Why accounting firms face unusual file risk
Accounting work is dense with some of the most sensitive data clients will ever produce: tax returns, financial statements, payroll records, audit workpapers, and pre-transaction due diligence packages. The exposure window is wide. External links pass through client email. Engagement files are shared with third-party auditors. Year-end documents move between firm and client during the precise moment they are most sensitive.
Most breaches in professional services are not dramatic infrastructure failures. They are quiet: a link forwarded once too many times, a shared folder with no expiry, a partner's device accessing files outside your control.
The regulatory context
Accounting firms operate under multiple overlapping obligations depending on jurisdiction and client type.
- GLBA (Gramm-Leach-Bliley Act) applies to firms providing financial services to US individuals, requiring safeguards for client financial data.
- GDPR applies when handling personal data of EU individuals, with direct implications for how client files are stored and shared.
- Professional ethics rules — from AICPA, ICAEW, and equivalent bodies — impose confidentiality duties on top of statutory requirements.
- SOC 2 alignment is increasingly expected by enterprise clients during vendor review.
None of these frameworks specify which file sharing tool to use. They specify outcomes: that sensitive data is controlled, that access is logged, and that you can demonstrate it.
What most firms actually use — and why it falls short
Email attachments remain the dominant transfer method in accounting. They are fast, familiar, and completely uncontrolled after delivery. Once sent, an attachment can be forwarded to anyone, saved anywhere, and there is no revocation mechanism.
Consumer cloud storage improves on email but introduces a different problem: the provider has full access to file content. That access may be used for scanning, threat analysis, or model training. For firms with confidentiality obligations, provider-side access is not a theoretical risk. It is a governance problem.
What a compliant standard looks like
Strong file sharing for accounting firms requires four controls working together.
Client-side encryption. Files should be encrypted before upload, on the device. This eliminates provider-side plaintext access and means a platform breach does not produce readable content.
Per-document key isolation. Each file should carry its own protection. A compromised passphrase on one document does not cascade to a client's entire engagement history.
Link controls. Every shared document should carry explicit expiry, download limits, and the ability to revoke access at any moment. A link without an expiry is an indefinite access grant.
Channel separation for credentials. The link and the passphrase should travel through independent channels. Delivering both in the same email eliminates one layer of protection.
Deployment checklist for accounting firms
- Define which file categories always require encrypted sharing: tax returns, financial statements, audit workpapers, payroll records.
- Set a firm-wide default expiry for all external links.
- Establish a passphrase policy: never reused, never sent in the same message as the link.
- Assign clear ownership for active share review on a monthly cadence.
- Use geolocking for client files that must not cross regulatory jurisdictions.
Business outcomes to track
- Percentage of external client shares with active expiry and download cap.
- Time to link revocation when a client relationship ends or an engagement closes.
- Number of forwarded or re-shared links outside the intended recipient scope.
- Audit readiness: can you produce a log of every external access within 24 hours?
Rollout approach
Start with the highest-sensitivity engagement type in your portfolio — M&A due diligence, or a client with explicit data handling requirements. Validate the workflow with that team, then standardize across all client-facing document delivery.
Frequently asked questions
Is Dropbox or Google Drive enough for CPA file sharing?
Consumer-tier Dropbox and Google Drive give you transport encryption and access controls, but the provider retains the keys and can be compelled to disclose content. For client work covered by professional confidentiality obligations or GLBA, that vendor-access path is the gap. Business plans with admin controls narrow the operational risk but do not change the underlying architecture.
What is the difference between secure file sharing and a client portal for accountants?
Secure file sharing is the transfer mechanism: encrypted upload, link controls, expiry, audit log. A client portal is a persistent shared workspace, usually with folder structure, request flows, and message threads. Most firms need both — the portal for ongoing engagement state, the file sharing primitives underneath for individual document delivery. The client portal for accountants guide covers the workspace layer in detail.
Do GLBA safeguards require encryption for accounting firms?
The FTC Safeguards Rule, which implements GLBA for non-bank financial institutions including many accounting firms, requires encryption of customer information in transit over external networks and at rest, where feasible (16 CFR §314.4(c)(3)). For client file exchange, encryption is generally feasible and therefore expected.
Can I send tax returns and W-2s by email?
You can, but the regulatory exposure shifts to you the moment it leaves your outbox. Most state CPA boards now treat unencrypted email transmission of tax documents as a substandard practice, and several state breach laws (notably Massachusetts 201 CMR 17.00 and New York SHIELD Act) impose encryption obligations on the data type.
How is this different from HIPAA-compliant file sharing?
The technical controls overlap substantially — encryption, expiry, audit logging, BAA-style vendor agreements — but the regulatory drivers differ. For accounting work touching healthcare clients with access to ePHI, both standards apply simultaneously. The HIPAA-compliant file sharing guide covers the additional controls required when patient data is involved.
What audit trail should an accounting firm maintain for shared files?
A practical minimum: sender, recipient, timestamp, access events (view, download), expiry status, and revocation events. For SOC 2 and enterprise client review, the log should be tamper-evident and retained for at least the engagement retention period set by firm policy — commonly seven years for tax workpapers under IRS retention guidance.