Do accountants need a client portal?

Buy a client portal if you want practice management: billing, e-signature, workflow and a client app in one place. Portals built for accounting firms do all of that, and a request link does not.

If you only need clients to send you documents, you do not need to pay per user for a whole practice suite. And if the documents are IDs, tax forms and bank statements, ask a question most portal comparisons skip: can the vendor itself decrypt them? ShieldFive document requests encrypt each file in the client’s browser, so only your firm can open it.

TaxDome sells per seat per year: Essentials (one user only) at $700, Pro at $900 and Business at $1,100 per seat per year on a three-year commitment, billed upfront; every plan includes the client portal and mobile app, unlimited document storage and e-signatures (TaxDome pricing).

Canopy says every plan includes “the complete Canopy practice management software suite, including CRM, workflow, document management, billing, client portal, payments”, from $74 per user per month billed annually (Canopy pricing).

SmartVault’s plans all include a custom branded client portal and a way to “request, track, and collect client documents”, from $55 per user per month billed annually with a three-user minimum; its Accounting plans add integrations with Lacerte, ProConnect, ProSeries, UltraTax, Drake and CCH (SmartVault pricing).

That is real value for a firm that will run its practice in the portal. The SmartVault comparison and the roundup of file sharing tools for accountants go further.

Not always. TaxDome can generate a file-request link that lets a client or a third party upload “without logging in”; for people with no TaxDome account you create a general guest account for the uploads, and you are notified when files arrive (TaxDome: client actions without portal login; TaxDome: request files).

Canopy has an upload link that clients and third parties use from their email without logging in to the portal, with an expiry between 3 days and 2 weeks (Canopy: request files via secure link).

SmartVault’s Doc Requests do go through a login: its help centre says a client who is not signed in “will be prompted to log in” before reaching the request (SmartVault: responding to a document request).

So if a portal you already pay for has a no-login upload link, use it for clients who will not log in. The question that is left is who else can read what they upload.

Portals encrypt files, but usually with keys the vendor holds. TaxDome says its sub-processors cannot read customer data “as it is encrypted with keys controlled by TaxDome” (TaxDome Trust Center). SmartVault says document contents are accessible to a limited number of its employees, with processes that forbid access without your permission, and suggests third-party encryption before upload if you need more (SmartVault security). For any other portal, check the vendor’s own security page rather than assuming “bank-level encryption” means only you can open the files.

Vendor-held keys are normal and can be acceptable. They do mean the vendor, and anyone who compromises it or compels it, can decrypt. With ShieldFive the key that opens a request’s files is held by your firm, and our servers store ciphertext.

1. Create a request and list the documents you need, or start from a template such as the Form 1040 checklist.

2. Send the client the link, and the PIN by a separate channel.

3. The client opens the link on a phone or computer and uploads. No account, no password to forget.

4. You get an email when files arrive and open them in your browser. If nothing arrives after about three and seven days, you get a reminder to re-send the link.

Some firms keep their portal for e-signature and billing and use a ShieldFive link only for the most sensitive documents. Both can run side by side.

If you want a portal, ShieldFive is not one. There is no client login, no e-signature, no invoicing, no workflow and no tax-software integration. If you already pay for TaxDome or Canopy and your clients are happy there, their own upload links may be all you need.

Chasing is light. On Firm seats (and during the trial), if you add the client’s email, ShieldFive reminds them at most twice, after about three and seven days, while required items are missing. The reminder cannot contain the upload link, because the decryption key never reaches our server, so it points the client back to the link you sent. You also get a reminder to follow up. Your firm name and logo appear on the upload page on the paid plan and during the 14-day trial. There are no recurring requests; you create a new request each time.

You need a free ShieldFive account to create requests and hold the keys; only the client skips signup. Every link needs a PIN of at least four characters.

Like any web app, we serve the JavaScript that does the encryption. The guarantee is “encrypted in the client’s browser, ciphertext at rest”, not a claim that no compromised server could ever interfere. The request security page sets out the threat model, and the guide to collecting documents from clients securely compares the wider options.