Accounting firms handle some of the most sensitive data a business has: bank statements, salaries, identity documents, contracts. Much of it still arrives as e-mail attachments. E-mail is not inherently reckless, but it has specific weaknesses worth understanding.
The real risks of e-mail
- Wrong recipient - autocomplete picks the wrong “Anna”, and a payroll file leaves the firm. This is one of the most common data incidents in small offices.
- Copies everywhere - every attachment lives in the sender's mailbox, your mailbox, your colleagues' forwards and every device synced to them.
- No expiry - documents stay in mailboxes for years, long after you needed them.
- Compromised accounts - a single phished password exposes years of client attachments at once.
- No audit trail - you cannot easily tell who opened or downloaded a document.
What “safer” looks like in practice
- One controlled place for documents, not dozens of inboxes.
- Access per client - each client sees only their own documents.
- Encryption in transit (HTTPS) and at rest.
- Short-lived, single-use sign-in links instead of shared passwords.
- Files that are never public - no open download links that anyone can forward.
- An activity log showing who uploaded, viewed and accepted what.
- Retention rules - documents are deleted when they are no longer needed.
Common alternatives, compared
Password-protected attachments help a little, but the password usually travels by the same channel or is the same for every client. Shared cloud folders are better organised, but links are easy to over-share and permissions drift over time. A client portal built for document collection combines per-client access, encryption and an audit log, and it removes attachments from mailboxes entirely.
Quick wins you can apply today
- Turn off address autocomplete for client contacts, or double-check the recipient on every attachment.
- Enable two-factor authentication on every mailbox in the firm.
- Ask clients not to send identity documents by e-mail.
- Delete old attachments once documents are stored in your accounting system.
- Write down where client documents live and who can access them - you may need it for data protection requests.
This article is general guidance, not legal advice; data protection obligations depend on your country and your engagement terms.
MonthDocs was built around these principles: private, encrypted storage, per-client access, single-use sign-in links, files that are never public and a full audit log.
