File sharing for accountants looks like a solved problem until you try to solve it with a general-purpose tool. The generic products are built for a team sharing documents with each other, and a practice is doing something structurally different: it is exchanging sensitive records with many separate outside parties who must never see each other, on a repeating annual cycle, with an obligation to know afterwards what was sent and when. That is why practices that adopt a consumer file-sharing tool usually end up with a folder per client, a link management problem and no record of anything. This guide sets out the three requirements a practice actually has, why they point away from the generic tools, and the honest answer about email, which is not that it can be banned overnight.
Requirement one: separation that cannot be got wrong
Every client must see their own records and nothing else, and that must be the default rather than the result of setting permissions correctly each time. Generic tools make sharing easy and separation a configuration task, which is exactly the wrong way round for this use. The failure mode is not dramatic; it is a link that was convenient once and outlived its purpose.
Requirement two: a record of what was sent
A practice needs to be able to say, later, what it sent and received and when. Generic sharing tools show you the current state of a folder, which is a different thing: it tells you what is there now, not what happened. When a client disputes having received a return, current state answers nothing.
Requirement three: revocation that is real
Access has to be removable, immediately and completely, when an engagement ends or a member of staff leaves. Links that were forwarded, downloads already taken and shared logins all defeat this in practice, which is why individual accounts and per-client access beat link sharing for anything that matters.
Questions people ask about file sharing for accountants
Can we just use a mainstream cloud drive?
You can, and many small practices do. Understand what you are accepting: separation becomes a configuration you must get right every time, and you get storage rather than a record of exchanges. For a handful of clients that trade-off is reasonable; at fifty it usually is not.
How do we stop clients emailing records?
Slowly, and by consistently asking through the portal rather than by announcing a ban. Clients follow the channel you use to ask them. What breaks the habit-forming is making an exception, because a single accepted attachment teaches them email still works.
Is encrypted email an alternative?
It addresses transport and leaves everything else: the records still land in one person's mailbox, there is still no request list, and version confusion is unchanged. It is a narrower fix than it appears, and it is usually harder for clients than a portal.