Sharing client documents securely: how your firm sets it up

Why are email attachments and chat apps risky for client documents?

Email attachments and chat apps are risky because you do not control where a document ends up, who can see it and how long it exists. An email is easily sent to the wrong recipient, for example through address autocomplete. According to the Dutch Data Protection Authority (AP), sending personal data to the wrong addressee is a data breach, and whether you must report it depends on the risk to the people concerned.

On top of that, after a few months attachments are stored in many places: the client's inbox, a team member's inbox, forwarded emails and download folders. With chat apps on a team member's private phone, the firm also has no view of the chat history and cannot clean it up when that person leaves. And a loose document is not linked to the administration or the client question it belongs to.

• Wrong recipient through a typo or autocompleted address.
• Copies in inboxes, forwarded emails and download folders.
• Chat history on private phones that the firm cannot see.
• No access control: whoever has the email or chat has the document.
• No link to the administration, so documents get lost.

How do you set up secure document sharing with a portal or app?

You set up secure sharing by choosing one fixed channel, such as a client portal or app, and deciding per user who can see and do what. A client with several companies gets access to those companies, and one of the client's employees might only get access to the client questions of one company. On the firm's side, you only see the administrations assigned to you.

A fixed channel only works if it is the only channel. Agree that financial documents are no longer emailed as loose attachments, and kindly redirect clients who still do so to the portal. Review access periodically: a departed employee of the client or the firm should no longer have access. For the portal supplier, also check the terms of the data processing agreement.

1. 1Choose one fixed channel for documents, such as a client portal with an app.
2. 2Give every user their own account instead of shared login details.
3. 3Set permissions per user and per company.
4. 4Connect sources such as the client's mailbox or cloud storage, so forwarding is no longer needed.
5. 5Agree that financial documents are not sent as loose email attachments.
6. 6Review periodically who has access and revoke it when someone leaves.

How long do you keep client documents and who may access them?

According to the Belastingdienst, a business must keep its records for 7 years, and 10 years for data about real estate. Core records such as the general ledger, accounts receivable and payable and the purchase and sales records must always be kept for 7 years. The retention obligation lies with the business, so with your client, even when the firm keeps the books. So record where the source files are stored and who keeps them.

The GDPR works the other way: you do not keep personal data longer than necessary. According to Ondernemersplein, keeping it longer than the statutory period requires a good reason. Also check whether each copy is needed: an invoice that is in the portal and the accounting software does not also need to stay in a team member's download folder or mailbox. That limits the number of places where a breach can occur.

How do you spot fake invoices and changed IBANs?

You spot fake invoices mainly by deviations from what is normal: an unknown supplier, an unusual amount, urgency in the tone or a different account number for a known supplier. A common form is an email that looks like it comes from a regular supplier, announcing that the bank account has changed. If such an invoice is paid without checking, the money often cannot be recovered.

The key rule: always verify a changed IBAN through contact details you already had, such as a phone number from earlier correspondence or the supplier's website, and never through the number or address in the same email. Software can help by checking the IBAN and flagging deviations, but the client decides on the payment. Signs to watch for:

• A different IBAN than before for the same supplier.
• A bank account in a different country from where the supplier is based.
• An invoice from a supplier the client has no relationship with.
• A different amount, invoice number or layout compared with earlier invoices.
• Pressure to pay quickly, or a request not to discuss the change by phone.
• A sender address that is slightly different from the known domain.

What do you tell clients about delivering documents securely?

Tell clients at the start, and again now and then, which channel to use for documents and what the firm will never ask for. The clearer the agreement, the faster a client recognises an unusual request. A short message during onboarding and a reminder around busy periods, such as the year-end close, is usually enough.

Keep it practical and concrete. Clients do not need a security course, but they do need to know where to put receipts and invoices, that they should always check a changed bank account by phone themselves and whom to call if in doubt. A few points you can reuse:

• Deliver documents through the portal, the app or the connected mailbox, not as loose attachments.
• We never ask by email or chat for login details or for a payment to a different account number.
• If an invoice from a regular supplier looks different or shows a new IBAN, call the supplier on a number you already had.
• Use your own account and do not share your login details with colleagues.
• Let us know when an employee with access leaves.
• If you doubt a message that appears to come from us, call us on the number you know.

How do Autoboeker's client portal, app and Connect work?

In Autoboeker, the client delivers documents through the client portal or the iOS and Android app, under your firm's name, with bulk upload via drag-and-drop. One account can have access to several companies, with permissions per user, for example only the client questions of company X. On the firm's side there are unlimited users with roles and permissions per administration. Questions, answers and uploads stay linked to the same context. According to Autoboeker's security information, data is encrypted with TLS in transit and AES-256 at rest, and every action is traceable in audit logs.

With Connect, the client links their sources in the client portal: Gmail and Outlook in two clicks, another mailbox via IMAP (including iCloud), WhatsApp for receipts and cloud storage such as iCloud, OneDrive, Dropbox, Google Drive and SharePoint. Each administration also has a purchase and a sales email address, and documents can be fetched from the Exact digital mailbox and from SnelStart. Sources are linked to an administration's portal, so documents arrive in that administration and are matched to an open client question or passed on to AI processing. There, Autoboeker runs checks including an IBAN check and flags deviations, unknown suppliers and duplicate invoices, for all four connected accounting packages.