Email encryption for accountants comes in two layers. TLS encrypts the connection between mail servers, but only when both sides support it, and leaves the message readable in each mailbox. Message-level encryption protects the content itself until the recipient opens it. Use message encryption whenever an email has to carry client tax data, and prefer a link for files.
TLS versus message-level email encryption for accountants
TLS (Transport Layer Security) encrypts the connection a message travels over, server to server. Message-level encryption encrypts the message itself, so it stays unreadable until the intended recipient opens it. For accountants, TLS is a baseline that happens automatically when both mail systems support it; message encryption is the step a person chooses for a specific email.
What TLS protects
TLS protects a message while it moves between mail servers. The Gmail help page on email encryption says "All Gmail messages use TLS automatically," and that the protection holds only when the recipient also uses a mail service that supports it: "If the recipient also uses this secure mail carrier, your message is protected." When a received message lacks it, Gmail shows a red open lock icon, which "means the message is unencrypted."
What TLS does not protect
TLS does nothing once a message arrives. The message sits readable in the sender's sent folder and the recipient's inbox, and in any device or backup those mailboxes sync to. If an attacker gets into either account, TLS has already finished its job. The sender also cannot guarantee it: whether a given message gets TLS depends on the recipient's provider.
What message-level encryption adds
Message-level encryption keeps the content scrambled at rest in the mailboxes as well as in transit. Microsoft's support article on encrypting email messages describes S/MIME encryption as content "converted from readable plain text into scrambled cipher text" that only a recipient with the matching private key can read.
The rule behind this matters for firms covered by the FTC Safeguards Rule, which at 16 CFR 314.4(c)(3) on eCFR (current as of October 2026) asks for encryption of customer information in transit over external networks and at rest. IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024) tells tax professionals to "Encrypt all sensitive files/emails, especially those with the taxpayer's personally identifiable information." The difference between protecting data on the move and data in storage gets its own post: encryption at rest vs in transit.
How do accountants send an encrypted email in Microsoft 365 or Google Workspace?
Accountants on Microsoft 365 or Google Workspace can encrypt a message from the compose window, if the firm's subscription and administrator settings allow it. Microsoft 365 offers Microsoft Purview Message Encryption and S/MIME. Google Workspace offers hosted S/MIME and, on some editions, client-side encryption. The steps below come from each suite's own help pages.
These options are features of the email suites themselves. Check with whoever administers the firm's mail which ones are turned on before promising a client an encrypted message.
Steps in new Outlook (Microsoft 365)
According to Microsoft's encrypt email messages article, using Microsoft Purview Message Encryption:
- In a new message, choose Options, then select Encrypt.
- Pick the protection with the restrictions you want, such as Encrypt or Do Not Forward.
- Finish the message and select Send.
The same article says the account needs "a qualifying Microsoft 365 subscription." The S/MIME route instead uses Options, then More Options, then Encrypt this message (S/MIME), and for outside recipients requires their certificate to be installed first, which rarely suits individual tax clients.
Microsoft's page on usage rights for Rights Management (updated August 2025) explains the difference between the two choices. With Do Not Forward, recipients "can't forward it, print it, or copy from it." With Encrypt, recipients "can copy from the email, print it, and forward it"; they only cannot remove the encryption.
Steps in Gmail (Google Workspace)
Google's article on Gmail client-side encryption gives these steps:
- Click Compose.
- Click Message security on the right side of the message.
- Under "Additional encryption," select Turn on.
- Add recipients, subject and body, then send. Sign in to the firm's identity provider if prompted.
Client-side encryption needs an Enterprise Plus, Education Plus, Education Standard or Frontline Plus edition, and the administrator must set it up. Turning it on mid-draft discards the draft, so decide first. Google's hosted S/MIME article describes the other route: with a certificate on the account, once a contact has sent a digitally signed message, Gmail "automatically encrypts the message" sent back to them.
Gmail's confidential mode is a different thing. The confidential mode help page covers expiry dates and passcodes and says recipients can still take screenshots or photos. It does not describe itself as encryption, so do not present it to clients as encrypted email.
A screenshot plan for the firm's internal guide
A one-page staff guide works best with five screenshots taken in the firm's own account:
- The compose window with the encryption control highlighted.
- The menu of protection choices, such as Encrypt and Do Not Forward, or Additional encryption.
- A sent message showing the encrypted indicator in the sent folder.
- What an outside recipient receives: the wrapper message with its "read the message" button.
- The sign-in or passcode screen the recipient sees next.
Blur the account names before sharing the guide.
What does a client see when opening an encrypted message?
A client who gets an encrypted message from a firm usually does not see the content in their inbox. They see a notice with a button that leads to a web page, where they sign in or request a one-time passcode before the message opens. Each extra step invites a call to the office.
Microsoft's help article on how to open a protected message describes the recipient's path. A Gmail user selects Read your message, then Sign in with Google, then Allow, and the message opens in a new browser tab. Users of other providers choose to sign in with a one-time passcode, which is emailed to them and "expires after 15 minutes." The Microsoft Purview Message Encryption overview adds that recipients with Gmail and Yahoo accounts get "a wrapper mail that directs them to the encrypted message portal."
For Gmail client-side encryption, Google's article says a recipient "may be required to create a Google Guest Account" to read the message, and that the sender's administrator can force all external recipients to create one.
Those steps lead to predictable support calls:
- "The code never came." The passcode email went to spam or a different inbox.
- "It says the code expired." The client opened the message, then came back later.
- "I can't find the attachment." The file is inside the web page, not in the inbox.
- "Is this a scam?" A message that asks the client to click a button and sign in looks like the phishing emails clients have been warned about.
Warn clients before the first encrypted message. A short note sent separately, from a known address, saying "you will receive an encrypted message from us today; click Read the message and request a code" heads off most of these calls. It also gives the client a way to confirm the message is genuine.
Encrypted email versus a link for sending client returns
Encrypted email suits a short message or a single document sent to a client who has opened one before. A share link or a client portal suits finished returns, large files and anything the client will need again later, because the file stays in one place under the firm's control instead of travelling into another mailbox.
A finished return is the case that tips the balance. It runs to many pages, the client may need to download it again months later for a mortgage application, and the firm may want to stop access after a set date. An encrypted email puts a copy in the client's mailbox, behind a sign-in that may expire. A link or portal keeps one copy in a place the firm manages, and the firm decides when that access ends.
Use this rule of thumb:
| Situation | Better route |
|---|---|
| A two-line answer that mentions a client's balance due | Encrypted email |
| One form the client should not pass on to anyone | Encrypted email with Do Not Forward |
| The finished 1040 and its schedules | Link or portal |
| A set of documents for a client's attorney | Link or portal with named recipients |
| Anything over the mail system's attachment limit | Link or portal |
Whichever route the firm uses, limit who inside the firm can send client files out at all. The post on access controls for accounting firm staff covers mapping roles to client folders.
For files coming in rather than going out, the firm's intake route matters more than email encryption. Schema CPA gives each client one upload link, so clients have a place to send W-2s and statements that is not the firm's inbox, and every page is classified by type, issuer and period once it arrives. The documents section of the homepage lists what it reads. The client document collection category covers intake from start to finish.
Email encryption gaps: subject lines, replies and forwarding
Email encryption gaps are the parts of a message that encryption leaves exposed or that a recipient can undo. The common ones in accounting firms are subject lines that name the client and form, replies sent without encryption, and forwarding that the chosen option still allows. Each one can leak data that the encrypted body was meant to protect.
Subject lines
Google's client-side encryption article states that "The header of the email, including subject, timestamps, and recipients, will not have additional encryption." Treat every subject line as readable by anyone who sees the mailbox. "Your return" is fine. "Moreno 2026 1040, SSN XXX-XX-4821" is not.
Replies
Some options protect replies and some leave it to the client. The Microsoft Purview Message Encryption overview says the service "also encrypts replies from recipients of encrypted email." A client who starts a fresh message instead of replying, or who answers from their phone's default mail app, may send their next attachment in the clear. Ask clients to reply inside the encrypted message, and never to start a new email with documents attached.
Forwarding
The option the sender picks decides what the recipient can do. Under Microsoft's Encrypt option, recipients can forward and print; only Do Not Forward blocks that. Gmail's confidential mode disables forwarding but, by Google's own description, cannot stop a screenshot. No setting stops a client from photographing their screen.
Copies the firm keeps
Encryption protects the copy in the recipient's mailbox, not the original saved on a preparer's desktop or in the firm's sent folder. Those copies fall under the firm's own storage and destruction practices, which encryption at rest vs in transit covers in more detail. When the email itself is the problem, the broader case against emailing tax documents explains why many firms move documents off email altogether.