SmartVault Alternative: Encryption, Features and Limits

SmartVault is a document-management and client-portal platform built specifically for US accounting and tax firms, owned by GetBusy plc (LSE: GETB) since 2017. It is one of the most widely deployed tools in this category, and it is a mature, workflow-deep product. It is not, by any wording in its own published documentation, encryption the provider cannot read: SmartVault encrypts data with AES-256, but SmartVault itself holds the keys, and its own security materials describe data as accessible to "screened employees with your permission" — a policy control, not a cryptographic one.

This is a buyer comparison, not a self-pitch. ShieldFive appears here as one entry, positioned honestly against a fifteen-plus-year-old incumbent with real scale in this exact market. Where SmartVault is stronger — and on tax-workflow integration, certifications, and track record, it clearly is — the page says so.

What SmartVault actually is

SmartVault Corporation was founded in 2008 in Houston, Texas, and has operated since 2017 as part of GetBusy plc, a UK-listed document-workflow group (SmartVault is GetBusy's largest business by revenue). Its core product is a branded client portal with native two-way integration into the tax software US accounting firms already run: Lacerte, ProSeries, ProConnect, UltraTax CS, Drake, and CCH Axcess, with SmartRouting able to auto-file scanned or printed documents into the right client folder for CCH Axcess and Drake users specifically. SmartRequest, and more recently an AI-assisted version SmartVault calls SmartRequestAI, generates and tracks client document-request lists — SmartVault's own materials describe it drafting a request list from a client's prior-year return and auto-categorizing what comes back. E-signature runs through a DocuSign integration with Knowledge-Based Authentication (KBA) for IRS Forms 8878 and 8879, bundled at no extra per-envelope cost on the Accounting Unlimited plan. The portal itself is white-label: firms set their own logo, color scheme, and a custom subdomain in place of the default my.smartvault.com. SmartVault names SOC 2 Type 2, ISO 27001, and ISO 22301 as certifications it holds.

On encryption, SmartVault's published security pages describe AES-256 at rest and TLS in transit, marketed as "bank-level" or "bank-grade" security — unquantified marketing language, not a technical specification. The more concrete statement is that confidential data "can only be accessed by screened employees with your permission," which is an access-control policy, not an architectural limit: it describes who SmartVault has decided may look, not a system where SmartVault is structurally unable to. Nothing in SmartVault's public documentation claims client-side encryption, zero-knowledge, or that SmartVault itself cannot decrypt customer files. On residency, SmartVault publishes a GDPR Data Transfer Addendum applying Standard Contractual Clauses to data moved outside the EEA and UK — the existence of that addendum is itself the strongest public signal that EU customer data is routinely transferred to, and stored in, the US, since a transfer mechanism is only needed for data that leaves the EU in the first place. No specific EU hosting region is named anywhere in SmartVault's published materials.

SmartVault vs ShieldFive, compared

Cells reflect SmartVault's public documentation and independent third-party trackers as summarized above, accessed 2026-09-14, and change often — confirm current terms, certifications, and pricing directly on smartvault.com before a buying decision. ShieldFive's own document-request pricing is on the document-collection page for accounting firms.

Where SmartVault leads, honestly

SmartVault leads on depth in the one job accounting firms actually hire this category for. Native two-way integration with Lacerte, ProSeries, ProConnect, UltraTax CS, Drake, and CCH Axcess means a completed return can land in the client's folder without a human copying a file; SmartRouting extends that to scanned paper for CCH Axcess and Drake users. SmartRequestAI is a genuine, recent product investment — an AI-assisted request list drafted from the prior year's return, rather than a firm starting from a blank checklist every season. KBA-compliant e-signature for Forms 8878 and 8879 is built in through DocuSign, not a separate tool to procure. And SmartVault holds three named certifications — SOC 2 Type 2, ISO 27001, ISO 22301 — that a firm's own client due-diligence process can ask to see evidence of; ShieldFive has none of those today. With roughly two decades of combined company history (SmartVault founded 2008, under GetBusy since 2017) and a customer base SmartVault's own materials put at well over 6,000 CPA and tax-preparation firms, it is a low-procurement-risk, high-workflow-fit choice for a firm that runs its whole client-document process through one vendor.

Where it does not lead: the encryption is provider-managed, not zero-knowledge, by SmartVault's own published wording. No EU hosting option is named, and the existence of an SCC-based transfer addendum is the strongest available signal that EU client data lands in the US by default. No post-quantum cryptography is described anywhere in SmartVault's materials. And the review picture is more mixed than a single G2 or Capterra score suggests — see below.

Where ShieldFive leads, honestly

ShieldFive encrypts files on the device before upload and stores encrypted file data in the EU. Your password never reaches our servers: the browser turns it into a separate login value with Argon2id and sends only that, and the key that opens the vault is derived separately and stays on the device. That service remains part of the trust boundary, so this is not an absolute provider-cannot-decrypt guarantee. Web uploads default to ML-KEM-1024/XChaCha20-Poly1305 with AES-GCM fallback. Android also defaults to the hybrid format, with the same AES-GCM fallback, and reads both formats. The crypto core is open under Apache-2.0; the apps are not fully open source, and no external security audit is complete. The request's title, the client label, and the item checklist are themselves encrypted, not only the files. Data sits in the EU by default (database in Frankfurt, files in Amsterdam), not as a US-hosted default with an SCC addendum layered on top, and an Article 28 DPA is published and included on every seat. There is no per-tier user minimum: seats are sold individually from 1 up to 500, so a solo practitioner pays for one seat rather than clearing a 2- or 3-user floor. The encryption core, @shieldfive/crypto, is published on npm under Apache-2.0 with a public specification and test vectors, so the encryption claim is something you can read and check rather than take on trust.

Where it does not lead, and it would be dishonest to pretend otherwise: there is no tax-software integration of any kind — no Lacerte, ProSeries, ProConnect, UltraTax, Drake, or CCH Axcess connector. There is no e-signature and no KBA. Client reminders are minimal: a firm is notified when a client uploads, and on Firm seats (and during the trial), if you add the client's email, ShieldFive reminds them at most twice, around day 3 and day 7. There is no configurable sequence, and the free plan sends no client reminders. The request checklist is a free-text field filled in per request, not a template library or an AI-assisted draft from a prior return. And ShieldFive has not completed a third-party audit or certification — its evidence today is an open crypto core and a published internal security review, not a SOC 2, ISO 27001, or any named certificate.

What the reviews actually say

The rating-site picture for SmartVault is worth reading past the headline number. On G2 and Capterra — platforms where a vendor typically prompts satisfied customers to leave a review — SmartVault sits around 4.2–4.3 out of 5. On Trustpilot, a platform people reach on their own initiative, more often to complain than to praise, SmartVault's review volume is far smaller (dozens rather than hundreds) and the sentiment skews noticeably more critical: recurring complaints about the interface, the lack of a native Mac desktop app, and customer-service responsiveness. That gap between a vendor-prompted platform and an unprompted one is common across software generally, not unique to SmartVault, but it is a more honest read than either number alone.

Two switching-relevant patterns recur across independent review aggregators (Capterra, TrustRadius, G2) rather than in any single source: a 2-user minimum on some tiers and a 3-user minimum on Business Pro, which shuts out a solo practitioner from the per-seat pricing entirely, and complaints about year-over-year price increases — one Intuit Accountants Community thread from February 2022 describes a roughly threefold jump tied to a forced minimum-seat change, a historical data point rather than a current one, but consistent with the general shape of more recent, undated aggregator complaints about pricing. What the review record does not show, searched directly: no forum thread, G2 con, or Capterra complaint frames leaving SmartVault as an encryption or EU-residency decision. That is ShieldFive's actual differentiator on this page, and it would be dishonest to claim the market is already asking for it — the demand for client-side encrypted, EU-resident storage in this category is a case this page has to make, not one it can point to reviewers already making.

Which one fits your firm

Pick SmartVault if your firm is US-based, runs returns through Lacerte, ProSeries, ProConnect, UltraTax CS, Drake, or CCH Axcess, and wants that integration plus KBA e-signature and an AI-assisted request workflow in one platform with a named SOC 2 / ISO 27001 / ISO 22301 certification your clients' own vendor review can ask about. Budget for the 2- or 3-user minimum if you are a small or solo practice, and confirm current per-tier pricing directly, since third-party sources disagree on the exact numbers more than a mature, stable product's pricing normally would.

Consider ShieldFive if its client-side encryption, EU ciphertext storage and sharing workflow fit your needs. Review the client-code trust boundary and client-specific encryption formats above. It has no completed external security audit, and you will need existing tools for tax-software integration and e-signature.

A separate encrypted sharing tool can complement a workflow suite, but ShieldFive must not be used on the assumption that provider decryption is technically impossible. Review its client-code trust boundary, storage location and workflow limits before adopting it.

For the wider field, the accounting file sharing comparison of SmartVault, ShareFile, TaxDome, Canopy, Suralink and Liscio covers three more named workflow suites on the same axes. For a head-to-head against another provider-managed incumbent, see ShieldFive vs ShareFile or ShieldFive vs Content Snare. If collecting documents from clients is the actual job rather than general file storage, see how ShieldFive is set up to collect documents from clients for accounting firms.

Frequently asked questions

Is SmartVault zero-knowledge or end-to-end encrypted?

No. SmartVault's published security documentation describes AES-256 encryption at rest and TLS in transit, with confidential data accessible to "screened employees with your permission." That is provider-managed encryption under an access-control policy — SmartVault's own infrastructure can reach the keys — not zero-knowledge, where the provider is architecturally unable to decrypt regardless of policy. SmartVault does not claim client-side or zero-knowledge encryption anywhere in its public documentation.

Does SmartVault have post-quantum encryption?

Not that is described anywhere in SmartVault's public documentation as of September 2026. Its published encryption is AES-256; no post-quantum or quantum-resistant key exchange is mentioned in its security materials.

Does SmartVault offer EU data residency?

No specific EU hosting region is published. SmartVault publishes a GDPR Data Transfer Addendum applying Standard Contractual Clauses to data transferred outside the EEA and UK — the clearest available signal that EU customer data is stored in the US by default, since that mechanism exists specifically to cover data leaving the EU. Confirm directly with SmartVault if EU residency is a hard requirement for your clients.

What does SmartVault cost compared with ShieldFive?

SmartVault publishes three tiers. On annual billing: Business Pro $55 per user per month (3-user minimum), Accounting Pro $65 (2-user minimum), Accounting Unlimited $85 (2-user minimum). Billed monthly the same tiers are $75, $85 and $110. The two accounting-specific tiers are therefore $65–$85 annual, or $85–$110 monthly; e-signature, KBA and PDF form filling are add-ons below Accounting Unlimited rather than included. Figures read from SmartVault's own pricing page on 2026-09-14. ShieldFive's document-request feature gives a new firm 14 days with everything unlocked, then is free with 1 open request at a time (links last up to 7 days), 10 GB of storage and no card; paid seats are €29 per seat per month (or €290 per seat per year) for unlimited open requests, automatic client reminders, your logo and longer links, with no user minimum, up to 500 seats. The two aren't a like-for-like comparison — SmartVault's price includes tax-software integration and e-signature that ShieldFive doesn't have — so weigh cost against the whole feature set, not the seat price alone, and confirm SmartVault's current tiers directly before budgeting.

Is ShieldFive a full replacement for SmartVault's workflow features?

No. ShieldFive has no tax-software integrations, no e-signature, no KBA, no configurable client reminders (Firm seats get at most two fixed reminders), and no request-template library. It is encryption-first storage and document collection, not a practice-management platform. A firm that needs SmartVault's workflow depth specifically should not expect ShieldFive to be a drop-in replacement; the realistic setup for many firms is running both, with ShieldFive covering the highest-sensitivity files or clients with a strict data-residency requirement.

Does SmartVault have a 2-user minimum?

Multiple independent pricing trackers describe a 2-user minimum on some SmartVault tiers and a 3-user minimum specifically on Business Pro, which effectively excludes a solo practitioner from those plans. Confirm current tier structure directly with SmartVault, since this is exactly the kind of detail that changes with a pricing update.

What do SmartVault's reviews actually say?

SmartVault rates around 4.2–4.3 out of 5 on G2 and Capterra, platforms where vendors typically prompt satisfied customers to review. Its smaller pool of Trustpilot reviews, reached by people on their own initiative, skews more critical — recurring complaints about the interface, the absence of a native Mac desktop app, and customer-service responsiveness. Neither number alone tells the full story; reading both is more informative than either.

Is SmartVault's SOC 2 certification the same kind of assurance as ShieldFive's security review?

No, and it's worth being precise about the difference. SmartVault names SOC 2 Type 2, ISO 27001, and ISO 22301 as certifications it holds — independently assessed standards, though whether they certify SmartVault's own organization and application versus being inherited from underlying cloud infrastructure was not independently confirmed for this comparison. ShieldFive has completed no third-party audit or certification; its current evidence is an open-source crypto core you can read yourself and a published internal security review. A completed certification and an open, unaudited codebase are different kinds of assurance, not directly comparable — choose based on which one your firm's own due-diligence process requires.