How to send client documents securely: email, portal or shared link?

A client needs their tax return, a signed agreement, or a copy of the closing statement. The quickest way to send it is to attach it to an email. For a document with a Social Security number or bank details in it, that's also the way most likely to cause you a problem later.

Here's how to decide, and what to set up so the safe way is also the easy way.

What's wrong with an ordinary attachment

It sits in two mailboxes forever. Yours and the client's. If either is ever broken into, the document is there to be read. We cover what that looks like in your work email was hacked.

You can't take it back. Once sent, it's out of your control, including when you mistype the address.

The client's email may be weaker than yours. A personal account with a reused password and no second step is common.

None of that matters for a meeting agenda. It matters a great deal for a tax return.

A simple rule for staff

Sort what you send into two piles.

Fine by ordinary email: scheduling, general advice, anything you wouldn't mind being read by a stranger.

Never as a plain attachment:

• Tax returns and anything showing a Social Security number
• Bank and wire details
• Copies of driver licenses and passports
• Medical records
• Signed agreements with financial terms

If a document is in the second pile, it goes one of the three ways below.

Three safer ways to send

1. A client portal. The client signs in and downloads the file. Nothing sensitive travels by email, and you can see who opened what. Most tax, accounting and legal practice software includes one. If yours does, this is the best answer, and the work is getting clients to use it.

2. A shared link from your file system. Microsoft 365 and Google Workspace both let you share a file with a named person, who has to prove who they are to open it. Set the link to expire, and to block downloading if they only need to read. You can turn the link off afterward, which you can never do with an attachment.

3. Encrypted email. Business plans of Microsoft 365 and Google Workspace can encrypt a message so only the intended person can open it. It suits one-off sends to someone who won't use a portal.

Avoid the homemade version: a password-protected PDF with the password in the next email. Both messages land in the same mailbox.

Receiving documents is the other half

Clients send you their documents the same careless way. Give them somewhere better:

• An upload link or portal, mentioned in your engagement letter and your email signature
• A line in your onboarding email: "Please don't email ID or tax documents. Use this link."
• Staff who move anything sensitive out of the inbox and into the file system when it does arrive by email

And never accept payment details by email alone

Documents aren't the only risk. Any message that changes where money goes gets a phone call to a number you already hold. See the call-back rule.

Why it's worth the trouble

Setting this up costs little: the tools are usually in software you already pay for. What it saves is the bad week after a mailbox is opened by someone else.

In Florida, unauthorized access to electronic data holding personal information starts a 30-day clock to notify everyone affected. A mailbox holding five years of attached tax returns is a very long list of people to write to. The same mailbox holding links that have expired is a short one.

That's the trade: a few minutes of setup and a change of habit, against letters to every client you've ever emailed a return to.

Start this week

1. Write the two piles down and send them to your staff.
2. Find out what you already own: a portal in your practice software, or sharing and encryption in Microsoft 365 or Google Workspace.
3. Set link defaults to named people only, with an expiry.
4. Add the upload link to your signature and engagement letter.
5. Clear out old attachments from mailboxes once they're filed.

Setting up sharing and encryption properly is part of how we look after Microsoft 365 and Google Workspace. To talk through your firm's setup, book a free Security Check.