Sharing documents securely
Why sensitive financial documents should not travel by email, how portal sharing and secure links work, and what to do if something was sent the wrong way.
How-toFor Portal clients, Business owners, Firm staff, Bookkeepers
Why not email
Email attachments are copied to every mailbox they pass through, backed up indefinitely, and searchable by anyone who later gains access to any of those mailboxes. A bank statement sent in 2024 is still sitting in several places in 2026.
Never send by ordinary email:
- Bank statements and account numbers.
- Tax identification numbers — yours, an employee's, or a vendor's.
- Payroll registers with individual pay detail.
- Signed tax returns.
- Anything containing credentials or security answers.
How to share instead
| What you are sharing | Use |
|---|---|
| A document for your bookkeeper | Upload it to the portal, or attach it to the relevant request. |
| A receipt for one transaction | Attach it to that transaction so it stays with the record. |
| A statement for a client to read | Publish to the portal rather than attaching to an email. |
| A document for someone without portal access | A secure link with an expiry, rather than an attachment. |
| A document that must be signed | The signing flow, which records who signed and when. |
If something went out the wrong way
- 1
Work out exactly what was disclosed and to whom.
Vague concern is hard to act on; a specific list is not.
- 2
Ask the recipient to delete it, but do not treat that as containment.
- 3
Change anything that is now exposed.
Account credentials, and any access the document would enable. Bank account numbers alone are not usually cause to close an account, but tell the bank.
- 4
Tell whoever is affected if it was someone else's data.
Employee and vendor data carries notification obligations in some circumstances. Ask before deciding not to notify.
- 5
Fix the process, not just the incident.
Common questions
Upload it to the portal instead and tell them you have. Habits are hard to change and the request is usually convenience rather than a considered decision.
Documents attached to transactions are retained with the record. Retention policy for other documents is set in Document Storage — and record retention requirements are a tax and legal question worth confirming with your preparer.
See alsoDocument storage and retention
Was this useful?