A good client portal for accountants lets clients upload requested documents, sign, approve and pay in one login, while giving the firm control over who sees what. Check that it supports multi-factor authentication, encryption, access reviews and activity logs, because the FTC Safeguards Rule already requires those of tax firms. Then test it as your least technical client would.
Key takeaways
- Tax preparation firms are covered by the FTC Safeguards Rule, so a portal must support MFA, encryption, access control and activity logging.
- The best test of a portal is a 20-minute run-through from the point of view of your least technical client.
- Request lists with checklists save more staff time than storage space or branding ever will.
- Signing, approvals and payment in the same portal remove the most common reasons clients fall back to email.
- Ask every vendor the same written questions and score the answers, rather than comparing demos.
What does a client portal need to do for a US accounting firm?
A client portal is a secure website where each client logs in to exchange documents and complete tasks with your firm. For an accounting practice it has three jobs: collect what you need from clients, deliver what they need from you, and keep a record of both. If it does those well, it replaces most of the email attachments, couriered folders and "did you get my W-2?" phone calls that fill a busy season.
The trap is choosing on the demo. Every demo is run by someone who uses the product daily, on a fast laptop, with a perfect test client. Your clients will use it once a year, on a phone, often while doing something else. So judge any portal on two tests: does it meet the security obligations you already have, and can your least confident client finish a task without calling you?
Which security controls does the Safeguards Rule expect?
The FTC treats tax preparation firms as financial institutions, so the Safeguards Rule applies to them. Several of its requirements land directly on whatever tool your clients use to send you their data. Map each requirement to a portal feature and ask the vendor to show it working.
| Safeguards Rule requirement | What to check in the portal | Ask the vendor |
|---|---|---|
| Multi-factor authentication for anyone accessing customer information | MFA for staff logins at minimum, and an option for clients | Can MFA be enforced for all staff, not just offered? |
| Encrypt customer information on your system and in transit | Encryption of stored files and of connections | Where are files stored, and how are they encrypted at rest? |
| Control access and review it regularly | Role-based permissions; firm-only folders clients never see | Can we list who has access to a client’s files in one view? |
| Log authorized users’ activity | An activity history per client and per user | Can we export the log, and for how long is it kept? |
| Dispose of data no later than two years after last use, unless needed | Deletion and retention controls | Can we delete a former client’s files completely, and prove it? |
The Rule also requires notifying the FTC within 30 days of discovering a notification event involving unencrypted information of at least 500 consumers. That is your obligation, not the vendor’s, but you will need the vendor’s logs to work out what happened. IRS Publication 4557 covers the same ground from the IRS side and is worth reading alongside the Rule. Our guide to writing a WISP for the Safeguards Rule shows how the portal fits into the wider plan.
How do you test a portal as your least technical client?
Pick a real person in mind: perhaps a retired client in their seventies who files a joint return and uses an older phone. Then run this script on a free trial, on a phone, with a fresh email address you have never used for the vendor.
- Invitation. Does the invite email look trustworthy, carry your firm’s name and avoid landing in spam?
- First login. How many screens before the client reaches their task? Count them. More than four is a warning.
- Finding the request. Without hints, can the client see exactly which documents you still need?
- Uploading. Photograph a paper form with the phone camera and upload it. Is the image readable when it reaches you?
- Joint access. Can a spouse get their own login to the same household, or must they share one?
- Signing. Sign a sample engagement letter. Does the client get a copy automatically?
- Forgotten password. Reset it. Does the reset work on the phone without a desktop?
Time the whole script. If it takes you more than 20 minutes, it will take your clients longer, and many will give up and email you instead. A portal clients avoid gives you none of the security benefits in the table above.
Why do request lists matter more than storage?
Vendors often lead with storage limits and branding. Neither saves your staff much time. What saves time is a request list: a checklist of named items for each client ("2026 W-2 from employer", "1099-INT from credit union", "property tax bill") that the client ticks off by uploading, and that your team can see at a glance.
Look for these details:
- lists you can build from a template per return type, then adjust per client;
- each uploaded file attached to the item it answers, not dumped in a general folder;
- automatic reminders for outstanding items, with a stop as soon as the list is complete;
- a firm view showing which clients are complete, partial or not started.
Organizers and questionnaires belong in the same place. A short online questionnaire ("Did you buy or sell a home this year?") that adds items to the request list based on answers beats a 14-page PDF organizer that half your clients never open.
Should signing, approvals and payments live in the portal?
Yes, if you can. Every task that sends the client somewhere else is a task that sends them back to email. The three that matter most for a tax firm are:
- Signatures on engagement letters, consent forms and authorization forms, with a signed PDF and an audit record returned to the client file. For Form 8879, check how the portal handles the identity verification IRS rules require; our guide to Form 8879 e-signature covers that in detail.
- Approvals of draft returns and financial statements, so you have a dated record that the client reviewed the figures.
- Payment of invoices online, ideally with the option to release final documents only once the invoice is paid.
When all three live in one login, a typical client completes their year in a handful of visits: upload documents, answer questions, review the draft, sign, pay, download. Each step leaves a record, which matters when someone asks months later who approved what and when.
Worked example: what email costs a 600-return firm
Consider an illustrative firm preparing 600 individual returns. Before its portal, staff estimated each return generated about eight document emails, three of which needed follow-up because a file was missing, unreadable or sent to the wrong person. At roughly four minutes to file, rename and chase each email, that is:
- 600 returns × 8 emails × 4 minutes = 320 hours of handling a season;
- 600 × 3 follow-ups × 6 minutes = another 180 hours.
After a season with request lists and automatic reminders, the firm estimated handling dropped by about two-thirds, as uploads arrived already attached to the right client and item. Even if your saving is half that, around 165 hours is a month of one person’s time released in the busiest part of the year. Your own numbers will differ; the point is to count the emails before you buy, so you can tell afterwards whether the portal paid for itself.
Which rollout mistakes stop clients using the portal?
Most portal failures are rollout failures, not software failures. The same four mistakes come up again and again.
- Launching in February. Inviting every client at the start of filing season means your team answers login questions when it has the least time. Invite in the autumn, starting with clients who already email documents promptly.
- Keeping email as an equal option. If clients can still send attachments with no consequence, many will. Reply to emailed documents with a polite note and a link to the right request item, every time.
- One giant request list. Forty generic items overwhelm clients. Ten specific items, named the way the client would recognize them, get finished.
- No owner inside the firm. Someone needs to own templates, reminder wording and the weekly check of incomplete lists. Without that, request lists drift out of date by the second season.
Measure adoption simply: the share of documents that arrive through the portal rather than email, checked weekly during the season. Aim for most of them by the end of the first year, and look closely at the clients who still email, because they usually point to one specific step in the portal that is harder than it should be.
What questions should you ask every vendor?
Send the same written list to every shortlisted vendor and score the answers from 0 to 2. Written answers are easier to compare than demos and become part of your vendor file under the Safeguards Rule.
- Can MFA be enforced for all staff accounts? Is it available to clients?
- Where is client data stored, and is it encrypted in transit and at rest?
- Can we export a client’s full activity history?
- Can we delete a former client’s data completely and on our schedule?
- Do clients get one login per person, including spouses?
- Can request lists be built from templates and send their own reminders?
- Are e-signatures, approvals and invoice payments handled inside the portal?
- Can documents be held until an invoice is paid?
- What happens to our data if we cancel, and in what format can we export it?
- What independent security assessments, if any, can you share?
A vendor that answers vaguely on questions 1 to 4 is telling you something important. Those are the questions an IRS or FTC inquiry would ask you.
How Zaquil handles the client portal for accountants
Zaquil gives each client a branded secure client portal under your firm's name. Here is how a tax season runs through it.
When an engagement starts, Zaquil reads the client's emails, forms and emailed files, works out the job and proposes a document checklist. You adjust it, and the client sees it in the portal as a simple list of what is still needed. They upload against each item from a phone or laptop, and fill in your organizers and questionnaires online. On your side, each file lands on the client record, attached to the job.
When the draft is ready, the client approves and e-signs the return or engagement letter in the portal and gets a signed PDF with a signing certificate. They pay the invoice online in the same place, and you can lock final documents until the invoice is paid, so the download appears as soon as payment clears.
Behind the portal, automations send reminders for outstanding items and stop when the checklist is complete, and replies come into the one inbox alongside the client's email, SMS and WhatsApp messages. Firm-only working papers stay in the Documents hub, which clients never see.
The accounting and tax setup comes with checklist templates for common return types. Start a 14-day free trial from the pricing page and run the client-side test script above on it.
Frequently asked questions
What is a client portal for accountants?
It is a secure website where each client logs in to exchange documents and complete tasks with their accounting firm. Clients upload requested documents, answer questionnaires, review and sign returns and pay invoices. The firm sees what is outstanding for each client and keeps a dated record of every upload, signature and approval in one place instead of scattered email threads.
Is a client portal safer than email for tax documents?
Usually, if it is set up properly. A portal can require multi-factor authentication, encrypt files at rest and in transit, limit who can see each client’s files and log every access. Ordinary email attachments sit in multiple inboxes with no access control. The protection depends on configuration, so enforce MFA for staff and review access regularly.
Does the FTC Safeguards Rule apply to accounting firms?
It applies to tax preparation firms, which the FTC lists among the financial institutions covered by the Rule. Covered firms need a written information security program with measures including multi-factor authentication, encryption, access controls, activity logging and secure disposal. Accounting firms that do not prepare taxes should check with a professional whether their services bring them within the Rule.
What security features should an accounting client portal have?
At minimum: enforceable multi-factor authentication for staff, encryption of stored files and connections, role-based permissions, firm-only folders clients cannot see, an exportable activity log and complete deletion of former clients’ data. These map to Safeguards Rule requirements. Ask vendors to demonstrate each one rather than relying on phrases such as bank-level security.
Will older clients use a client portal?
Many will, if the portal is simple. Test it on a phone as your least technical client would: count the screens to reach a task, try uploading a photo of a paper form and reset a password. If that takes more than 20 minutes, expect clients to give up and email instead. Offer a short phone walk-through for first-time users.
Can spouses share one client portal login?
They should not need to. Sharing credentials makes it impossible to tell who uploaded or signed what, and it weakens security. Look for a portal that gives each person their own login to the same household or client record, so both spouses can upload documents and each can sign in their own name.
Can clients sign Form 8879 in a client portal?
They can, provided the signing process meets the IRS identity verification requirements for electronic signatures on Form 8879, which include identity checks for remote signers. Not every e-signature tool meets them. Ask the vendor exactly how it handles 8879 signing and what evidence it records, and keep that record with the return.
What is a request list in a client portal?
A request list is a checklist of the specific documents you need from a client, such as a W-2 from a named employer or a 1099-INT from a particular bank. The client uploads against each item, the list updates as items arrive, and automatic reminders chase only what is missing. It replaces long emails listing what to send.
Should clients pay invoices through the portal?
It helps. Paying in the same place they sign and download keeps clients in one login and gives you a clear record. Some portals let you hold final documents until the invoice is paid, which shortens collection time without awkward conversations. Make sure payment terms are agreed in the engagement letter before you use that option.
How much time does a client portal save an accounting firm?
It depends on how much document handling you do now. Count the emails per return, the follow-ups for missing or unreadable files and the minutes each takes. A firm handling eight emails per return at four minutes each spends more than 30 hours per 60 returns. Request lists and automatic reminders typically cut much of that.
What happens to client data if we change portal provider?
Ask before you sign. A good vendor lets you export every client’s files and activity history in a standard format and then deletes your data on request. Under the Safeguards Rule you must dispose of customer information securely when it is no longer needed, so get written confirmation of deletion when you leave.
Do clients need to download an app to use a client portal?
Not necessarily. Many portals run in a web browser on phones and computers, which avoids asking clients to install anything. If the vendor offers an app, test both. What matters is that clients can log in, upload a photo, sign and pay from a phone without needing a desktop computer.
Run this part of your business in one place
Zaquil puts every email, document, approval, invoice, call and automation for your accounting and tax setup in a single workspace — set up for US practices on day one.
- Client portal with document requests, organisers, e-signatures and online payment
- Jobs with templates, checklists and recurring work; invoices and unbilled time
- One inbox for email, chat, SMS, WhatsApp and calls across every brand