A secure email client for accountants looks after the copies of client mail on your own devices and the sign-in that guards them. If you prepare returns, your mailbox already holds W-2s, K-1s and bank statements. That’s normal, and it’s manageable. A secure setup comes down to four pieces: encryption, a second factor at sign-in, a habit for phishing, and a portal for what you send out.
Each piece has its own job, and none of them is hard. This page takes them in the order they matter for a practice of one. First, what’s actually in your mail. Then where it can be read, what the federal rules ask, and how to spot the mail that’s after your logins. Last come the questions to ask of any email client before it holds tax data. Point is one of those clients, and it has its own section near the end.
What a tax practice holds in its mail
By October your mailbox holds a year of other people’s financial lives. Most of it arrived because a client hit reply.
| What arrives | Usually as | What’s on it |
|---|---|---|
| W-2s and 1099s | A phone photo or a PDF attachment | Social Security number, employer, income |
| K-1s | A PDF forwarded from the partnership | Partner’s identifying number, share of income |
| Bank and brokerage statements | PDF attachments, sometimes a screenshot | Account numbers, balances |
| Direct deposit details | A line typed into a reply | Routing and account numbers |
| ID for verification | A photo of a driver’s license | Name, address, date of birth |
| IRS notices | A scan of the letter | Name, tax year, notice details |
| Last year’s return | A PDF from a client who changed preparers | All of the above, in one file |
Two things stand out. Almost all of it is inbound, so the client chose how it traveled. And most of it stays in your mailbox long after the return is filed. Where it lives once it’s read is covered in filing client mail. Which copy of a form you work from is in where client documents land.
Four places a client’s W-2 can be read
A message carrying a W-2 can be read in four places. Each is protected by something different, and somebody different chooses it.
| Where | What protects it | Who chooses |
|---|---|---|
| On the way between providers | TLS, the encryption most providers apply to mail in transit | The sending and receiving providers |
| Stored in your mailbox | Your provider’s encryption at rest, your password, your second factor | You, when you picked a provider and turned on two-factor |
| On your phone and laptop | Device encryption, the screen lock, the app you read in | You |
| In your client’s sent folder | Whatever your client’s account has | Your client |
TLS does real work, and it has one limit. It protects mail only while it travels. LuxSci, which sells encrypted email to regulated businesses, puts it plainly: “Anyone who can access the recipient’s email inbox can read the secure message.” So the copy that sits still matters as much as the trip.
Here’s the one place a mix-up costs something. A secure email client protects the third row. It doesn’t encrypt what a client sends you, and it can’t reach the copy in their sent folder. For mail you send out, sealing the message itself takes encryption on the message, a portal or a secure file transfer. How those differ, and which of them an assistant can read, is in encrypted email, and what an AI assistant cannot read.
What the Safeguards Rule asks of one practitioner
The FTC’s Safeguards Rule applies to a solo preparer. 16 CFR 314.2 says so directly:
An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution.
That brings in the rule’s safeguards. Two of them touch your email client every day. The first is encryption, in 16 CFR 314.4(c)(3):
Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest.
That covers the trip and the copy that sits still. Where encryption is truly infeasible, the rule allows “effective alternative compensating controls” approved by the person who runs your security program. In a practice of one, that person is you.
The second is a second factor at sign-in, in 314.4(c)(5):
Implement multi-factor authentication for any individual accessing any information system.
Your mailbox is an information system under that wording. So is the email app on your phone, because it signs in to the mailbox. A code from an authenticator app or a security key is the usual way to meet it.
Encryption also changes what a breach costs you. The rule defines a notification event as “acquisition of unencrypted customer information” without authorization. If 500 or more people’s information is involved, 314.4(j) asks you to tell the FTC within 30 days of discovery. Data that was encrypted, with the key kept safe, doesn’t meet that definition. If the key was reached too, the rule treats the data as unencrypted.
The IRS guide for tax professionals, Publication 4557 (Rev. 6-2024), puts the same floor in practical terms:
Use separate personal and business email accounts; protect email accounts with strong passwords and two-factor authentication if available.
The rest of the floor belongs to the whole setup: your own domain, retention and the written security plan. That’s in the best email setup for accountants, and none of it changes with the app you read in.
The mail that’s after your logins
Most attacks on a tax practice start in the inbox. The IRS describes the aim as getting you to give up “computer passwords, e-Services passwords, to steal your EFINs or CAF numbers or even to take remote control of your entire computer system.” The prize is your clients’ data, used to file false returns in their names.
The shapes repeat, so they’re learnable.
- The new client. Somebody you’ve never heard from asks for help with their taxes and attaches “their documents.” The IRS warned about this one by name. The attachment or link is the attack.
- The IRS that isn’t. A message about your EFIN, your e-Services account or a “suspended” credential, with a link to sign in.
- The software update. A note that looks like your tax software or your provider asking you to confirm your login.
- The known client, slightly off. A familiar name from an address that’s one letter different, asking you to change where a refund goes.
The habit that handles all four is short. Publication 4557 says it in one line:
Never open an embedded link or any attachment from a suspicious email.
A real new client can wait while you check them. Reply to ask for a phone call, or send them your portal link so the documents arrive there. For anything that claims to be the IRS or your software, go to the site yourself instead of following the link.
If something gets through, report it fast. The IRS asks tax pros to forward suspicious mail to phishing@irs.gov. After data theft, contact your local IRS Stakeholder Liaison. In the IRS’s words, “If reported quickly, the IRS can block fraudulent returns in clients’ names.” Publication 5293 gathers the rest of the steps in one place.
The W-2 that arrives as a photo anyway
You can ask clients to use the portal. Some will still reply with a photo of a W-2 taken on the kitchen table. That’s fine, and you don’t have to send it back.
Publication 4557 asks you to “caution customers against transmitting sensitive data, like account numbers, via email.” Asking once, kindly, is enough. After that, what you control is where the photo goes next.
- It stays in one account. The practice mailbox, behind your password and your second factor. It doesn’t get forwarded to a personal address to read later.
- It doesn’t travel on in the clear. If a copy has to go to someone else, it goes through the portal or as a protected file.
- It lands in the client’s file. Once it’s filed, the inbox isn’t the only place it lives.
- Next time is easier. Managing client document requests covers how to ask so documents arrive the right way the first time.
Handing off to the portal
A portal is the better route for anything you send out that carries a client’s numbers. The file stays on the portal’s side, the client signs in to fetch it, and email carries only the notice that it’s there. Publication 4557 sets the same order:
Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email.
Email stays the right route for the conversation around the file.
| What you’re sending | The better route |
|---|---|
| A copy of the finished return | The portal |
| Form 8879 or another form to sign | The portal, or your tax software’s e-signature |
| A list of documents you still need | Email, with no numbers in it |
| A question about one figure | Email, naming the form rather than quoting the full number |
| A note that the return was filed |
Pick one portal and use it every time, so clients know where to look. Mail keeps arriving beside it, and that’s fine. Clients reply to the portal’s notice instead of logging in, and the reply lands in your inbox. That’s the mail your email client is protecting.
The phone and the laptop
Most solo practitioners read client mail on two devices. The email client matters, and so does the device under it.
On the phone. Android requires every device launching with Android 10 or later to use file-based encryption (Android Open Source Project). A recent phone already encrypts what it stores. Two things are still yours.
- The screen lock. Encryption protects a lost phone best when the phone is locked. A PIN or a fingerprint is the minimum for a phone with client W-2s on it.
- What the lock screen shows. A notification banner can show a line of a client’s message to a table full of people. Set previews to show the sender only, or nothing, while the phone is locked.
On the laptop. Publication 4557 notes that Windows and Mac “come with factory-installed security software and with encryption technology.” Check that drive encryption is on for the laptop you prepare returns on. Its job, in the IRS’s words, is to protect information on devices that are “lost, stolen or improperly discarded.”
If a device goes missing. The fastest step is at your email provider. Sign the lost device out of your account there, and change the password if it was saved anywhere. An email client that signed in through your provider is cut off the same way.
Choosing a secure email client for accountants
Whichever app you choose, a handful of answers decide whether it suits a practice that holds tax data. Ask each vendor these before you connect your mailbox.
| Question | A good answer sounds like |
|---|---|
| How does it sign in? | Through your provider’s own sign-in page, so the app never holds your password and you can cut it off from your account |
| Does your second factor still apply? | Yes, because the sign-in happens at your provider |
| What does it encrypt? | Any copy it keeps, in transit and at rest, stated in its policy |
| Who at the company can read your mail? | Written limits on staff access |
| What happens to suspicious mail? | Risky messages are set aside before you open them |
| Can a message be sealed end to end? | Yes, and the vendor says plainly between whom |
| What does it do with client content and AI? | A clear statement you can hold it to |
The last row is a question of its own. Whether an assistant should see client financial data at all is taken up in is it safe to use AI with client financial data?. The questions to ask an AI tool is the list to send a vendor.
How Point holds a tax practice’s mail
Point reads the mailbox you already have. Your address and your provider stay as they are, and so does your second factor. Here’s what a day with tax data in it looks like.
- You sign in at Google or Microsoft. Point never sees your password. It keeps the grant in a guarded place, and you can withdraw it from your provider account any time. Where your email credentials are kept has the details.
- Point’s own copy is protected. The privacy policy lists “encryption in transit and at rest where supported,” with access controls, least privilege and limits on human access. The same documents say plainly that “No method of transmission, storage, or processing is completely secure.”
- The new-client attachment waits. Risky mail is set aside before it reaches you. A sender Point doesn’t know is held rather than read into anything, so a stranger can’t instruct your inbox. You decide about it when you’re ready. Keeping suspicious mail away from AI explains how.
- Some mail can be sealed. The composer has a lock. The message is sealed on your device, Point’s servers carry it sealed, and it opens on a device that holds the key. Point can’t read it, so it writes no summary and finds no tasks in it. For a client who reads mail in an ordinary inbox, the portal is still the route for documents.
- Replies wait for you. Point can draft a reply to a client. Unless you’ve changed the setting, it waits until you’ve read it and pressed send, and it goes from your own address.
- Your phone stays in step. On Android, Point is one column and three tabs. File a thread there and your mailbox files it too.
The full list is on the benefits page.
When something else fits better
A secure email client is right for the mail you’ll always get. Some needs sit elsewhere.
- Sending finished returns. A portal does this better than any email client, because the file never sits in your client’s inbox.
- Large files to another firm. Publication 4557 names Secure File Transfer Protocol for this. If you send files to other professionals often, a file transfer service may suit you better than attachments.
- A mailbox built around encryption. Providers such as Proton Mail build the mailbox itself around encryption. That’s a change of provider, and your address moves with it. It’s a bigger decision than choosing an app, so make it on its own terms.
Common questions
What is the most secure email client for accountants?
The one that signs in through your provider, keeps your second factor in force, encrypts any copy it holds and sets suspicious mail aside. Pair it with drive encryption on your devices and a portal for outbound documents. No email client covers a client’s own inbox, so the portal does that part.
Is Gmail secure enough for clients’ tax documents?
Google says that “All Gmail messages use TLS automatically.” That protects the trip. With two-factor on, the copy in your mailbox sits behind your password and your second factor. Outbound files are different. Publication 4557 asks you to send only password-protected and encrypted documents by email, or to use secure file transfer instead. A portal is the usual answer.
Do accountants need encrypted email?
The Safeguards Rule asks you to encrypt customer information in transit and at rest. TLS and your provider’s storage cover much of that for mail you receive. For files you send, encrypt the file or use a portal. Encryption also matters after a breach, because encrypted data with a safe key isn’t a notification event under the rule.
Does the Safeguards Rule require two-factor authentication on my email?
Yes. 16 CFR 314.4(c)(5) asks for multi-factor authentication for anyone accessing any information system. Your mailbox counts, and so does every app that signs in to it. Publication 4557 asks the same for email accounts specifically.
What should I do with an email from a new client I don’t know?
Don’t open the attachment or the link. Reply to ask for a call, or send your portal link so the documents arrive there. If it’s a phishing attempt, forward it to phishing@irs.gov.
Can I let clients email me their W-2s?
Many will, whatever you ask. Publication 4557 asks you to caution clients against emailing sensitive data like account numbers. Point them to your portal. When a W-2 arrives by email anyway, keep it in your practice mailbox and file it to the client.
Can Point read a message I’ve locked?
No. A locked message is sealed on your device and opens on the device that holds the key. Point’s servers carry it sealed, so the message carries no summary and no tasks.