What to look for in a client portal: a buyer's checklist

What to look for in a client portal, in order: how much effort a client spends signing in, whether it tracks document requests per client, what staff seats and permissions cost, whether every file can be exported if you leave, and the total price. Score each candidate on the same weighted checklist during a two-week trial with real clients.

Client sign-in effort: what to look for in a client portal first

Client sign-in effort is the work a client does to get into the portal: creating an account, remembering a password, finding a code, and doing it on a phone. Check it first, because a portal clients will not open fails at everything else. Judge it by the first visit and by the return visit eleven months later.

Sign-in methods vary, and each has a cost:

• Password accounts. The client creates a password on the first visit. Easy to understand, but annual clients forget it, and February fills up with reset requests.
• Emailed sign-in links. The client enters an email address and clicks a link sent to it, with nothing to remember. The catch is that the link only works as well as the client's inbox.
• Codes by text or app. A second step after the password or link. It protects the account and adds a step that some clients find confusing.

The firm's side of the login is a different question. IRS Publication 4557 (Rev. 6-2024) says the FTC Safeguards Rule requires multi-factor authentication "for anyone accessing customer information on your system," and that this applies to all companies regardless of size. Staff logins to a portal fall under that description, so ask how staff MFA works before anything else on the firm side. Which other security controls to verify, and how to test a vendor's claims, are covered in the post on the security controls to verify in a portal.

Test the client side on a phone, not a desktop. Many clients will photograph a W-2 and try to upload it from the same device. Count the taps from the invitation email to a finished upload, and note anything that needs an app download, a desktop browser or a call to the firm.

Then test the return visit. Ask the vendor what happens when a client who signed in last March comes back next February with a new email address or a new phone. If the answer involves the firm resetting accounts by hand, multiply that by the number of annual clients.

Does the client portal track document requests per client?

A client portal tracks document requests when the firm can list each expected item for each client, see which are still open, and send reminders based on what is missing. A portal without this is a file drop that cannot say what has not arrived. Ask to see a request list with real document names.

The difference matters most in February and March. A file drop shows "14 files uploaded." A request list shows "Harbor Federal December statement: open; Ridgeline Brokerage 1099-B: open; W-2 from Northgate Media: received." Only the second one tells a preparer whether the return can start.

Questions to ask in this part of the evaluation:

• Can each request line name a document type, an issuer and a period, or only a free-text label?
• Can last year's list be copied forward for each client, so recurring forms are requested automatically?
• Does an upload tick a line on its own, or does someone at the firm match it?
• Can reminders list only the open items, and does the firm review them before they go out?
• Is there one view across all clients showing who still owes what?

Watch the matching question closely. If the client can tick "1099-DIV received" by uploading any file, the request list reports what the client believes they sent, not what arrived. Matching documents to lines by reading them is a separate job. Schema CPA, for example, is not a portal; it reads each page a client sends, sorts it by document type, issuer and period, compares it with last year's documents and drafts a reminder of what is still missing for the firm to review. The client tracker demo on the homepage shows that per-client view.

Staff seats, permissions and exports in accounting client portal software

Staff seats, permissions and exports decide what accounting client portal software costs over several years and how hard it is to leave. Price per staff seat, the roles available for limiting who sees which clients, and a complete export of files and messages are the three things to pin down in writing before signing.

Seats. If the portal charges per staff user, count everyone who needs access in March, including seasonal preparers and front-desk staff who only upload scans, and price the plan at that number. Ask whether seasonal seats can be added for three months and removed.

Permissions. A role setting limits what each staff member can open. Publication 4557's FTC checklist says to "limit access to customer information to employees who have a business reason to see it." Ask whether access can be limited by client, not just by feature, and whether a departing employee's access can be removed in one step. The checklist also says to prevent terminated employees from accessing customer information "by immediately deactivating their passwords and user names."

Exports. Publication 4557's summary of the Safeguards Rule also tells firms to "select service providers that can maintain appropriate safeguards" and to make sure the contract requires them to. A vendor that holds every client document is that kind of provider. Ask for a full export of every client's files, with folder names that say which client each belongs to, plus messages and signed documents. Ask how long it takes, what format it arrives in, and whether it is available after the contract ends.

Do the export once during the trial. A vendor that cannot produce a clean export of five test clients will not produce one for five hundred.

How should a firm run a client portal trial?

A client portal trial should last two weeks and use five real clients chosen to cover the firm's range: one monthly bookkeeping client, one business return, two individual returns and one client who struggles with technology. Staff log every problem in one shared sheet, and the firm scores the portal on the checklist at the end.

A two-week plan:

1. Day 1. Set up the five clients with real request lists copied from last year. Invite each one with the message the firm would really send.
2. Days 2 to 5. Watch first sign-ins. Log how many clients got in without help, how long it took, and every question they asked.
3. Days 6 to 10. Run normal work: a reminder for open items, a question about one document, a finished document posted back, one signature if the portal includes it.
4. Days 11 to 12. Remove one staff member's access and add a new one. Run a full export of all five clients.
5. Days 13 to 14. Score the checklist below as a group and decide.

Questions for the shared log: Did any client need a phone call to sign in? Did any upload land in the wrong client? How many minutes did staff spend matching uploads to requests? What did the export contain? Write answers in plain sentences, with the client's initials and the date.

Choose trial clients who will say what they think. The technology-shy client is the most useful one, because that experience predicts the support load in February. The post on how to roll out a tax client portal covers what to do after the trial, when the rest of the client list moves over.

Example scored buyer's checklist

The checklist below is an example. Weights add up to 100; adjust them to the firm's client mix. Score each criterion from 0 to 5, multiply by the weight, and divide the total by 5 to get a score out of 100.

As a worked example, a fictional firm, Harbor Point CPA, scored one portal 4 on criterion 1 (14 × 4 = 56) and 2 on criterion 9 (10 × 2 = 20). Those two lines alone show the trade-off: easy for clients, weak on getting data out.

Client portal red flags in the sales demo

Client portal red flags in a sales demo are signs the product does less than the pitch says: features shown on slides but not on screen, no clear answer about exporting data, and contracts longer than the firm can test. Any one is a reason to slow down; two together are a reason to look elsewhere.

Slides instead of screens. If request tracking, reminders or exports appear only in a slide deck, ask to see them in a live account. "That's on the roadmap" is an honest answer and means the feature does not exist today.

No export answer. A vendor that cannot say what a full export contains, or charges a fee for it, is telling the firm it will be hard to leave. Ask for a sample export file during the demo.

Long contracts before a trial. A multi-year commitment signed before any real client has used the portal puts the risk on the firm. Ask for a trial with real clients first, then a term the firm can renew.

Security claims without documents. Words like "secure" and "encrypted" on a slide are claims. Ask for the documentation behind them; the post on the security controls to verify lists what to request.

Demo data only. A demo with three tidy fictional clients hides what happens with a 40-page mixed PDF or a blurry phone photo. Bring one anonymized real file and ask to upload it.

No answer about the client's phone. If the demo never leaves a desktop browser, ask to see the client's view on a phone before the call ends.

For what a portal is and the jobs it covers, see what a client portal for accountants does. For timing a portal decision around the season, the tax season workflow category covers when changes land best.