How to Send Documents Securely to Clients (and Get Them Back)

Tax returns, contracts, ID documents, payroll files, bank statements. Professional services firms move sensitive documents every day, and most of them still travel as email attachments.

This guide covers the practical options for sending documents securely, the habits that cause most leaks, and how to collect documents from clients without a trail of attachments in everyone's inbox. It's written for accountants, law firms, consultants and agencies, but the principles apply to anyone handling client files.

Why email attachments are the weak point

Email is convenient, but it's a poor place for sensitive files:

• Copies multiply. Every attachment sits in your sent folder, the client's inbox, and any backups or devices those accounts sync to.
• Wrong recipient is easy. Autocomplete picks the wrong "James", and the file has gone.
• No control after sending. You can't revoke access, set an expiry or see whether the file was opened.
• Forwarding is invisible. A client forwards your letter to a colleague, who forwards it on. You won't know.
• No context. An attachment called "scan_0042.pdf" doesn't say which request it answers or whether it's the final version.

Email is fine for telling a client a document is ready. It's not the best way to deliver the document itself.

Five ways to send documents securely

There's no single right answer. Pick the option that matches the sensitivity of the file and how often you exchange documents with that client.

1. A client portal

A client portal gives each client a private, logged-in space where you share documents and they upload theirs. Files stay in one place, tied to the client and the request, instead of scattered across inboxes.

Best for: firms that exchange documents with the same clients repeatedly, such as accountants, law firms and agencies.

Check: how clients sign in, who on your team can see each client's files, what happens to files when an engagement ends, and what the vendor states about encryption, hosting location and compliance.

2. A secure file-sharing link

Services like business cloud storage let you share a link instead of an attachment. Use the settings that matter: restrict the link to named people, require sign-in, set an expiry date and turn off downloads if the client only needs to view.

Best for: one-off large files, or clients you rarely exchange documents with.

Watch out for: "anyone with the link" sharing, which works like an unlocked attachment that never expires.

3. Encrypted email

Many email providers offer encryption or a "confidential" mode, where the recipient verifies their identity before opening the message.

Best for: occasional sensitive messages when the client already uses the same email system.

Watch out for: recipients who can't open the message, and the same lack of context as any other email.

4. Password-protected files

Protecting a PDF or archive with a password is better than nothing, provided the password travels separately: by phone or text, never in the same email.

Best for: a quick fix when nothing else is available.

Watch out for: weak passwords, and passwords reused across every client.

5. E-signature platforms

If the document needs signing, send it through an e-signature service. The client signs without downloading, printing or scanning, and you get a completed copy with a signing record.

Best for: engagement letters, contracts and authorisations.

How to receive documents securely from clients

Sending is half the problem. Most firms find collecting documents harder: clients email them in batches, send the wrong version, or forget half of them.

1. Ask for exactly what you need. "Bank statements" invites a guess. "Business current account statements, 1 April 2025 to 31 March 2026, as PDF" doesn't.
2. Give clients one place to upload. A request with clear instructions and an upload space beats "reply with attachments".
3. Don't ask for sensitive files too early. Collect documents after the client has agreed to work with you. Keep your first client intake form to contact details and the shape of the work.
4. Never ask for passwords. If you need access to a client's accounting software, bank feed or website, ask them to invite you with your own login. Don't collect credentials in a form or an upload.
5. Review what arrives. A file being uploaded doesn't mean the request is complete. Check it's the right document, the right period and readable before marking it done.
6. Tidy up. Agree how long you'll keep documents and remove copies you no longer need, in line with your professional and legal obligations.

A simple policy your team can follow

You don't need a long policy document. A one-page agreement your team actually follows does more:

• Sensitive client documents are shared through [our chosen tool], not as email attachments.
• Shared links are restricted to named people and have an expiry date.
• Passwords for protected files are sent by a separate channel.
• We never ask clients for passwords, recovery codes or full card details.
• We confirm the recipient before sending anything sensitive.
• When someone leaves the team, their access is removed the same day.

If you work in a regulated profession, check this against your regulator's guidance and your data protection obligations. Requirements for client confidentiality, identity checks and record retention vary by profession and country.

What to look for in a secure file sharing client portal

If you're choosing a portal for document exchange, ask vendors:

• Access: how do clients sign in, and can you control which team members see which client?
• Requests: can you ask for specific documents with instructions, or is it just a shared folder?
• Review: can your team mark a document as reviewed, not just received?
• Records: can you see who uploaded what and when?
• Security and compliance: what does the vendor state, in writing, about encryption, hosting location, certifications and data processing agreements? Ask for documentation rather than relying on a badge on the homepage.
• Exit: how do you export your data if you leave?

For shortlists by profession, see our guides to the best client portals for accountants and the best client portals for law firms.

Where Angelwood fits

Angelwood's document requests are built around the collection problem. Each request explains which document you need, what it's for and the format your team can use. Clients upload against that request, so the file keeps its context, and your team can see what has arrived and what still needs a review before it's marked ready.

Angelwood is focused on the client-facing work around an engagement: onboarding, document requests and reviewed project updates. If you have specific security or compliance requirements, ask us for details before you commit, and compare them with the questions above.

FAQ

What is the most secure way to send documents to a client?

Use a method that keeps the file out of email and lets you control access: a client portal with individual client logins, or a sharing link restricted to named people with an expiry date. For documents that need a signature, use an e-signature platform.

Is it safe to email sensitive documents?

Email isn't designed for sensitive files. Copies stay in multiple inboxes, attachments can go to the wrong person, and you can't revoke access afterwards. Use email to notify the client and deliver the file through a more controlled channel.

How do I get clients to send documents securely?

Give them one place to upload, with a clear list of exactly what you need and why. Don't ask them to email attachments, and never ask for passwords; ask them to invite you to systems with your own login instead.

What is a secure file sharing client portal?

A private, logged-in space for each client where you and the client exchange documents. Unlike a shared folder, a good portal ties each file to a request, shows what's outstanding and lets your team review what's been received.

Is a password-protected PDF secure enough?

It's better than an unprotected attachment if the password is strong and sent separately. For regular exchanges of sensitive documents, a portal or restricted sharing link is easier to manage and gives you more control.