Secure File Sharing for Accountants With New Clients

Secure file sharing for accountants starts with a checked onboarding form or client portal that keeps documents against the right client. Use email for messages and secure links. Collect ID, TFNs and deeds through the protected channel.

The Safest Way to Collect a New Client’s Documents

Choose an onboarding form for collecting a new client’s details and documents together. A client document portal suits the continuing exchange of returns, statements and source records. Both need restricted access and a clear record of which client supplied each file.

Channel	Best fit	What your practice must manage
Checked onboarding form	New clients with entity details, identity checks and an engagement letter	Required questions, authorised TFN collection and the destination for completed documents
Portal inside your practice tools	Regular exchanges with clients already on your list	Client permissions, separate access for each person and staff responsibility for incoming files
ShareFile	A dedicated document exchange channel across clients and external advisers	Folder permissions, request-link settings and filing into the client record
OneDrive, SharePoint or Google Drive links	Occasional exchanges where you already manage a business cloud account	Named access, folder boundaries, expiry and removal of permissions
Encrypted or password-protected email attachment	An agreed exception when a client cannot use the usual channel	Encryption, recipient checks and a separate way to communicate the password

For a sole practitioner with occasional business clients, a restricted folder or upload request can handle a small number of exchanges. Keep a checklist beside it. The upload alone will not tell you whether the deed matches the trustee details.

For a practice onboarding several clients each week, choose a form with document requirements and automatic follow-up. Assign an owner to every request. Otherwise, staff still chase missing documents even after replacing attachments with links.

Tax Genie is the best fit when you want checked Australian client onboarding and ongoing document requests together. Its guided form checks ABNs against the Australian Business Register and checks TFN format. Clients upload encrypted files and return to their portal using a mobile code.

Tax Genie also chases missing answers by email and SMS, then files completed documents to supported document systems. Those steps save your staff the work of writing reminders and moving completed files manually. Its security and TFN handling page explains how TFNs are protected.

Why Email Fails for ID and Tfns

An emailed identity document leaves copies in the sender’s mailbox, your inbox and any forwarded conversation. A compromised mailbox can expose those copies long after onboarding ends. Licence details and TFNs can support identity fraud, while intercepted correspondence can help a scammer impersonate your practice.

A secure document exchange keeps access permissions with the file. Your practice can remove access to a shared link. Removing a link does not recover a file that someone has already downloaded.

The OAIC’s guidance on the TFN Rule explains the binding requirements for individuals’ TFN information. Recipients must take reasonable steps to prevent loss and unauthorised access, use, disclosure or other misuse. Access must be restricted to staff who need the information for an authorised purpose.

The Rule also limits collection to lawful purposes. A form requesting a TFN must explain the legal authority and purpose of collection. It must explain that refusing to quote a TFN is not an offence and state the consequences of refusal. Entity TFNs have separate taxation-law protections.

The TPB’s confidentiality guidance explains Code item 6. A registered practitioner must obtain client permission before disclosing client information to a third party, unless a legal duty permits disclosure. Tell clients about relevant cloud arrangements and obtain permission for the proposed disclosure.

The TPB’s guidance on protecting clients’ TFNs advises against sending or receiving TFNs through ordinary email. It recommends secure electronic channels or encrypted or password-protected attachments. Choosing a tool does not remove your practice’s obligation to configure and use it properly.

If ID or a TFN arrives by email anyway, use this response:

1. Restrict access to the message and avoid forwarding the attachment internally.
2. Transfer necessary information to the correct restricted client record and confirm that the transfer succeeded.
3. Remove redundant mailbox copies under your retention policy, including recoverable copies where your email service permits this. Preserve anything required by law or an incident investigation.
4. Send the client the preferred secure route for future documents. Ask them to remove unnecessary copies from their sent mail.

The TPB says a lawful TFN recipient does not need to de-identify a TFN simply because it arrived by email. Reducing duplicate copies is a security practice, not a rule that every received email must immediately be destroyed.

Use your document management procedure to decide what belongs in the retained record. For payment-redirection risks, follow the separate business email compromise guidance.

Onboarding Forms Versus Ongoing File Exchange

Onboarding collects and checks a defined set of details once for the new engagement. It establishes the client’s identity and entity details, gathers required documents and ends with the checked record and signed engagement letter. Ongoing file exchange carries each later job’s records and completed documents.

A form can connect an upload request to the answer that explains it. If the client selects a company trustee, the form can request the relevant company details and trust deed. A generic folder accepts whatever the client uploads, including an incomplete or unrelated document.

Build the form so the entity answer determines the questions and upload requirements. Check ABN and TFN format while the client enters them. Let clients decline to quote a TFN, then arrange an authorised alternative. Format checks catch mistyped numbers without proving identity or authority to act.

Tax Genie applies rule-based checks and AI review after the client finishes the form. Fixable issues return to the client on the same private link. It removes TFNs before AI review and records every staff reveal of a TFN.

After onboarding, keep asking for documents against the same client. Tax Genie’s portal supports ongoing uploads and downloads as well as new-client requests. If your practice uses another portal, assign the annual job and its document list there once the engagement is ready.

ShareFile and Client Document Portals

ShareFile is Progress Software Corporation’s document-sharing product, historically known as Citrix ShareFile. It suits practices wanting a dedicated exchange channel without moving every practice-management task into the same tool.

ShareFile has branded client access, permissioned folders, file request links and access-expiry settings. Its activity reports record file access and other account activity. Staff choose the destination folder and who can access it. A ShareFile folder must still be connected to your practice’s filing procedure.

ShareFile’s published plans distinguish secure sharing from wider document workflows. Advanced covers file sharing. Premium includes e-signatures, forms and requests, so signing is not universally a separate add-on. Its user-based subscription and minimum staff licences need to be included in the practice’s budget.

Tool	Client access and mobile use	Where received files go
ShareFile	Named client access or request links, with settings governing sign-in. Mobile apps support access across devices.	The ShareFile destination folder chosen by staff
FYI New Collaborate	Microsoft-based guest sign-in, with Google or code-based options depending on practice settings	The upload folder imports and files documents into FYI
Karbon	Request links or a portal account. Its client mobile app supports uploads.	Uploaded request files appear on the work item’s task list
TaxDome	Signed-in client portal or client mobile app, including phone document uploads	The client account’s permitted document folders
Content Snare	Clients complete requests without creating a login. Portal links let them access files you send.	The request record, with supported integrations for document filing

FYI suits an existing FYI practice that wants received documents filed there. Its guest sign-in depends on the practice’s Microsoft settings. Give clients instructions that match those settings instead of promising the same login experience to everyone.

Karbon suits document requests attached to work already managed in Karbon. TaxDome suits a practice using its client account and document folders. Content Snare suits item-by-item collection with reminders and review of the answers received.

For Australian onboarding, compare the checks alongside the exchange channel. Tax Genie combines ABR checks, protected TFN handling and document requests. Its client portal and automatic chasing then carry the continuing exchange without making clients remember a password.

If you are replacing an existing ShareFile archive, use the separate ShareFile migration guide for the transfer and access rebuild.

Security Settings to Check in Any Tool

Secure cloud storage needs permissions for both receiving and sharing documents. A file request that accepts an upload has a different job from a folder link that lets someone read existing files.

Microsoft’s OneDrive and SharePoint file requests are upload-only. Recipients cannot view the folder’s contents. Anyone holding the request link can upload, so the link alone does not prove who supplied the file. The administrator must enable the feature.

Google Drive permits sharing with named recipients and assigning viewing or editing permissions. Folder permissions can give access to the documents inside. Use a separate restricted folder for each client and limited-access subfolders where different people need different documents.

Inspect these settings before making the channel your default:

• Require multi-factor sign-in for staff and enable it for clients where the channel supports it. A password-free link is not automatically multi-factor sign-in.
• Limit each client to their own files. Separate a company director’s access from another group member’s personal tax records.
• Set link expiry and remove access when the job or authorised exchange ends. Avoid long-lived links to identity documents.
• Restrict downloads where available and useful. Treat a downloaded copy as outside the portal’s permission settings.
• Keep access logs and assign someone to review unusual activity. Confirm the logs show the actions your practice needs to trace.
• Require encryption in transit and storage. Protect devices that download files and restrict local copies.
• Read the vendor’s hosting statement, including processing locations and service providers. An Australian website or sales office does not establish Australian hosting.

ShareFile describes managed storage zones and customer-managed storage options. Its file-storage location depends on the account and storage arrangement. Get the account’s written arrangement before making a statement to clients about where their documents are held.

Never share an entire client folder using a public viewing link. Before sending a link, inspect its access settings and confirm that it exposes only the intended documents. At handover, revoke former staff access, remove obsolete guest access and cancel outstanding links.

Your wider cyber security checklist covers staff devices and email accounts alongside document exchange.

Moving Clients Off Email

Start the secure channel with every new client. Replace attachment requests in your welcome message and send a short document checklist. Tell staff to reply with the secure route whenever a client emails a sensitive document.

Move existing clients when their next annual job starts. Send the explanation with that job’s request, then provide phone help for anyone who cannot open the link. Record which clients need assistance so the next staff member does not restart the same conversation.

Use this wording in your client message:

To protect your information, please use the secure document link we send you for ID, TFNs and tax records. We no longer accept these documents through ordinary email. You can still email us with questions.

Open the link and follow the instructions beside each requested item. If you cannot use it, phone our office using the number you already have. We will arrange another way to receive your documents.

Offer assisted upload or an in-person appointment when the client cannot use the portal. Some clients lack a suitable device or reliable mobile reception. Help them complete the secure route without asking them to disclose a portal password or one-time code.

For an executor, confirm their authority and whose records they can access before opening a deceased estate’s folder. A relative helping with a device does not automatically have authority to receive the documents.

Where a secure attachment is the agreed exception, confirm the recipient address and use encryption or password protection. Communicate the password through a separate agreed channel. For TFNs handled by phone, complete the required identity checks first.

Give one staff member responsibility for assisted clients. The next new client receives a secure request from the start, and every exception has an agreed method recorded against the client.