Accounting firms handle some of the most sensitive client information – tax returns, financial statements, payroll data, and business records. Secure file sharing isn't just convenient; it's essential for client trust, regulatory compliance, and practice success.
The Stakes for Accounting Firms
Accounting data breaches are particularly damaging because:
- Identity theft risk – Tax documents contain everything needed for identity fraud
- Financial exposure – Bank account numbers, income information, business data
- Regulatory consequences – Violations of privacy regulations and professional standards
- Reputation damage – Clients trust accountants with their most private information
- Professional liability – Potential malpractice claims and licensing issues
What Accounting Firms Share
Tax Season
- Tax organizers and questionnaires
- W-2s, 1099s, and other tax forms
- Completed tax returns for review and signature
- Supporting documentation
Year-Round Services
- Financial statements
- Bookkeeping reports
- Audit workpapers
- Advisory reports and analyses
- Payroll documents
Client Requests
- Prior year returns
- Bank and loan documentation
- Entity documents
- Historical records
Security Requirements
IRS Publication 4557 Compliance
The IRS recommends specific security practices for tax preparers, including:
- Encryption of all taxpayer data
- Strong authentication
- Secure file storage and transmission
- Access controls and audit trails
Professional Standards
AICPA and state CPA societies require protection of client confidential information.
State Privacy Laws
Many states have specific requirements for protecting financial and personal information.
Best Practices for Secure Sharing
1. Always Use Password Protection
Password-protect all client file shares. Send passwords via separate channel (phone call is best for sensitive documents).
2. Set Expiration Dates
Tax documents don't need to be accessible forever. Set appropriate expiration dates:
- Tax return reviews: 7-14 days
- Document requests: 30 days
- Ongoing engagement files: 90 days with review
3. Use Download Tracking
Track when clients access files to:
- Confirm document receipt
- Follow up on un-downloaded returns
- Document delivery for records
4. Encryption Is Non-Negotiable
Use services with strong encryption in transit and at rest. GetShared provides AES-256 encryption.
5. Limit Access Appropriately
Share only what's needed with only who needs it. Don't share entire client folders when only one document is requested.
Client Portal Options
Dedicated Accounting Portals
Some practice management software includes client portals. Pros: integrated with workflow. Cons: often limited features, may be expensive.
General File Sharing Services
Services like GetShared offer more flexibility:
- No per-client fees
- Better sharing features
- Custom branding for professional presentation
- Easy for clients (no account required)
Hybrid Approach
Use your practice management portal for ongoing engagements, general file sharing for one-off requests and large files.
Tax Season Workflow
Sending Tax Organizers
- Generate organizer from tax software
- Upload to GetShared folder for client
- Send password-protected link with expiration
- Track that client received it
Receiving Client Documents
- Create upload folder or request link
- Client uploads their documents
- Files go directly to secure storage
- Receive notification of upload
Delivering Completed Returns
- Export returns from tax software
- Create organized folder (federal, state, local)
- Upload with cover letter explaining contents
- Send password-protected link
- Track download to confirm receipt
- Follow up if not downloaded before deadline
Security Controls to Implement
| Control | Implementation |
|---|---|
| Encryption | Choose services with AES-256 |
| Password protection | All external shares |
| Link expiration | 7-90 days based on content |
| Two-factor auth | On all staff accounts |
| Access logging | Enable and review regularly |
| Staff training | Annual security training |
Common Mistakes to Avoid
Don't: Email Tax Returns as Attachments
Email is insecure. Tax returns contain everything needed for identity theft. Always use secure file sharing.
Don't: Use Personal Cloud Storage
Personal Dropbox/Google Drive accounts lack business security controls and create compliance issues.
Don't: Share Without Tracking
You need to know files were received. "I sent it" isn't enough when clients claim they never got their return.
Don't: Keep Links Active Forever
That 2019 tax return link doesn't need to work in 2026. Use expiration dates.
For Multi-Partner Firms
With GetShared team features:
- Shared access to client folders across staff
- Role-based permissions (partners, managers, staff)
- Centralized management of external sharing
- Audit trail of who shared what
Conclusion
Secure file sharing is fundamental to modern accounting practice. The key requirements:
- Encryption for all client data
- Password protection on external shares
- Expiration dates to limit exposure
- Tracking to confirm delivery
- Professional presentation to maintain client confidence
GetShared provides all these features while being simple enough for clients who aren't tech-savvy. Try it free for your next client delivery.
