Accounting secure file sharing: getting client files in and sending returns back

Inbound: send the client one upload link per engagement, with a list of what you need and a PIN sent by a different channel. The client uploads without creating an account, and each file is encrypted in their browser so the service stores only ciphertext.

Outbound: do not attach the return to a plain email. Send it as an encrypted link that expires, with any password sent separately, or through the portal your clients already use. Then write both methods into your written information security plan (WISP), with who can open the files and when they are deleted.

A firm that prepares tax returns is a financial institution under the FTC Safeguards Rule, whatever its size, and must keep a WISP. The rule asks for customer information to be encrypted “both in transit over external networks and at rest”, for access limited to the people who need it, for multi-factor authentication and for oversight of any service provider that holds the data. Our FTC Safeguards Rule guide for tax preparers quotes each paragraph with a link to the rule text.

The IRS says the same in its own terms. Publication 4557 asks firms to encrypt sensitive files and emails and suggests secure file transfer instead of email, and the sample WISP in Publication 5708 says passwords must travel by a different method than the data. The IRS Security Six and WISP guide covers that material and the Form W-12 question.

Neither source names a product or treats inbound and outbound separately. They set outcomes: encrypted in transit and at rest, access limited, passwords separate, providers vetted, files disposed of on schedule. Every transfer method you use, in either direction, has to meet those outcomes and belongs in the plan.

This is where most of the volume is, and where clients most often fall back to email. The method that works is one link per client and engagement, with the document list on it, that opens in a phone browser without an account. Every signup screen is a point where a client gives up and emails a photo instead.

1. Build the list from the return, not from memory. The Form 1040 checklist is a starting point; remove what does not apply.

2. Create the request with a PIN of at least four characters and an expiry (up to 7 days on the free plan; 30 or 90 days, or none, on Firm seats).

3. Email or text the link, and give the PIN another way: a phone call, a text if the link went by email, or in person.

4. The client opens the link, enters the PIN and uploads. Each file and its name is encrypted in the browser to your firm’s key before it leaves the device.

5. You get an email when files arrive and decrypt them in your own browser. When the engagement is done, file what you keep and revoke the link.

For the choice between upload links, shared drives and client portals on the inbound side, see secure file sharing for accountants, which compares them on client effort, who can read the files and cost.

The outbound file is often the most sensitive one in the engagement: a complete return carries the client’s Social Security number, income, bank details for a refund and often the dependants’ details too. Emailing it as an attachment leaves a readable copy in your sent folder, the client’s inbox and both mail providers’ systems, with nothing to expire or revoke.

Three methods meet the outcomes above. A password-protected PDF, with the password sent by text or phone, works with any email client but relies on the tool’s encryption and stays in both mailboxes. A client portal works if your clients already log in to it. An encrypted transfer link works without an account on the client’s side.

ShieldFive Send encrypts the files in your browser with a random key that is carried in the link after the “#”, a part of the URL browsers do not send to the server. The client opens the link and downloads without an account. A transfer takes up to 20 files and 750 MB and expires after 1, 3 or 7 days. Anyone holding the full link can download, so send it only to the client. For files already in your ShieldFive vault, a share link carries an expiry and a password; send the password by a different channel than the link, as Publication 5708 asks.

For each method: the tool, who approved it, how it encrypts in transit and at rest and who holds the keys, which staff can open the files and that their accounts use multi-factor authentication, how passwords or PINs reach the client, and when files and links are deleted. Name the vendor as a service provider and note when you last reviewed it.

Write down what staff do when a client emails a document anyway, and what they do when a client asks for their return by email: send it by the approved method instead, and say why.

It does not make your practice compliant with the Safeguards Rule or anything else. It is one tool in your plan; the WISP, your own devices, training and incident response are still yours.

It moves files. It does not prepare returns, collect e-signatures on Form 8879, invoice or integrate with tax software. If your practice software includes a portal your clients already use in both directions, that is a reasonable default.

On the inbound side, chasing is light. On Firm seats (and during the trial), if you add the client’s email, ShieldFive reminds them at most twice, after about three and seven days, while required items are missing. The reminder cannot contain the upload link, because the decryption key never reaches our server, so it points the client back to the link you sent. You also get a reminder to follow up. There are no recurring requests. You need a free ShieldFive account to create requests; only the client skips signup.

Like any web app, we serve the JavaScript that does the encryption. The guarantee is “encrypted in the browser, ciphertext at rest”, not a claim that no compromised server could ever interfere. The request security page sets out the threat model.

Price: a new firm gets 14 days with everything unlocked, then 1 open request at a time free, with links that last up to 7 days and no client reminders. The Firm plan is €29 per seat per month or €290 per year for unlimited open requests, client reminders, your logo and links up to 90 days or with no expiry.

This page summarises public rule text and IRS guidance, through the guides linked above, as of the date at the top. It is not legal or tax advice and does not tell you whether your practice meets its obligations.