Email can protect tax documents when the right controls are configured, but an ordinary attachment creates copies the firm may struggle to manage. A well-configured client portal can provide a more controlled sharing workflow. Neither option is secure simply because the vendor uses encryption.
Compare the full process: sender and recipient identity, account protection, encryption, downloads, access logs, retention, and the staff procedure when something goes wrong.
Key takeaways
- Compare the complete sharing workflow, including recipient identity and retained copies.
- Distinguish transport, storage and message-level encryption instead of treating them as interchangeable.
- Verify a portal’s permissions, logs and expiration settings in the actual product.
- Access revocation cannot recall a copy already downloaded by a recipient.
Table of Contents
What does email encryption actually protect?
Different encryption layers solve different problems.
Transport encryption protects a connection while information moves between systems. Google’s Gmail guidance explains TLS and other available protections. Check the actual message path and configuration rather than assuming every recipient connection has the same protection.
Encryption at rest protects stored information at the service or device layer. It is inaccurate to say that mainstream mailboxes are generally stored unencrypted: Microsoft documents encryption at rest and in transit, and Google Workspace also describes storage encryption.
Message-level or client-side encryption can add a different layer of protection. Its availability, key handling, recipient experience, and recovery need to be assessed for the firm’s workflow.
Encryption at rest does not prevent an attacker who has gained authorized account access from reading messages available through that account. That is why account security and document retention remain important.
Why do attachments create a management problem?
An attachment may exist in the sender’s mailbox, the recipient’s mailbox, downloaded folders, synchronized devices, forwarded messages, and backups. The firm may not control all those locations.
A mistaken recipient creates a different problem from interception in transit. Encryption does not automatically prevent someone from sending the right document to the wrong person.
Repeatedly forwarding old threads can also expose unrelated documents or client details. Staff need a clear handoff process that includes checking the recipient and the specific material being shared.
What can a client portal improve?
A suitable portal can centralize document access and may offer authenticated users, access logs, expiration, and configurable permissions. Those capabilities must be confirmed and enabled in the actual product.
A portal link sent by email can avoid attaching the tax document to that message. Keep the notification itself free of unnecessary identifiers and sensitive details.
Portal access is not the same as permanent control over every copy. If a recipient can download, print, photograph, or capture the information, expiration will not recall those copies. Assess download restrictions and staff or client device handling separately.
For the firm’s own document policy, decide which records should remain available, who owns the retention schedule, and how deletion interacts with legal or contractual requirements.
When should a firm use a portal instead of an attachment?
An authenticated portal is a useful starting point for recurring exchanges of sensitive tax records when it supports the firm’s required permissions, logs and retention process. It gives staff a consistent place to send a client without attaching another copy to each message.
A routine scheduling email may need no attachment at all. Where email is an approved alternative for documents, specify the encryption method, recipient check and handling instructions. Choose the method from the document’s sensitivity and the available controls, rather than leaving each employee to improvise.
A checklist for configuring document sharing
Before introducing a portal or revising email use, verify:
- Named staff accounts, appropriate client identities, and suitable MFA.
- Client-level permissions that prevent cross-client access.
- The encryption and recipient-authentication settings for the chosen workflow.
- Whether downloads and forwarding are permitted, restricted, or logged.
- Link expiration, access revocation, and the effect on previously downloaded copies.
- Logs the firm can retrieve, their retention, and who reviews them.
- A recovery path when a client cannot sign in.
- Retention, backups, deletion, and offboarding responsibilities.
Test these controls using synthetic documents. Include a negative test: a test user should fail to open a different test client’s folder. A demonstration that one authorized user can sign in is not enough.
How should staff guide a client through the handoff?
Use a short message explaining where to sign in and how to obtain help through a known firm contact. Avoid training clients to trust every unexpected “view document” message.
During onboarding, show the legitimate portal address and explain that the firm will not ask for an email password. If a client receives an unusual notice, encourage independent verification with the firm.
For a client who cannot use the portal, approve an alternative based on the document sensitivity and the firm’s tools. Do not let each employee improvise a different transfer method.
If an encrypted attachment is the approved alternative, confirm the protection and exchange any required secret through a separately verified channel. An extra password in the same email provides little separation if that message is exposed.
What if a document goes to the wrong person?
Report the event through the firm’s incident process. Record the recipient, information involved, time, and available access evidence. Revoke portal access where possible, while recognizing that revocation does not remove an existing download.
Ask the recipient to delete the material where appropriate, but do not treat that request as proof of complete containment. The security lead and relevant reviewer should determine the next steps from the facts.
Use the MFA guide for tax firms to protect the accounts behind either sharing method, and document the selected process in the firm’s WISP.
How Verito helps protect the document-sharing workflow
VeritGuard managed IT can support the device security, patching, staff training, and IT support surrounding document sharing. Ask which email and account administration tasks are included in the proposed scope.
If the workflow also uses hosted desktop applications, VeritSpace hosting addresses that environment. Confirm compatibility and licensing separately; hosting a desktop does not automatically provide or configure a client portal.
For Microsoft 365 workflows, Verito’s managed Microsoft 365 service addresses account administration, sharing limits and data-loss policies. Discuss the specific email or SharePoint workflow and confirm licensing and the selected service scope.
Choose the document-sharing method first, then agree which systems Verito will manage and which remain with the portal or email provider.
Sources
- Microsoft: Encryption in Microsoft 365
- Google: How Gmail encrypts email
- Google: Gmail client-side encryption and storage protection
- IRS: Publication 4557, Safeguarding Taxpayer Data
