A secure client portal for CPA firms encrypts files in transit and at rest, requires a second login factor, ends idle sessions, logs who viewed or downloaded each file, and lets shared links expire. The firm should verify each control with a written answer, a current vendor report and a log it can export, not with a sales page.
What makes a secure client portal for CPA firms?
A secure client portal for a CPA firm is one whose controls match what federal rules already expect of the firm: encrypted storage and transfer, multi-factor sign-in, limited access, activity logs and timed expiry for anything shared. The portal holds client tax data, so the firm answers for those controls even when a vendor runs them.
The reason starts with how the FTC classifies accounting firms. The definitions in 16 CFR 314.2 (eCFR, up to date as of October 14, 2026) say that "an accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution." That puts a tax practice under the Safeguards Rule, whose elements are listed in 16 CFR 314.4.
Five controls in that section map directly onto portal features:
- Encryption. Section 314.4(c)(3) says to "protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest."
- Multi-factor authentication. Section 314.4(c)(5) says to "implement multi-factor authentication for any individual accessing any information system," unless the firm's Qualified Individual approves an equivalent control in writing.
- Access limits. Section 314.4(c)(1) calls for access controls that permit access "only to authorized users."
- Activity logs. Section 314.4(c)(8) calls for controls "designed to monitor and log the activity of authorized users."
- Service provider oversight. Section 314.4(f) requires the firm to select providers "capable of maintaining appropriate safeguards" and to require those safeguards by contract.
Two portal controls are not named in the rule; they are common ways a portal puts the access element into practice. A session timeout signs out an idle browser, which protects a login left open on a shared office computer. Link expiry closes a download link after a set number of days, so an old email cannot reopen a file months later. Ask whether both are on by default and whether the firm can set the limits.
How to choose between an authenticator app, a hardware key and a text code is a separate decision. The guide to choosing an MFA factor for tax professionals compares them.
Is an encrypted client portal encrypted end to end?
An encrypted client portal is not necessarily encrypted end to end. When a vendor says "encrypted", ask which of two things it means: files travel over an encrypted connection, or files sit encrypted on the vendor's storage. Neither is end to end, which means only the sender and recipient hold the keys. Ask whether the vendor's systems can decrypt files.
That difference matters less for compliance than for knowing who can read a file. The Safeguards Rule language quoted above asks for encryption in transit over external networks and at rest. It does not say end to end. A portal that encrypts both ways can meet the encryption element while the vendor's own staff still have a technical path to the files.
The definitions behind "at rest" and "in transit" have their own post: encryption at rest vs in transit explains each one and where each stops protecting a file.
The question that exposes the difference is simple: "Can anyone at your company open a file stored in our account, and under what circumstances?" A clear answer names who can, why (support requests, legal orders, malware scanning), whether the access is logged, and whether the firm is told. A vague answer repeats "bank-level encryption" without saying who holds the keys.
Ask two follow-ups. First, does encryption cover backups and file previews, or only the original upload? Second, are email notifications free of client data, or do they include file names, which often contain a client's name and the form type? A notification that says "Harlow_2026_W2.pdf is ready" has already disclosed something.
Vendor reports for a secure portal: SOC 2 and penetration tests
Vendor reports for a secure portal are documents prepared by an outside party that test the vendor's controls. The two a CPA firm will see most are a SOC 2 report from an independent CPA firm and a summary of a penetration test. Each is only useful once the firm reads its date and its scope.
A SOC 2 report is the output of an examination done under the AICPA's attestation standards. The AICPA's guide, SOC 2 Reporting on an Examination of Controls at a Service Organization (updated as of October 15, 2022), describes it as an "assertion-based examination of a service organization's description of its system and its controls" relevant to "security, availability, processing integrity, confidentiality, or privacy."
Three things to read in any SOC 2 report:
- The date or period. Ask whether the report tests controls as of one date or over a span of months, and when that span ended. A report that ended 18 months ago describes a system that has since changed.
- The categories in scope. Security alone, or security plus confidentiality and privacy. For tax files, confidentiality is the category a firm cares about most.
- The system described. Confirm the portal product the firm will use is inside the described system, and not only the vendor's billing or marketing tools.
A penetration test is a paid attempt to break into a system. Section 314.4(d)(2) of the rule asks for continuous monitoring or, absent it, annual penetration testing and vulnerability assessments "at least every six months." That paragraph applies to the firm's own systems, and the rule exempts firms with customer information on fewer than five thousand consumers from it. The vendor question is still fair under the service provider element: ask when the portal was last tested, by whom, and whether high findings were fixed.
Ten security questions for a portal vendor
The table below is an example question list. Weak answers are paraphrased types, not quotes from any vendor.
| # | Question | A good answer sounds like | A weak answer sounds like |
|---|---|---|---|
| 1 | Are files encrypted in transit and at rest, including backups? | "Yes, both, and backups use the same encryption." | "We use bank-level security." |
| 2 | Who at your company can open our files? | "Two support roles, only on a ticket, and every access is logged." | "No one would ever look." |
| 3 | Is MFA required for staff and for clients? | "Required for staff; the firm can require it for clients." | "It is available in settings." |
| 4 | Can we set session timeouts? | "Yes, from 5 to 60 minutes, per firm." | "Sessions stay open for convenience." |
| 5 | Do shared links expire? | "Default 14 days, adjustable, and we can revoke one early." | "Links work until deleted." |
| 6 | What does the audit log record? | "View, download, upload, delete and share, per user, per file." | "Logins." |
| 7 | Can we export the log? | "CSV export by date range and client." | "Contact support for a report." |
| 8 | How long are logs kept? | A specific period in writing. | "As long as needed." |
| 9 | May we see your latest SOC 2 report? | "Yes; its period ended in June 2026." | "We are working toward it." |
| 10 | When was the last penetration test? | "March 2026, by an outside firm; highs fixed within 30 days." | "Our team tests constantly." |
Portal audit logs a CPA firm should be able to pull
A portal audit log is a time-stamped record of each action taken on each file: who viewed it, downloaded it, shared it, moved it or deleted it. A CPA firm should be able to pull that record itself, filtered by client and date, without a support ticket. If something goes wrong, the log is the only account of what happened.
The Safeguards Rule's logging element, section 314.4(c)(8), describes controls that "monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information." For a portal, authorized users include both firm staff and clients, so the log should cover both.
A useful log row carries six fields. Here is an example for a fictional client, Harlow Example, with an account number ending in example digits:
| Time (example) | User | Role | Action | File | Source |
|---|---|---|---|---|---|
| 2027-02-03 09:14 | d.ortiz@exampleridgecpa.com | Staff | Viewed | Harlow_2026_1099-INT_XXXX-4821.pdf | Office IP |
| 2027-02-03 09:15 | d.ortiz@exampleridgecpa.com | Staff | Downloaded | Harlow_2026_1099-INT_XXXX-4821.pdf | Office IP |
| 2027-02-04 21:40 | harlow.example@mail.example | Client | Uploaded | Harlow_2026_W-2_Northgate.pdf | Mobile |
| 2027-02-05 11:02 | j.kim@exampleridgecpa.com | Staff | Deleted | Harlow_2026_W-2_Northgate_copy.pdf | Office IP |
The download line deserves attention. A view stays inside the portal. A download puts a copy on a device the portal no longer controls, which is why the next section starts there.
How long a vendor keeps logs is a question to ask, not a number to assume. The rule does not set a log retention period. Get the period in writing, and check that it covers at least the window in which the firm would plausibly need to answer a client's question about the past season. If the vendor keeps logs for 90 days, export them before the season's logs roll off.
Test the log before buying. Have one staff member upload, view, download and delete a test file, then pull the log and confirm all four actions appear with the right name and time.
When a secure portal still leaks client data
A secure portal still leaks client data when people work around it. The three usual paths are shared staff logins, files downloaded to desktops and laptops, and download links forwarded outside the portal. None of these is a flaw in the portal's encryption. Each is a habit the firm has to change.
Shared staff logins. One login for the front desk, used by three people, means the audit log names an account, not a person. IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024) tells practitioners not to "share password among employees" and says "each individual with access to client accounts should have a unique password." Give every staff member their own seat, even if the portal prices per seat.
Downloaded files. Once a preparer downloads a client's brokerage statement to work on it, that copy sits in a downloads folder outside the portal's controls. Decide where working copies go, and clear them when the return is filed. The organizing client files category covers folder structure for those working copies.
Forwarded links. A client who receives a download link by email can forward it to a spouse, a lender or the wrong address. Link expiry and a sign-in requirement on download limit the damage. A link that opens for anyone holding it is a file attachment with extra steps.
Two more paths are worth a line each. Former staff whose portal access was never removed still have a working login. Clients who give up on the portal and email their W-2 anyway put the file back in the inbox the portal was meant to replace. The reasons clients do that are covered in why clients avoid client portals, and a staged plan for getting them onto one is in how to roll out a tax client portal.
A portal moves files securely; it does not tell the firm what is in them. Schema CPA works on the documents after they reach the firm, sorting each page by document type, issuer and period and checking the set against last year's return. The documents section of the homepage lists what it reads.