This article is general information, not legal or compliance advice. Requirements depend on your jurisdiction and circumstances; consult qualified advisors and the current IRS and FTC guidance.
Why does document collection matter for security?
Because intake is where the most sensitive data enters your firm, often from many clients at once, through channels your firm doesn't fully control.
W-2s, 1099s and K-1s contain Social Security numbers, account numbers and income details. Every copy that sits in an inbox, a download folder or a shared drive is another place that data can be exposed.
What are the risks of collecting documents by email?
Attachments persist in mailboxes, can be forwarded or misdirected, and are hard to track or delete consistently.
- Persistence: attachments remain in sent and received folders indefinitely unless someone deletes them.
- Misdirection: autocomplete makes it easy to send to the wrong address.
- Phishing exposure: clients become used to sending sensitive files by email, which attackers can exploit.
- Fragmentation: documents end up scattered across several people's inboxes.
What does a client portal do differently?
It gives clients one controlled destination, keeps documents out of inboxes, and lets the firm manage access centrally.
A well-designed portal stores documents encrypted, limits who can see them, and keeps a single record per client. It also improves workflow: documents are in one place, which makes it easier to see what's outstanding.
| Consideration | Client portal | |
|---|---|---|
| Where files end up | Multiple inboxes and devices | One managed location |
| Access control | Whoever has the mailbox | Managed by the firm |
| Tracking what's received | Manual | Centralized per client |
| Client familiarity | High | Requires a short introduction |
What is a WISP, and how does document collection fit?
A written information security plan describes how your firm protects client data. Your document-collection method should be described in it.
Tax professionals are generally expected to maintain a WISP. Typical elements include who is responsible for security, how data is collected, stored and disposed of, access controls, employee training, and incident response. Describe your intake channel explicitly, including what you tell clients to do and what staff do when documents arrive another way.
What does IRS Publication 4557 cover?
Publication 4557, Safeguarding Taxpayer Data, is IRS guidance for tax professionals on protecting client information and building a security plan.
It's a practical starting point for small and mid-sized firms. Read the current version on IRS.gov rather than relying on summaries, and pair it with any requirements that apply to your firm under the FTC Safeguards Rule and state law. Your advisors can tell you which apply.
How do you move clients from email to a portal?
- Announce the change in your engagement letter and organizer.
- Send a short how-to with tips for photographing documents.
- When clients email documents anyway, move them into the portal and remind them kindly.
- Stop sending documents back to clients by email.
What should staff do when documents arrive by email anyway?
Move them into the firm's secure system, remove them from the mailbox according to your policy, and remind the client of the portal.
Some clients will keep emailing documents no matter what. Your WISP should say what happens next: who moves the files, where they go, and when the email copies are deleted. Consistency matters more than perfection. A simple, repeatable routine is easier to follow during busy weeks.
What should you ask a portal provider?
- Is uploaded data encrypted in storage?
- How is one firm's data separated from another's?
- Who at the provider can access client documents, and under what circumstances?
- How are user accounts and access managed for your staff?
- Where is data stored, and how is it deleted when you ask?
- Can they provide security documentation for your review?
Get answers in writing and keep them with your security plan.
How do you protect clients from phishing?
Tell clients exactly how your firm will and won't ask for documents, and never deviate from it.
If clients know you will only ever ask them to upload through the portal, a fake email requesting documents is easier to spot. Put that message in your engagement letter and reminders.
Where does NiniTaxBot fit?
NiniTaxBot includes a secure client portal with encrypted storage and firm-level data isolation at the database level. It can be one part of your firm's security plan. It doesn't replace your WISP, training or policies. See the security overview.