Secure file sharing for accountants takes four steps: choose one sharing method per purpose, set every share link to expire and to open only for named recipients, give each share a staff owner who logs what went to whom, and close every open share after the season. Settings carry part of the load; ownership and cleanup carry the rest.
Secure file sharing methods accountants choose between
Accountants choose between five secure file sharing methods: a client portal, a one-way upload link, a cloud storage share link, encrypted email, and SFTP. Each fits a different job. Most firms use two or three: one for intake from clients, one for sending files back, and one for exchange with other professionals.
A short description of each:
- Client portal. A site where clients sign in to send and receive files, usually with a message history. Good for two-way, recurring exchange.
- Upload link. A one-way address tied to one client, with no account. Good for intake from clients who only send.
- Cloud share link. A link to a file or folder in the firm's cloud storage. Flexible and familiar, and the method with the most settings to get right, which is why the next section covers it.
- Encrypted email. An email whose message or attachment is encrypted, so only the intended recipient can open it. Useful for occasional one-off sends. The options are covered in email encryption for accountants.
- SFTP. Secure File Transfer Protocol, a way to move files between systems over an encrypted connection. More technical; common for bulk transfers between firms or with institutions.
The IRS names two of these directly. IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024) advises: "Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email." For cloud storage, the same publication suggests using "a strong password, multi-factor authentication options" and to "beware of thieves posing as providers."
Choosing between an upload link and a portal for client intake is its own decision, with a side-by-side table in secure upload link vs client portal.
Cloud share link settings for CPA file sharing
Cloud share link settings decide who can open a file the firm shares and for how long. For CPA file sharing, set five things on every link: an expiry date, a password or sign-in requirement, view-only access where possible, no re-sharing, and named recipients instead of "anyone with the link." Check each default against this list.
The names of these settings vary between storage services, and some services do not offer all of them. Check the service's own help pages for where each one lives. What follows is what each setting is for.
Expiry. A link that never expires stays live in every inbox it reached. Set a short period, such as 14 days for a document a client needs to download once.
Named recipients. "Anyone with the link" means the link is the only key. Restricting access to specific email addresses means a forwarded link does not open for the person it was forwarded to.
Password or sign-in. Where named recipients are not possible, a password sent by a different channel (a text or a phone call) adds a second thing a stranger would need.
View-only. If the recipient only needs to read a document, turn off download and editing. This does not stop a screenshot, but it stops a clean copy being saved.
No re-sharing. Turn off the recipient's ability to invite others or create their own link.
Settings checklist for a cloud share link
Example values are for a fictional share to a client's lender.
| Setting | Set to (example) | Done |
|---|---|---|
| Who can open | Named: loans@examplebank.example only | [ ] |
| Expiry | 14 days from today | [ ] |
| Password | Set; sent by text, not in the same email | [ ] |
| Permission | View only, download off | [ ] |
| Re-sharing | Off | [ ] |
| Contents | Only the files listed in the client's consent, nothing else in the folder | [ ] |
| Owner | Staff member's name recorded in the share log | [ ] |
| Notification | Firm alerted when the link is opened | [ ] |
Who owns each file share in the firm?
Each file share in the firm should have one named staff owner: the person who created it, who knows why it exists, and who is responsible for closing it. Without an owner, shares pile up, nobody knows which are still needed, and an old link to a client's return stays open for years.
Ownership works through a simple log. Every time a staff member shares a client file outside the firm, they add one row. Here is an example with fictional names:
| Date (example) | Owner | Client | What was shared | Shared with | Method | Expires | Closed |
|---|---|---|---|---|---|---|---|
| 2027-03-02 | D. Ortiz | Harlow family | 2026 Form 1040, signed | loans@examplebank.example | Cloud link, named | 2027-03-16 | 2027-03-10 |
| 2027-03-05 | J. Kim | Canopy Example LLC | 2026 trial balance | Outside CPA, R. Patel | SFTP | n/a | 2027-03-05 |
| 2027-03-11 | D. Ortiz | Example Bakery | Bank statements, Jan to Dec, account XXXX-4821 | Client's attorney | Cloud link, named | 2027-03-25 |
The last row is open. In a weekly review, the owner either confirms it is still needed or closes it.
Ownership also matters when someone leaves. A departing staff member's open shares should transfer to a named colleague before their account is closed, or the shares break or, worse, keep working with no one watching. Which staff can reach which client folders in the first place is covered in access controls for accounting firm staff.
Keeping the log does not need to be elaborate. A spreadsheet in a folder only partners can edit is enough for most small firms, as long as every share gets a row.
Secure document exchange with other CPAs, lenders and attorneys
Secure document exchange with other CPAs, lenders and attorneys means sending client files to a third party the client has authorized, by a method that limits who can open them. Two things come first: confirming the client's authorization covers this recipient and these documents, and choosing a channel the recipient can actually use.
The authorization question has a federal rule behind it for tax return information. 26 CFR 301.7216-3 (eCFR, up to date as of October 14, 2026) says that, unless the rules specifically authorize a disclosure, "a tax return preparer may not disclose or use a taxpayer's tax return information prior to obtaining a written consent from the taxpayer." It also says the consent "must be knowing and voluntary." What a valid consent must contain is set out in that section; read it there, and treat questions about a specific disclosure as ones for the firm's own counsel.
Once authorization is settled, match the method to the recipient:
- Another CPA firm. SFTP or a named cloud link both work. For ongoing work, ask whether they already have a portal they prefer to receive into.
- A lender. Ask whether the lender has its own upload page. If not, a named, view-only cloud link with a short expiry fits a one-time send.
- An attorney. Ask how their office receives files. Some prefer encrypted email; some have their own secure upload.
Send only what was authorized. If the client consented to sharing a 2026 return with a lender, the lender gets the return, not the whole client folder. Build a fresh folder with only those files and share that, so nothing else rides along.
Log the exchange in the share log above, with the consent date in the notes.
Is a shared drive safe for client documents?
A shared drive is safe for client documents only when access is limited by client or by role, so each user reaches the folders they need and nothing more. A single drive where every staff member can open every client's folder exposes every client to every account, including a compromised or departing one.
The IRS publication quoted above lists the principle plainly: "Limit access to taxpayer data to individuals who need to know." On a flat shared drive, everyone needs to know everything, by design.
A shared drive is acceptable when:
- Each client's folder, or each team's set of clients, has its own permission group.
- Staff sign in with their own accounts, with multi-factor authentication turned on.
- External sharing from the drive is off by default, or limited to named recipients with expiry.
- Someone reviews the permission groups at least once a year.
A shared drive is a problem when it is a mapped network folder with one password, when former staff accounts still have access, or when the drive also syncs to personal laptops that leave the office. Folder structure that makes per-client permissions easy is covered in the organizing client files category.
The drive also tends to collect copies. A client's W-2 arrives by email, gets saved to the drive, then downloaded to a preparer's desktop. Three copies, three places to protect. Keeping intake in one place reduces that. Schema CPA, for example, keeps every document a client sends, by whatever route, in a single per-client file and reads each page there; the workflow section of the homepage shows the steps.
File sharing cleanup after tax season
File sharing cleanup after tax season is a once-a-year pass, usually in spring, that closes open share links, removes outside users from firm folders, and deletes working copies that should not be kept. Shares created under deadline pressure in March are easy to forget by May. A fixed cleanup date stops them lasting for years.
The FTC's guide to the Safeguards Rule, FTC Safeguards Rule: What Your Business Needs to Know (December 2024), describes the disposal element as: "Securely dispose of customer information no later than two years after your most recent use of it to serve the customer." The rule text in 16 CFR 314.4(c)(6) (eCFR, up to date as of October 14, 2026) allows exceptions, such as information needed for business operations or required to be kept by law. Cleanup of share links is a narrower task than disposal, but the two belong in the same spring review.
End-of-season cleanup list
Run this list after the filing deadline and after extensions are filed. Example dates assume the 2026 tax year.
- Export the share log and sort by "Closed" blank. Close or renew every open share. (Example: May 1, 2027.)
- In each cloud storage account, list all links set to "anyone with the link" and turn them off.
- Remove outside users (other firms, lenders, attorneys, temporary staff) from every firm folder.
- Disable accounts of seasonal staff who have left, and transfer their shares first.
- Ask staff to clear client files from desktops, download folders and personal devices, and confirm in writing.
- Review shared drive permission groups against the current staff list.
- Delete working copies that duplicate the client's permanent file, following the firm's retention policy.
- Note any share that broke a rule (no expiry, no owner) and fix the cause before next season.
The firm's broader effort to stop documents arriving by email in the first place, which shrinks the cleanup each year, is covered in how to stop emailing tax documents.