Secure file upload for accountants: what actually matters
Tax documents contain Social Security numbers, account numbers, income, and addresses. Even so, many of them still travel as email attachments: they sit in your inbox, in the client's sent folder, and in every forward and reply, indefinitely. A dedicated upload link is a simple improvement. This guide covers what to look for in one, in plain language, and what questions to ask any vendor, including us.
Why email attachments are a weak spot
- Copies everywhere. Each attachment lives in at least two mailboxes, often more, with no expiry.
- Wrong recipients. Autocomplete makes it easy to send a W-2 to the wrong person.
- No cleanup. Years later, old returns and IDs are still sitting in an inbox that could be compromised.
- No record. It is hard to say who downloaded what, and when.
Five things to look for
1. Encryption in transit and at rest
Uploads should travel over HTTPS, and files should be encrypted where they are stored, not just on the way there. Ask which algorithm is used and whether files are encrypted before they are written to storage.
2. Access-controlled links
The client's upload link should be long and unguessable, tied to one request, and should not expose other clients' files. Downloading files should require your own signed-in account. A link that anyone can use to browse files is a shared folder, not a secure upload link.
3. Retention limits
The safest file is one you no longer store. Look for a setting that deletes files automatically a set number of days after the work is finished, so client documents don't accumulate forever. Keep your own records according to your firm's policy and any rules that apply to you; the upload tool should not become your long-term archive.
4. Safe file handling
A tool that accepts files from the public should limit file types and sizes, never display uploaded files as web pages, and rate-limit uploads and logins to slow down abuse.
5. An audit trail
You should be able to see when files were uploaded and downloaded, and when they were deleted. That record matters if a client ever asks what happened to their documents.
Questions to ask any vendor
- How are files encrypted at rest, and who holds the keys?
- Can a client upload link be used to see or download files?
- Can I set automatic deletion, and what exactly gets deleted?
- Which security certifications or audits do you actually have? (Ask for the report, not just a badge.)
- Where do I send a security question, and how fast do you reply?
How FilesDue handles it
Here is what FilesDue does today, stated plainly:
- Encryption: files are encrypted with AES-256-GCM before they are stored, and all traffic uses HTTPS.
- Client links: each request gets a long random link (256 bits). Clients use it to upload to that request and see their own checklist status. It does not let anyone download files.
- Your access: viewing and downloading files, including the ZIP of a finished request, requires your signed-in FilesDue account.
- Retention: you choose to keep files for 30, 60, 90, or 180 days after a request is complete. After that, files are purged automatically and the client link stops working.
- File handling: uploads are limited to common document types (PDF, images, Office files, CSV, ZIP) up to 100 MB each, are never rendered inline as web pages, and uploads and sign-ins are rate-limited.
- Audit log: sign-ins, request creation, uploads, ZIP downloads, and purges are recorded.
FilesDue does not currently hold third-party security certifications such as SOC 2, and we won't claim otherwise. If your firm requires a specific certification, ask us first. For more detail, see our security page, or email hello@filesdue.com.
— The FilesDue team
Give clients a secure upload link — try FilesDue free for 14 days →