Jordan Hetrick
Most firms shop for a client portal for accountants the same way they shop for anything else. They compare branding options, e-signature tools, and the look of the mobile app. Those details affect how clients feel about the portal. They say nothing about what happens to a client’s Social Security number after you upload their return.
Security requirements are the better place to start, because federal rules already assign you part of the responsibility for whatever your vendor does with client data. Here is what to demand before you sign.
The short answer
A client portal holds your clients’ most sensitive files, so pick one on security first. The FTC Safeguards Rule treats the portal company as your service provider: you must choose one that can protect client data, put its safeguards in the contract, and check on it periodically. Before you sign, require five things: MFA for staff and clients, files encrypted at rest and in transit, a contract deadline for breach notice, a SOC 2 report, and single sign-on (SSO) with Microsoft 365 for your staff. Look at the rest of the product only once a portal passes.
Treat the Portal Vendor as Part of Your Security Program
Tax preparers and CPA firms fall under the FTC Safeguards Rule, which applies to businesses significantly engaged in financial services and covers professional tax preparers and CPA firms, including sole proprietors. The rule requires a written information security program, and that program has to cover your vendors.
The text of 16 CFR 314.4(f) spells out three duties.
- You must take reasonable steps to select service providers capable of maintaining appropriate safeguards.
- You must require those safeguards by contract.
- You must also assess each provider periodically, based on the risk it presents.
A portal holds your most sensitive files, so it sits at the top of that risk ranking. A sales demo does not satisfy the rule. You need documents you can file: a signed contract with security terms, written answers to your security questions, and a record of when you last reviewed the vendor.
Require Multi-Factor Authentication for Everyone Who Logs In
The Safeguards Rule requires multi-factor authentication for any individual accessing any information system. The only exception is when your designated Qualified Individual approves, in writing, access controls that are reasonably equivalent or more secure. You’ll find the language in section 314.4(c)(5).
For a portal, that translates into a simple test. Ask whether MFA is on by default for your staff. Ask whether clients are prompted to use it, or can opt out with one click. A portal that treats MFA as an optional setting leaves the decision to your least careful user. Find out whether the vendor supports an authenticator app or hardware key in addition to text-message codes, since your Qualified Individual may want that flexibility.
Require Encryption in Transit and at Rest
Section 314.4(c)(3) of the rule requires encryption of all customer information you hold or transmit, both in transit over external networks and at rest, and the IRS recommends that preparers use encrypted methods to exchange personal information with taxpayers. The portal exists to replace email attachments, so confirm it actually encrypts uploads, downloads, and stored files. The FTC has said that a firm storing customer information with a provider must require that provider to encrypt it and periodically check that it still does.
Ask the vendor to put its encryption practices in writing. A marketing page that says “bank-level security” doesn’t count. You want to know what protects files while they travel, what protects them while they sit on a server, and who holds the keys. If the answer is vague, treat that as a finding.
Put Breach Notification Terms in the Contract
Since May 2024, the FTC has required covered firms to notify the agency within 30 days of discovering a breach involving at least 500 consumers, where the information taken was unencrypted.
Your contract should set a short, specific deadline for the vendor to notify you of any incident involving your clients’ data. It should also specify what the vendor will provide to help you investigate, such as access logs and a list of affected files. A firm of any size can ask for this. If a vendor refuses to commit to a number of days, you have learned something about how they will behave during an incident.
Three weeks of vendor silence uses most of your FTC window.
The FTC gives you 30 days from discovering a breach involving 500 or more consumers’ unencrypted data. Set the vendor’s notice deadline in the contract.
Look for Single Sign-On With Microsoft 365
If your staff already sign in to Microsoft 365, look for a portal that lets them use that same account to sign in, called single sign-on (SSO). It is one less password for each person to track, and staff use a portal more when getting in is easy. Your Microsoft 365 accounts should already require MFA, and with SSO the portal sign-in gets that same protection. SSO is for your staff; clients still sign in with the portal’s own login and MFA.
SSO also matters when someone leaves. Disable their Microsoft 365 account and their portal access ends with it, which helps you meet the Safeguards Rule’s requirement to permit access only to authorized users. Without SSO, someone has to remember to remove that person from the portal too.
If your firm uses Microsoft Copilot and wants it to read client files, ask the vendor whether the portal can copy files into SharePoint or OneDrive, and where they would land. Microsoft says Copilot only reads data a user already has permission to view, so anyone who can open that folder can ask Copilot about what is in it. Most firms will not need this.
Request Independent Audit Evidence From the Vendor
A vendor can pass your questionnaire and still run a weak operation, so ask for evidence. Request a recent independent security audit report, such as a SOC 2 report, and go straight to its exceptions section, where the auditor notes any control that failed testing. Ask how the vendor handles employee access to your clients’ files, how long it keeps deleted data, and where that data is stored. Ask what happens to your files if you cancel.
During the free trial
Test the portal yourself in fifteen minutes
Record the Portal Decision in Your WISP
Your Qualified Individual should sign off on the portal choice, and the decision belongs in your written information security program (WISP). Record the vendor you chose, its written answer to each requirement below, and the date you will review it again. If a regulator or an insurance carrier ever asks why you picked this vendor, a dated record of your reasoning is the strongest answer you can give.
Your portal vendor record
Six answers to get in writing, and file in your WISP
MFA 314.4(c)(5)On by default for staff? Can clients opt out? Authenticator app or hardware key?
Encryption 314.4(c)(3)What protects files in transit and at rest? Who holds the keys?
Breach notice Contract; FTC 30-day noticeDays to tell you of an incident? Which logs and affected-file lists will you get?
Staff sign-in 314.4(c)(1)SSO with Microsoft 365? Does disabling a staff account end portal access?
Audit evidence 314.4(f)Latest SOC 2 report and its exceptions? Which vendor staff can open client files?
Leaving ContractHow long is deleted data kept, and where? What do you get back if you cancel?
A Simple Rule for Choosing a Client Portal for Accountants
A weak security foundation is much harder to fix than a missing feature, and your clients will not accept “the vendor was breached” as an explanation. Choose the portal that makes MFA mandatory, encrypts everything, commits to a fast breach notice, hands over an independent audit report, and lets staff sign in through Microsoft 365. Then compare features among the vendors that pass.
Key Takeaways
- The FTC Safeguards Rule makes a CPA firm pick capable service providers, put their safeguards in the contract and reassess them periodically, so a client portal vendor belongs in the firm’s WISP.
- Section 314.4(c)(5) requires multi-factor authentication for anyone reaching a system with customer information; a portal should switch it on for staff by default and keep clients from skipping it.
- Section 314.4(c)(3) requires customer information to be encrypted whether it is moving or stored, and encryption also decides whether a vendor incident reaches the FTC’s 30-day notice, which covers unencrypted data on 500 or more consumers.
- A portal that signs staff in through Microsoft 365 (SSO) carries your Microsoft 365 MFA over, and disabling a departing employee’s account ends their portal access too.
- Ask the vendor for its SOC 2 report and read the exceptions, then spend fifteen minutes on a trial as both the preparer and a test client.
For CPA firms
Choose your client portal with PK Tech
PK Tech has worked with CPA firms as a managed IT provider for more than 17 years, and holds AICPA SOC 2 Type II attestation from an independent audit. Bring the portals on your shortlist and the vendor answers you have so far.
Schedule a call with Jordan →