Most firms shop for a client portal for accountants the same way they shop for anything else. They compare branding options, e-signature tools, and the look of the mobile app. Those details affect how clients feel about the portal. They say nothing about what happens to a client’s Social Security number after you upload their return.
Security requirements are the better place to start, because federal rules already assign you part of the responsibility for whatever your vendor does with client data. Here is what to demand before you sign.
The short answer
A client portal holds your clients’ most sensitive files, so pick one on security first. The FTC Safeguards Rule treats the portal company as your service provider: you must choose one that can protect client data, put its safeguards in the contract, and check on it periodically. Before you sign, require five things: MFA for staff and clients, files encrypted at rest and in transit, a contract deadline for breach notice, a SOC 2 report, and single sign-on (SSO) with Microsoft 365 for your staff. Look at the rest of the product only once a portal passes.
Tax preparers and CPA firms fall under the FTC Safeguards Rule, which applies to businesses significantly engaged in financial services and covers professional tax preparers and CPA firms, including sole proprietors. The rule requires a written information security program, and that program has to cover your vendors.
The text of 16 CFR 314.4(f) spells out three duties.
A portal holds your most sensitive files, so it sits at the top of that risk ranking. A sales demo does not satisfy the rule. You need documents you can file: a signed contract with security terms, written answers to your security questions, and a record of when you last reviewed the vendor.
The Safeguards Rule requires multi-factor authentication for any individual accessing any information system. The only exception is when your designated Qualified Individual approves, in writing, access controls that are reasonably equivalent or more secure. You’ll find the language in section 314.4(c)(5).
For a portal, that translates into a simple test. Ask whether MFA is on by default for your staff. Ask whether clients are prompted to use it, or can opt out with one click. A portal that treats MFA as an optional setting leaves the decision to your least careful user. Find out whether the vendor supports an authenticator app or hardware key in addition to text-message codes, since your Qualified Individual may want that flexibility.
Section 314.4(c)(3) of the rule requires encryption of all customer information you hold or transmit, both in transit over external networks and at rest, and the IRS recommends that preparers use encrypted methods to exchange personal information with taxpayers. The portal exists to replace email attachments, so confirm it actually encrypts uploads, downloads, and stored files. The FTC has said that a firm storing customer information with a provider must require that provider to encrypt it and periodically check that it still does.
Ask the vendor to put its encryption practices in writing. A marketing page that says “bank-level security” doesn’t count. You want to know what protects files while they travel, what protects them while they sit on a server, and who holds the keys. If the answer is vague, treat that as a finding.
Since May 2024, the FTC has required covered firms to notify the agency within 30 days of discovering a breach involving at least 500 consumers, where the information taken was unencrypted.
Your contract should set a short, specific deadline for the vendor to notify you of any incident involving your clients’ data. It should also specify what the vendor will provide to help you investigate, such as access logs and a list of affected files. A firm of any size can ask for this. If a vendor refuses to commit to a number of days, you have learned something about how they will behave during an incident.
Three weeks of vendor silence uses most of your FTC window.
The FTC gives you 30 days from discovering a breach involving 500 or more consumers’ unencrypted data. Set the vendor’s notice deadline in the contract.
If your staff already sign in to Microsoft 365, look for a portal that lets them use that same account to sign in, called single sign-on (SSO). It is one less password for each person to track, and staff use a portal more when getting in is easy. Your Microsoft 365 accounts should already require MFA, and with SSO the portal sign-in gets that same protection. SSO is for your staff; clients still sign in with the portal’s own login and MFA.
SSO also matters when someone leaves. Disable their Microsoft 365 account and their portal access ends with it, which helps you meet the Safeguards Rule’s requirement to permit access only to authorized users. Without SSO, someone has to remember to remove that person from the portal too.
If your firm uses Microsoft Copilot and wants it to read client files, ask the vendor whether the portal can copy files into SharePoint or OneDrive, and where they would land. Microsoft says Copilot only reads data a user already has permission to view, so anyone who can open that folder can ask Copilot about what is in it. Most firms will not need this.
A vendor can pass your questionnaire and still run a weak operation, so ask for evidence. Request a recent independent security audit report, such as a SOC 2 report, and go straight to its exceptions section, where the auditor notes any control that failed testing. Ask how the vendor handles employee access to your clients’ files, how long it keeps deleted data, and where that data is stored. Ask what happens to your files if you cancel.
During the free trial
Test the portal yourself in fifteen minutes
Your Qualified Individual should sign off on the portal choice, and the decision belongs in your written information security program (WISP). Record the vendor you chose, its written answer to each requirement below, and the date you will review it again. If a regulator or an insurance carrier ever asks why you picked this vendor, a dated record of your reasoning is the strongest answer you can give.
Your portal vendor record
Six answers to get in writing, and file in your WISP
A weak security foundation is much harder to fix than a missing feature, and your clients will not accept “the vendor was breached” as an explanation. Choose the portal that makes MFA mandatory, encrypts everything, commits to a fast breach notice, hands over an independent audit report, and lets staff sign in through Microsoft 365. Then compare features among the vendors that pass.
For CPA firms
Choose your client portal with PK Tech
PK Tech has worked with CPA firms as a managed IT provider for more than 17 years, and holds AICPA SOC 2 Type II attestation from an independent audit. Bring the portals on your shortlist and the vendor answers you have so far.
Schedule a call with Jordan →