The short answer
Accountant file sharing is mostly one job: getting tax documents in from clients without chasing them by email. The tools that do it well share three things: a request link the client can upload through without creating an account, automatic reminders until everything has arrived, and a view that shows which client sent which document and what is still missing. All seven tools compared here do the first. They differ on price, on how much of the rest of your practice they want to run, and on who holds the keys to the files.
- You want document collection and nothing else: ShieldFive at EUR 29 per seat a month, or Liscio at $49 per user a month if you also want client messaging and organizers.
- You want one system for the whole practice (CRM, billing, e-signature, workflows): TaxDome or Canopy.
- You want tax-software filing and a long-established vendor: SmartVault or ShareFile Premium.
- You run audit engagements around a PBC request list: Suralink.
The table further down has the prices and the differences, all checked against each vendor's own pages on 6 October 2026.
How document requests work, start to finish
Every tool in this comparison runs some version of the same loop. The details below are how ShieldFive runs it; the table after it shows where the others differ.
- You create a request. Name the client and list the documents you need: last year's return, W-2s and 1099s, three months of bank statements, a copy of an ID. Each item becomes a line on a checklist. You can protect the link with a PIN.
- The client uploads through the link. There is no account to create, no password and no app. The client opens the link on a phone or a laptop and drops the files in. Each file is encrypted in the client's browser before it uploads, so we store ciphertext and never hold the keys; your firm does.
- Reminders go out by themselves. If the request is still incomplete, the client gets a reminder on day 3 and another on day 7. Reminders stop as soon as the request is complete, expired or revoked.
- You see who sent what. Every request belongs to one client, and its checklist shows which items have arrived and which are still outstanding. You get an email when a client uploads. If a document reaches you some other way, mark the item received or not needed so the checklist stays accurate.
- You send the finished return back. Share the completed return or statements as a link with an expiry, and revoke it once the client has the file.
Two limits apply, and the security notes further down state them in full. We deliver the app code that does the encrypting, so the protection holds for the code your browser is served. Checklist labels are encrypted too, but metadata is not: file sizes, timestamps, the client's email address (used for reminders) and your firm's name.
What CPA firms should actually require
The marketing pages for secure file sharing tools list dozens of features. For an accounting firm the list that matters is short, and it splits into two groups that rarely come in one product.
The confidentiality controls, these decide who can read client data if something goes wrong:
- Encryption model and key custody. Is content encrypted in transit and at rest (table stakes), and crucially, who holds the keys? If the provider holds them, the provider can decrypt, by choice, by breach, or by legal compulsion. Client-side encryption, where files are encrypted on the device and the provider stores only ciphertext, is the model where the provider does not hold the keys.
- Per-document key isolation and audit trail. A separate key per file so one compromised passphrase does not cascade, plus a log of every access, expiry, and revocation.
- Data residency and jurisdiction. Where the bytes physically sit, and which legal regime governs them. For EU clients or EU-based firms, US-hosting under Standard Contractual Clauses is a different answer than EU residency.
The workflow controls, these decide how much of your practice runs inside the tool:
- Tax-software integration. Native two-way connectors to Lacerte, ProSeries, ProConnect, UltraTax CS, Drake, or CCH Axcess that auto-file returns into client folders.
- PBC / document-request workflow. Templated, trackable provided-by-client request lists, ideally with rollforward from the prior year.
- E-signature with KBA. IRS Form 8879 signing with Knowledge-Based Authentication built in.
- Branded client portal, invoicing, CRM. The rest of practice management.
Almost no product is best at both groups. The encryption-first tools are thin on tax workflow; the tax-workflow suites are provider-decryptable. Deciding which group is non-negotiable for your firm is the whole comparison.
What the rules behind those controls actually say
That control list is not a matter of taste. It is what several overlapping obligations converge on, and which one applies to a given client changes what you are allowed to accept from a vendor.
- The FTC Safeguards Rule (GLBA). Since June 2023 the Rule has treated tax and accounting firms as financial institutions. It requires a written information security program plus encryption of customer information in transit over external networks and at rest, where feasible (16 CFR §314.4(c)(3)). For client file exchange, encryption is plainly feasible, so it is expected rather than optional.
- GDPR. Any client file carrying personal data of an EU individual pulls storage location, transfer mechanism, and processor terms into scope. This is where the residency row of the table below stops being a nice-to-have: US hosting under Standard Contractual Clauses is a defensible answer, but it is a different answer from EU residency under EU jurisdiction, and the vendor's DPA has to say which one you actually bought.
- Professional confidentiality. AICPA, ICAEW, and equivalent bodies impose a duty of confidentiality that sits on top of statutory requirements and does not lapse because a vendor's terms grant it access. A provider that can read client files is, in practice, a party you have given access to.
- State data-security law. Several US states impose encryption obligations on the data type itself, notably Massachusetts 201 CMR 17.00 and the New York SHIELD Act, and most state CPA boards now treat unencrypted email transmission of tax documents as substandard practice. That is the practical answer to whether you can send a return or a W-2 as an attachment: you can, and the regulatory exposure becomes yours the moment it leaves your outbox.
- SOC 2 alignment. Not a law, but increasingly a gate. Enterprise clients ask for it during vendor review, which is why the certification row below matters commercially even though it says nothing about who holds the keys.
None of these frameworks names a product. They specify outcomes: that sensitive data is controlled, that access is logged, and that you can demonstrate both. That last word is what turns the audit trail from a convenience into a compliance artifact. A workable minimum is sender, recipient, timestamp, access events (view and download), expiry status, and revocation events, tamper-evident and retained for at least the engagement retention period your firm policy sets, commonly seven years for tax workpapers under IRS retention guidance.
For the requirement-by-requirement map of the Safeguards Rule and IRS Pub 4557, see the FTC Safeguards Rule guide. None of this is legal advice; confirm how each obligation applies to your firm with your own counsel.
The two options most firms are really comparing against
Before the shortlist, the honest baseline. Most firms are not choosing between SmartVault and Suralink. They are choosing between what they do today and anything better, and what they do today is an email attachment or a consumer cloud drive. Both fail the list above in specific, predictable ways.
Email attachments are still the dominant transfer method in accounting because they are fast and familiar, and they are completely uncontrolled after delivery. Once sent, an attachment can be forwarded to anyone and saved anywhere, and there is no revocation mechanism. Breaches in professional services are rarely dramatic infrastructure failures; they are quiet, a link forwarded once too often, a shared folder with no expiry, a departed staff member's laptop still holding a year of engagement files.
Consumer cloud storage fixes the delivery problem and introduces a different one: the provider has full access to file content. That access can be used for scanning, threat analysis, or model training, and it can be compelled by legal process. Business tiers add admin controls and better logging, which narrows the operational risk, but they do not change key custody. The encryption architecture is the line that does not move.
| Control | Email attachment | Consumer cloud drive | A zero-knowledge platform |
|---|---|---|---|
| Client-side / zero-knowledge encryption | None; TLS in transit at best | Provider holds the keys and can read content | Files encrypted on the device before upload |
| Per-document key isolation | None | Shared account-level access | A separate key per file |
| Link expiry + revocation | None; uncontrollable once sent | Basic link controls, varies by plan | Expiry, download caps, revoke at any time |
| Channel separation / audit trail | None | Partial; logging varies by plan | Link and passphrase separable; access logging varies by vendor (ShieldFive records it server-side, with no log you can view or export yet) |
| Data residency | Wherever the mail providers sit | Often US by default | Determined by the provider, not by your plan tier |
Cells reflect each option's typical default. Business-tier Drive and Dropbox plans narrow some of the operational gaps but do not change provider key custody.
Every product in the comparison below clears the email bar. The rest of this page is about which of them clears the rest.
Accountant file sharing tools, compared
All seven let clients upload through a link without an account. What separates them is what a seat costs, whether reminders run on their own, who holds the keys to the stored files, and how much else the product does.
| Tool | Cheapest plan with client requests | Client uploads without an account | Automatic reminders | Who holds the keys to stored files | What else it does | Trial |
|---|---|---|---|---|---|---|
| ShieldFive | EUR 29 / seat / month, or EUR 290 / seat / year | Yes, request link with optional PIN | Yes, day 3 and day 7, stop when complete | Encrypted in the browser before upload; we store ciphertext and never hold the keys | Document requests and sending files back. No tax-software integration, e-signature or billing | 14 days, everything unlocked, no card |
| ShareFile | Premium: $26 / user / month billed annually ($28.59 monthly), 3-user minimum. Advanced ($16.50) has no request lists | Yes, File Drop links on every plan | Automated notifications on Premium | Vendor | E-signature, client portal, workflows, data room tier | Free trial offered |
| SmartVault | $65 / user / month billed annually ($85 monthly); Accounting Pro needs 2 users | Yes, Request Docs link with no login | Yes | Vendor | Tax-software integrations, e-signature, proposals | On request |
| TaxDome | About $1,000 / user / year, billed annually (third-party figure; vendor page not reachable) | Yes, file-request link; uploads land in a guest client account | Yes, configurable interval and count | Vendor | Full practice management: CRM, pipelines, billing, e-signature, portal | Not publicly listed |
| Canopy | Standard: $74 / user / month billed annually; monthly costs about 20% more | Yes, secure upload link | Yes | Vendor | Full practice management: CRM, workflows, invoicing, tax resolution | Trial offered |
| Suralink | Quote only | Yes, no account or software install | Request notifications | Vendor | Audit PBC request lists, testing, workpapers | Demo only |
| Liscio | $49 / user / month billed annually | Yes, no app or password | Yes | Vendor | Client messaging, organizers, e-signature | Demo only |
Prices are list prices in each vendor's own currency, as published on 6 October 2026, and change often: confirm on the vendor's plans page before you buy. "Vendor" means the provider encrypts stored files with keys it manages, so it can technically decrypt them. That is a policy assurance, not a cryptographic one, and none of the six documents an end-to-end option.
Where each tool leads
A comparison that only flatters one product is not useful. Here is where each tool is the stronger choice, and where it is not.
ShieldFive
ShieldFive leads on price and focus for a firm whose problem is collecting documents. A seat costs EUR 29 a month, clients never pay or sign up, storage is not metered per client, and reminders and your logo on client pages are included. Files are encrypted on the client's device before upload, so we store ciphertext and never hold the keys. Database and files are stored in the EU, and a DPA is available.
Where it does not lead: there are no tax-software integrations (Lacerte, UltraTax, Drake, ProConnect, CCH Axcess), no built-in e-signature or KBA for Form 8879, no invoicing and no CRM. It has no SOC 2 or ISO certification and no completed third-party security audit yet; the evidence today is an open-source crypto core and a published internal review. It does not sign a US HIPAA Business Associate Agreement.
SmartVault
SmartVault leads on accounting-industry fit and procurement safety. It offers native two-way integrations with Lacerte, ProSeries, ProConnect, UltraTax CS, Drake and CCH Axcess that file returns into client folders, Request Docs links clients can upload through without a login, integrated 8879 e-signature with KBA, and a branded portal. It holds SOC 2 Type 2, ISO 27001 and ISO 22301.
Where it does not lead: at $65 a user a month on annual billing it costs more than twice a ShieldFive seat. SmartVault encrypts at rest with AES-256 but holds the keys, so it can technically decrypt stored documents. It is US-hosted on AWS with no published EU data-residency option.
ShareFile
ShareFile leads on workflow depth and regional flexibility: templated request lists, KBA e-signature for Form 8879, file-transfer integrations with CCH, Drake, Lacerte, ProSeries and UltraTax, a branded portal, and EU storage zones (Dublin, Frankfurt) alongside US ones. Its compliance posture (SOC 2 Type 2, ISO 27001, ISO 27701, HIPAA option) is mature.
Where it does not lead: request lists start on Premium at $26 a user a month with a three-user minimum, so the entry price for document requests is about $78 a month. By default ShareFile holds the keys and decrypts server-side. Its customer-managed-keys option moves master-key control to you but is still server-side encryption, and it is not available on HIPAA accounts. As a US-parent company (Progress Software), US jurisdiction applies whichever storage zone you choose.
TaxDome
TaxDome leads on breadth. It is a full practice-management suite: CRM, pipelines and automation, document requests and organizers with configurable reminders, IRS-compliant e-signature, invoicing and payments, and a white-label portal and mobile app, with integrations to Drake, Lacerte, ProConnect and UltraTax. For a firm that wants one system to run the whole practice, that surface area is the point.
Where it does not lead: base seats are billed annually only, reported at about $1,000 a user a year for Pro. In its own documentation the encryption keys are controlled by TaxDome, so it can technically read stored documents despite "end-to-end" language in its marketing. If HIPAA matters to you, see is TaxDome HIPAA compliant.
Canopy
Canopy is the closest like-for-like alternative to TaxDome: a practice-management suite with a client portal, document requests through a secure upload link, automated reminders, CRM, workflows, invoicing and a tax-resolution module. It leads for firms that do IRS resolution work alongside compliance.
Where it does not lead: at $74 a user a month on annual billing, Standard is the most expensive published seat in this table. Its pricing page documents MFA but no end-to-end encryption, so treat it as vendor-held keys.
Suralink
Suralink leads on the PBC request list for audit and assurance engagements. A dynamic request list tied to a secure portal is the core of the product, with templates, rollforward, an audit trail by user and IP, e-signature, and an Excel-native workpaper suite. Clients upload without an account or software install.
Where it does not lead: pricing is quote-only and there is no public trial. Encryption is server-side AES-256 with no published customer-held-key option. It connects to tax software through workpapers and APIs, not named tax-prep connectors.
Liscio
Liscio leads on client communication. Its Smart Client Requests send a secure link the client completes without an app or a password, with automatic follow-ups, alongside secure messaging, organizers and e-signature. At $49 a user a month on annual billing it sits between ShieldFive and the full suites.
Where it does not lead: it is lighter than TaxDome or Canopy on practice management, there is no public trial (demo only), and its pricing page documents no end-to-end encryption.
Sharing files alongside your tax software
ShieldFive does not integrate with any tax-preparation software. There is no plugin, no auto-filing, and no two-way sync; it sits beside whatever you already use. The workflow is the same for every product: export the return or source document from your tax software, encrypt it in the browser with ShieldFive, and send the client a link with an expiry and revocation. That wraps a provider-cannot-read layer around the file without changing how you prepare the return.
UltraTax CS
ShieldFive does not connect to UltraTax CS. Export the return or PDF from UltraTax, encrypt it in ShieldFive, and share an expiring link. The confidentiality layer is added at the sharing step, not inside UltraTax.
Lacerte
ShieldFive has no Lacerte integration. Print or export the Lacerte return to PDF, encrypt it client-side in ShieldFive, and send an expiring, revocable link instead of an email attachment.
ProSeries
ShieldFive does not integrate with ProSeries. Export the ProSeries document, encrypt it in the browser, and share it with an expiry so the file stays provider-unreadable in transit and at rest.
ProConnect Tax
ShieldFive has no ProConnect connector. Download the return or client document from ProConnect, encrypt it in ShieldFive, and share a link you can revoke once the client has retrieved it.
CCH Axcess
ShieldFive does not integrate with CCH Axcess. Export the document from CCH Axcess, encrypt it client-side, and send an expiring ShieldFive link for the highest-sensitivity files.
TaxDome
TaxDome is a full practice-management portal and is provider-decryptable; its keys are controlled by TaxDome, per its own documentation, so ShieldFive does not replace it. Firms considering ShieldFive alongside TaxDome should assess its client-code trust boundary and workflow limits before moving client files.
If what you actually want is a client portal
"Client portal" has become a category placeholder in accounting software marketing. In practice it usually means a vendor-hosted folder where clients can drop files behind a login screen. What it rarely means is per-document access control, encryption the vendor cannot bypass, or credentials that travel separately from content. The distance between those two definitions is where most portal disappointment comes from.
It helps to separate the two jobs, because most firms end up running both. Secure file sharing is the transfer primitive: an encrypted upload, a link with an expiry and a revoke, and an access log for a single document handoff. A portal is a persistent workspace, folder structure, document-request flows, and message threads that hold engagement state over time. A portal without client-side encryption still leaves the provider able to read what is stored, so the key-custody question from the table applies to both layers, not just to the transfer.
Where basic portals break down
Firms that adopt a basic portal tend to hit the same three frictions within about six months.
Clients don't use it consistently. When a client can forward a file by email in ten seconds but has to log into a portal to do the same thing in thirty, email wins. The portal quietly becomes an internal folder while clients revert to attachments.
Permissions age badly. A portal configured around one engagement accumulates stale access as the relationship changes. Access granted during year-one onboarding often no longer matches the current engagement scope, and nobody is scheduled to notice.
Audit trails are thinner than they look. Many portals record that a file was uploaded. Fewer record every external access with timestamp, IP, and download confirmation. The difference only becomes visible when a client disputes document receipt during a regulatory inquiry, which is the one moment you cannot fix it retroactively.
What to require in a client portal
- Encryption before upload. The portal should encrypt on the device, so the vendor cannot read client file contents at all. For a firm under a confidentiality duty, provider-side key access is a governance question, not a preference.
- Per-document controls, not folder defaults. Expiry, download limit, and revocation set on the individual file that was shared, rather than inherited from whatever the folder allows.
- Passphrase on a separate channel. The access link and its passphrase should travel independently. Sending both in one email removes a layer you thought you had.
- Complete, exportable access logs. Timestamp, actor identity, file accessed, action type (view, download, upload, share, revoke), originating IP, and the engagement the file belongs to, tamper-evident and exportable in a form that survives an inquiry.
Four questions settle fitness faster than any feature grid:
- Does the platform have access to file plaintext at any point?
- Can you revoke a single link after delivery, instantly, without disturbing other access?
- Can you export a timestamped log of every external access in the last 90 days?
- Are those controls available per link, or only per folder?
Most traditional portals fail at least two of the four. Of the tools above, the vendor-key tools answer the last three well and fail the first by design, because they hold the keys. ShieldFive has the client-code trust limitation described below; its audit coverage is also incomplete: share access is recorded server-side, but it is not yet self-serve exportable by the account owner.
The underlying question is not whether a controlled portal is worth the switching cost. It is whether the firm could demonstrate, in an examination or a client dispute, that it kept appropriate control over client files. A mail thread with an attachment history is not that demonstration.
Where ShieldFive fits, and where it does not
What it is. ShieldFive is document collection for firms: request links clients upload through without an account, a checklist per client, up to two automatic email reminders to the client (day 3 and day 7, when you add their email), and expiring links to send finished work back. Files are encrypted on the device before upload, and we store ciphertext in the EU and never hold the keys. Sign-in sends a key derived from your password in the browser, not the password itself. We deliver the app code, so the code your browser is served remains part of the trust boundary. Web uploads default to ML-KEM-1024/XChaCha20-Poly1305 with an AES-GCM fallback. The crypto core is open source; the apps are not fully open source.
Where it does not fit. It is not a practice-management suite. There are no tax-software integrations, no built-in e-signature or KBA for Form 8879, no invoicing and no CRM. If those are what you are shopping for, TaxDome, Canopy, SmartVault, ShareFile, Suralink or Liscio are the right tools. It has no completed third-party security audit and no SOC 2 or ISO certification yet; the evidence today is open code and a published internal security review. It does not sign a US HIPAA Business Associate Agreement, so work touching ePHI needs a HIPAA-specific arrangement.
For a head-to-head against a single incumbent, see ShieldFive vs ShareFile, ShieldFive vs SmartVault and ShieldFive vs Content Snare. For the compliance framing, see the FTC Safeguards Rule guide and the GDPR file-sharing checklist. The firm page walks through the request flow and per-seat pricing.
Which one fits your firm
Pick ShieldFive if your problem is clients sending documents by email, you want them to upload without an account and be reminded automatically, and you do not want to pay for a practice-management suite to get that. It is the cheapest seat here, and the only one where the vendor stores ciphertext and does not hold the keys.
Pick TaxDome or Canopy if you want one system for the whole practice: CRM, billing, workflows and e-signature. Canopy if you also do IRS resolution work.
Pick SmartVault or ShareFile if your returns run through Lacerte, UltraTax, Drake, ProConnect or CCH Axcess and you want files filed straight into client folders, or if your clients' vendor reviews require a named SOC 2 or ISO certificate.
Pick Suralink if your engagements are audits built around a PBC request list. Pick Liscio if client messaging matters as much as document collection.
Whatever you shortlist, check two answers against the vendor's own documentation before you sign: who holds the keys to stored files, and where the data legally sits.
Rolling out whichever one you pick
The tool matters less than the discipline around it, and the rollout that works is narrow before it is wide.
Start with the single highest-sensitivity engagement type in your portfolio: M&A due diligence, an audit with contested workpapers, or the client whose engagement letter carries explicit data-handling clauses. Configure the new workflow there, validate it with three to five clients, then standardize across all client-facing document delivery. The transition cost is behavioral rather than technical; clients adapt once the new route is reliable and the old one stops being offered.
A short standing checklist keeps it from decaying back into attachments:
- Name the file categories that always require encrypted sharing: tax returns, financial statements, audit workpapers, payroll records.
- Set a firm-wide default expiry on every external link, so no share is an open-ended access grant.
- Write down the passphrase policy: never reused, never sent in the same message as the link.
- Give one person ownership of reviewing active shares on a monthly cadence.
- If your tool offers a country allowlist on share links, treat it as one access-control layer, bypassable over a VPN, not a residency guarantee, and pair it with expiry and a share password.
Four numbers tell you whether the policy is real rather than written: the share of external client shares carrying an active expiry and download cap; time to revocation when an engagement closes or a relationship ends; the number of links found forwarded outside the intended recipient scope; and whether you could produce a log of every external access within 24 hours if a client asked today.
Competitor facts in the comparison table were re-checked against each vendor's own pricing and help pages on 6 October 2026. Prices and plans change often; confirm current terms, regions and report scope directly with the vendor before a buying decision.