification rules that apply, including the FTC timing noted above where relevant.
4. Learn. Record the cause and change the workflow so it cannot recur.

Run a short drill once a year. People remember a drill better than a policy.

Frequently Asked Questions

Is email safe enough for sending tax returns?+

Standard email is not a controlled channel. The file is copied to several mailboxes and may stay in archives. Use an authenticated portal or a restricted, expiring link, and reserve email for messages that tell the client the file is ready.

Does the FTC Safeguards Rule apply to my accounting firm?+

The rule applies to financial institutions under FTC jurisdiction, and its examples include tax preparation firms. Coverage depends on the activities you perform, so review the rule and ask your adviser. If it applies, you need a written information security program with the elements described by the FTC.

What is better for client files, a portal or secure links?+

Portals suit recurring client relationships with structured folders. Secure links suit one-off sharing, third parties and clients who do not want another account. Many firms use both.

How long should a shared tax document stay accessible?+

Keep access only as long as the client needs it, often days or weeks, then expire the link and rely on your own records for retention. Align the schedule with legal and professional retention rules.

Can I put a watermark on financial statements?+

Yes. A dynamic watermark that shows the viewer's email on every page discourages forwarding and shows whose copy circulated if one leaks. It complements, and does not replace, access restrictions.

What should I do if a client file goes to the wrong person?+

Revoke access at once, check whether the file was opened, inform the client and follow your breach response plan and any notification duties. Our guide to sending confidential documents to the wrong recipient outlines the steps.