Secure Client Document Exchange for Accountants

Why email attachments are the wrong tool

• Attachments sit unencrypted in inboxes indefinitely, on every device that has ever synced that mailbox
• There is no audit trail of who opened, forwarded, or downloaded the document
• A compromised mailbox exposes every attachment ever sent or received, not just recent activity
• Clients frequently email documents to the wrong recipient by autocomplete error
• There is no way to revoke access to an attachment once it has been sent

Portal and SharePoint options

Encryption and access control that actually matters

Whichever platform a firm chooses, the meaningful protections are the same: encryption in transit (so data cannot be intercepted while moving) and at rest (so a stolen device or breached storage account does not expose readable files), expiring links rather than permanent ones, and multi-factor authentication on every account with access to client data. A portal with none of these controls configured is not meaningfully safer than an email attachment.

Retention: documents should not live forever by default

Client documents accumulating indefinitely in a shared folder or portal increase exposure with no corresponding benefit. A retention schedule, whether it follows CPA Ontario record-keeping guidance or the firm's own policy, should define how long client documents remain accessible and when they are archived or securely deleted. Retention policies in SharePoint and Microsoft 365 can automate much of this once the schedule is defined.

Rolling this out without disrupting client relationships

1. Pick one platform and retire the alternatives, rather than running three half-adopted portals at once
2. Give clients simple, written instructions for the new upload process before the first tax season using it
3. Set default link expiry and access permissions centrally so individual staff cannot accidentally share broadly
4. Review access permissions on client folders on a defined schedule, not only when someone leaves
5. Pair the rollout with staff training so old email-attachment habits do not creep back in during busy periods

Where this connects to broader firm security

Secure document exchange is one piece of a wider security posture that also includes MFA, endpoint protection, and phishing defence, covered in cybersecurity for bookkeeping and accounting firms. It also matters most during the highest-volume period of the year, which is why we build it into tax-season readiness reviews.

Sources and further reading

• Microsoft Learn: SharePoint sharing and permissions overview

Frequently asked questions