PingtailSecure ways to collect client documents, compared
Email attachments, shared folders, client portals and upload links: what each one exposes, what clients will actually use, and what to change first.
Most small firms collect documents the way their clients prefer, which usually means email. A passport scan arrives as an attachment, a bank statement follows in a reply to an old thread, and a payroll report is forwarded from the client's personal address. Each one works. Together they mean that some of the most sensitive files your clients own now live in several inboxes, on several phones, in several backups, with no clear end date.
This page compares the four common ways to collect client documents: email attachments, shared cloud folders, client portals and upload links. For each one it sets out what is exposed, what clients will actually use, and when it is a reasonable choice. It ends with the changes worth making first, whichever tool you use. It is general guidance for small firms, not a security audit.
What "secure" means for a small firm
Security discussions get abstract quickly. For document collection, four plain questions cover most of the risk.
- How many copies exist? Every copy is one more place a file can leak from: a sent folder, a forwarded email, a laptop's sync folder, a backup.
- Who can open them? Only the people who need to, or anyone who gets hold of a link, a password or a mailbox?
- How are they protected where they are stored? Encrypted, and with the keys kept apart from the files?
- When are they deleted? At a date you chose, or never?
There is a fifth question that is easy to forget: will the client actually use it? A method clients avoid pushes them back to email, and then the secure option protects nothing.
The four options side by side
| Email attachments | Shared cloud folder | Client portal | Upload link | |
|---|---|---|---|---|
| Copies created | Many: both mailboxes, forwards, backups | One shared copy, plus every synced device | One, in the portal | One, in the tool |
| Who can open it | Anyone with access to either mailbox | Whoever the folder or link is shared with | Users with a login | The holder of the link, often with an extra check on a new device |
| Client effort | Lowest, they already know it | Low once set up, confusing for some | Highest: account, password, reset | Low: tap a link |
| Wrong recipient risk | Real: autocomplete picks the wrong name | Sharing settings drift over time | Low | Low: the link belongs to one request |
| Shows what is still missing | No | No | Sometimes | Usually, it is built around a list |
| Deletion you control | Hard: you cannot delete the client's copy | Possible, if the folder is yours | Yes, with retention settings in many | Yes, with retention settings in many |
The table is about typical setups. A specific product can do better or worse than its column, so check the details of the one you use.
Email attachments
Email is where every firm starts, and for good reasons: clients know it, nothing needs setting up, and it works from any device. The problems are copies and control. An attachment exists in the client's sent folder, your inbox, any colleague you forward it to, and the backups of all of them. A compromised mailbox on either side exposes every document ever sent through it. And once a file has been emailed, you cannot delete the copies that are not yours.
Two common habits make it worse. Sending a password-protected file and its password in the same email protects nothing. And replying to an old thread to send a new document means the latest statement travels with every previous message.
When email is fine: for documents that carry little personal information, such as a supplier invoice, and for firms with very few clients and a short retention habit. When it is not: identity documents, full bank statements, payroll records and tax forms with identification numbers. The guide to collecting identity documents from new clients covers those in detail.
Shared cloud folders
A shared folder per client solves the copy problem: one place, one version. It is a good fit for clients who already use cloud storage at work and for long-running files that both sides edit.
The risks are in the sharing settings. A folder shared with "anyone with the link" can be opened by anyone the link reaches. Permissions granted to a client's former bookkeeper or a departed employee tend to stay in place. Files sync to every device signed in to the account, including personal laptops. A client can delete or overwrite a file by mistake. And a folder does not tell anyone what is still missing; someone has to look.
When a shared folder is fine: for organized clients who already work in one, with sharing limited to named people and reviewed once a year. When it is not: for clients who will not remember how to find it next month, which is most of them.
Client portals
A portal gives each client an account where they can upload documents and see what the firm has sent. Done well, it is the most controlled option: one copy, named users, and the firm sets the rules.
The weak point is the client. A portal asks them to remember a login they use a few times a year. Password resets become a support task. Some clients reuse a weak password, and some simply give up and email the file anyway, which brings you back to the first column. The client portal or upload link comparison looks at this trade-off in more depth.
When a portal is right: for clients who log in often for other reasons, such as reading messages or approving documents, and for firms whose suite already includes one that clients use.
Upload links
An upload link is a private link sent for one request. The client taps it, sees the list of documents you need, and uploads each one. There is no account and no password, which is why clients use it.
The question to ask is what happens if the link is forwarded or found. Good implementations answer it in layers: the link is a long random token that cannot be guessed, it is stored only in hashed form, it belongs to one request rather than to the client's whole file, and opening it on a new device asks for a code sent to the client's email. Without those layers, a link is only as private as the inbox it was sent to.
When an upload link is right: for most small-firm clients who send documents a few times a year and will not keep a login. When it is not: when the client needs to browse their whole history with you on a regular basis; a portal or an optional account fits that better.
What to change first
You do not need to move every client at once. These changes reduce the most risk for the least effort, in this order.
- Stop accepting identity documents by email attachment; ask for them through an upload instead
- Never send a file's password in the same email as the file
- Turn on two-step login for every mailbox and storage account in the firm
- Review who has access to each shared client folder, and remove former staff and old advisers
- Pick one channel per document type and say so in your engagement letter, so clients know where to send what
- Set a retention period and delete files when it ends, keeping what the law or your supervisor requires
- Delete client documents from personal devices and download folders after filing them
Questions to ask any provider
Whatever tool you consider, ask these before you move client files into it. A clear written answer to each one tells you more than a marketing page.
- Are files encrypted where they are stored, and who holds the keys?
- Can a link or login be used from any device, or is a new device checked?
- Can I set how long files are kept, and are they deleted automatically after that?
- Can I delete one file, or everything for one client, at any time?
- Which file types are refused, and what happens to an unsafe file?
- Where are the files stored, and which other companies process them?
- Which certifications or audits do you hold, and can I see the report?
Questions
Is it safe for clients to email tax documents to their accountant?
It works, but it creates copies in both mailboxes and every backup, and you cannot delete the client's copies. For identity documents, bank statements and tax forms with identification numbers, an upload into one controlled place is safer.
Is a password-protected PDF sent by email secure?
Only if the password travels separately, for example by phone. A password sent in the same email, or in the next email to the same address, gives no extra protection to anyone who can read that mailbox.
Are upload links less secure than client portals?
Not necessarily. A link made of a long random token, scoped to one request and checked with a code on a new device, can be as safe as a login, and clients use it instead of falling back to email.
How long should a firm keep client documents?
As long as the law, your supervisor and your engagement letter require, and no longer. Set a retention period, delete files when it ends, and keep what you must where it belongs.
Doing this with Pingtail
Pingtail collects documents through a private upload link per request: a long random token stored only in hashed form, with a 6-digit code sent to the client's email when the link is opened on a new device. Every file is encrypted by the application before storage, with its own key, so the storage provider holds only ciphertext. You choose how long files are kept, and you can delete one file or all of a client's files at any time; unsafe file types are never stored. The details are on the security page, and we do not hold certifications. You can try it on yourself first: send a test request to your own email and upload the wrong file on purpose.