A secure mail client for a CPA firm, and the answers a client can ask for

A secure mail client for a CPA firm has a harder job than one on a single desk. The firm holds client tax records in seven or eight mailboxes, not one. Sooner or later a client asks a plain question. “Is my information safe in your email?” The honest answer depends on every seat at the firm, and on whether the firm can say what’s true on each of them.

Most firms are closer than they think. You probably already have two-factor sign-in, a portal and a provider that encrypts the trip. What’s usually missing is the short, written answer that every person at the firm gives the same way. That’s what this guide builds, one client question at a time.

Point reads each person’s mailbox as the mail lands. It sorts it, sets suspicious messages aside, and lets you lock a message end to end. Drafts wait for review by default. It sits inside the setup below rather than replacing it.

The questions clients ask about their records

Clients rarely ask about encryption by name. They ask in their own words, usually after a news story or a scam call. These are the six that reach a partner’s desk:

1. Is my information safe in your email?
2. Who at your firm can read my email?
3. How should I send you my documents?
4. What happens to my email when someone leaves your firm?
5. How long do you keep my email?
6. Would you tell me if something happened?

A seventh arrives as a request rather than a question: “Please send my records to my new accountant.” That one has a deadline, covered below.

Each answer is short. What makes it true is the setup behind it, and at a firm that setup has to hold on every seat.

What a secure mail client covers on every seat

A secure mail client is the app each person uses to read the firm’s mail. At a firm, the useful test is whether it behaves the same way for the partner, the senior and the seasonal preparer. One unprotected laptop is the firm’s answer, whatever the partner’s own setup looks like.

Here’s what each layer of a firm’s mail protects:

A sole practitioner covers all four rows alone. A firm splits them, so each row needs a name next to it.

The single-desk version of this, phone and laptop included, is in a secure email client for an accountant who holds clients’ tax data. Attachments, portals and which version of a file the firm works from are in email attachments for CPA firms.

“Is my information safe in your email?”

The answer you can give starts with the law, because a firm holding tax records is regulated here. The FTC Safeguards Rule defines who it covers, and 16 CFR 314.2 names your firm directly:

An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution because tax preparation services is a financial activity listed in 12 CFR 225.28(b)(6)(vi)

So the Safeguards Rule applies to you at any size. The IRS says the same thing in plainer words:

Protecting client data also is the law. Federal Trade Commission regulations require professional tax preparers to create and enact security plans to protect client data.

That plan is the written information security plan, or WISP. The IRS publishes a template for it in Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice.

Two rules in 16 CFR 314.4 decide most of what a client means by “safe.” The first is sign-in:

Implement multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls

The rule says “any individual.” That’s every staff mailbox, not only the partners’. The second is encryption:

Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest.

Your provider handles most of the trip and the stored mailbox. The gap is usually a file sent as a plain attachment, which is why the firm needs one rule for sensitive files.

A fair answer to the client sounds like this:

“Every mailbox here needs a second step to sign in. Our mail is encrypted on the way and where it’s stored. Anything with your Social Security number goes through our portal, never as a plain attachment. It’s all in a written security plan, and I’m the partner responsible for it.”

Only say what’s true at your firm. If one of those sentences isn’t true yet, that’s the first thing to fix.

“Who at your firm can read my email?”

Clients want to hear a short list. IRS Publication 4557, Safeguarding Taxpayer Data, gives you the principle:

Limit access to taxpayer data to individuals who need to know.

At a firm, mail reaches more people than the address suggests. Delegate access, a partner reading a colleague’s mailbox, a shared address and an auto-forward all widen the list. Write each one down. When a client asks, the honest answer is “the people on your engagement, and the partner over it.” If anyone else can read it, they should be on the same written list.

The Safeguards Rule also asks you to be able to see who did what:

Implement policies, procedures, and controls designed to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information.

Microsoft 365 and Google Workspace both keep sign-in and mailbox records for admins. A tool that reads your mail should keep its own record too. Point keeps an activity log of everything it does in your mailbox, and you can undo it from there.

Reading another mailbox you’ve been given access to is covered in every mailbox one partner reads. One mailbox that several people answer is a separate setup, covered in one mailbox, two accountants.

“How should I send you my documents?”

This one needs a single answer, given the same way by everyone at the firm. If the partner says “the portal” and a preparer says “just email it,” the client learns that email is fine.

Publication 4557 gives the firm a line it can repeat:

A legitimate business will never email and request personal or sensitive information be sent to them via email, unless through a secured mail service.

That sentence protects the client twice. They know where to send documents. They also know that an email from “your firm” asking for a Social Security number is suspect.

For outbound files, the same publication says:

Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email.

Most firms put the route in three places:

• The engagement letter. One sentence on how documents come in and go out.
• Every staff signature. The portal link and a line saying the firm won’t ask for sensitive numbers by email.
• The first reply to a new client. Before any documents move.

Clients will still email a W-2 now and then. When one arrives, it gets filed to the client’s record and the client gets a kind note pointing to the portal. Nobody forwards it on in the clear.

“What happens to my email when someone leaves your firm?”

Clients ask this when the person they worked with moves on. The answer is the same-day routine your firm runs when anyone leaves. Publication 4557 sets the standard:

Prevent terminated employees from accessing customer information by immediately deactivating their passwords and user names and taking other appropriate measures.

For mail, that routine has five steps, done on the person’s last day:

1. Block sign-in to their account and sign them out of every device.
2. Remove any app access they granted to their mailbox, including AI and mail tools.
3. Remove their delegate access to anyone else’s mailbox.
4. Turn their mailbox into one the firm keeps, with a named person reading it.
5. Tell clients on their engagements who looks after them now.

Steps 1 to 3 close the door. Steps 4 and 5 keep the client’s history with the firm, where it belongs. Seats and licenses for the departing person are covered in team and admin. Picking up a thread a colleague started is covered in a thread you didn’t start.

“How long do you keep my email?”

Two federal rules pull in opposite directions, and the firm’s answer sits between them.

The first sets a minimum. Under 26 U.S.C. 6107(b), a preparer must, for three years after the close of the return period:

retain a completed copy of such return or claim, or retain, on a list, the name and taxpayer identification number of the taxpayer for whom such return or claim was prepared

The second sets a limit. The Safeguards Rule at 16 CFR 314.4(c)(6) asks for:

secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates

That limit has exceptions in the rule. They include information needed for business operations, information the law requires you to keep, and cases where targeted disposal isn’t reasonably feasible. Email often falls in the last group, because client data sits inside threads about everything else.

So the firm picks one retention period, writes it in the WISP and applies it to mail like any other record. Then the answer to the client is a number. “We keep your mail for seven years after our last engagement, then delete it” is a full answer, if it’s what you do. The longer policy question, and what a notice on your email should say, belongs to email confidentiality and compliance.

“Can I have my records back?”

A records request is the one question here with a deadline attached. The AICPA’s Records Requests interpretation, ET sec. 1.400.200, says:

Where a member is required to return or provide records to the client, the member should comply with the client’s request as soon as practicable but, absent extenuating circumstances, no later than 45 days after the request is made.

For anyone practicing before the IRS, Circular 230 section 10.28 adds:

A practitioner must, at the request of a client, promptly return any and all records of the client that are necessary for the client to comply with his or her Federal tax obligations.

The clock starts when the request lands, in whichever mailbox it lands in. At a firm, that’s often a preparer’s, under a question about something else. Three habits keep it safe:

• One owner. Every records request goes to one named person, usually a partner.
• A date on the day it arrives. The request’s date is the start of the clock, so it’s written down with the task.
• The reply in the same thread. The firm’s response dates itself next to the request.

Point picks a records request out of the thread and writes it down as a task with the date it arrived. It stays on the list until someone closes it. Fee disputes, state board rules and which records count are covered in how soon a CPA must return client records.

“Would you tell me if something happened?”

The answer is yes, and the rules say how. The Safeguards Rule defines the event in 16 CFR 314.2:

Acquisition of unencrypted customer information without the authorization of the individual to which the information pertains.

The word “unencrypted” matters. Mail and files that were encrypted when taken don’t count as a notification event. Then 16 CFR 314.4(j)(1) sets the clock:

if the notification event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event.

A firm holding customer information on fewer than 5,000 consumers skips a few parts of the rule by 16 CFR 314.6. One of them is the written incident response plan. The FTC notice still applies, so it’s worth a page in the WISP anyway.

The IRS also asks for a call. Its data theft page tells tax professionals to report client data theft to their local IRS stakeholder liaison, so the IRS can watch for fraudulent returns. The same page covers state attorneys general, law enforcement and the letter to each affected client.

Email is often where the first sign shows up. Publication 4557 lists this among the warning signs of data theft:

Tax professionals or clients responding to emails that practitioner did not send.

So a client who writes “Did you just ask me for my bank details?” is a report, and it goes to the partner named in the plan the same day.

The answer sheet the firm keeps

Put the answers on one page, next to the WISP. Everyone at the firm reads it once, and the person named in the plan keeps it current.

A firm that can fill in the third column honestly can answer any client who asks.

How Point holds a firm’s client mail

Point reads the mailbox each person already has, so the firm’s provider and its controls stay as they are. Here’s what that adds for a firm holding tax records:

• Sign-in stays with your provider. Each person connects by signing in at Google or Microsoft. The grant can be canceled from the provider account, which makes it part of step 2 when someone leaves. Where your email credentials are kept has the details.
• The copy Point holds is protected. Point’s privacy policy lists “encryption in transit and at rest where supported,” with access controls and limits on human access.
• A message can be locked end to end. There’s a lock in the composer. The message is sealed on the sender’s device and opens only on a device that holds the key. Point can’t read a locked message, so it carries no summary and no tasks. Encrypted messages covers when the lock fits and when the portal does.
• Suspicious mail waits at the door. Risky messages are set aside before they reach anyone’s feed, and kept away from the AI. Keeping suspicious mail away from AI explains how.
• Every action is on the record. The activity log shows what Point did in each mailbox, and you can undo it.
• Replies wait for a person. Point drafts a reply in your voice. By default it waits until someone reads it and presses send, and it goes from that person’s own address.

What Point reads and keeps, in the terms a firm’s security plan needs, is in is it safe to put client data near AI.

The full list of what Point handles for a firm is on the benefits page.

Where a portal or another tool does the job

Point works from each person’s own mailbox. Some of a firm’s needs sit elsewhere:

• Finished returns and organizers. A client portal does this better than any mail client, because the file never sits in the client’s inbox.
• A mailbox built around encryption. Providers such as Proton Mail build the whole mailbox around encryption. That’s a change of provider for every seat, and worth deciding on its own terms.
• One address that several people answer. Practice management software built around shared email fits that job.

Most firms run a portal and a mail client together. The portal carries the numbers, and the mail carries the conversation.

Common questions

What is a secure mail client?

A secure mail client is the app you use to read and send email that protects your end of it. It signs in through your provider with a second step, stores its copy encrypted, and keeps previews off a locked screen. It often lets you encrypt a single message as well. At a CPA firm, it has to work the same way on every person’s devices.

Does the FTC Safeguards Rule apply to a small CPA firm?

Yes. 16 CFR 314.2 names an accountant or tax preparation service that completes income tax returns as a financial institution. Under 16 CFR 314.6, a firm below 5,000 consumers can skip a few parts, such as the written incident response plan. They still need a written information security plan, multi-factor sign-in and encryption.

Can a CPA firm email tax documents to clients?

Not as plain attachments. IRS Publication 4557 says to send only password-protected and encrypted documents by email, or to use secure file transfer. The Safeguards Rule requires customer information to be encrypted in transit over external networks. Most firms send returns through a portal and use email for the conversation.

Who at a CPA firm should be able to read a client’s email?

Only the people who need to. IRS Publication 4557 says to limit access to taxpayer data to individuals who need to know. In practice, that’s the staff on the engagement and the partner over it. Write down every delegate, shared address and forward so you can give the client a true answer.

How long should a CPA firm keep client emails?

Federal law requires a preparer to keep a copy of each return, or a list of clients, for three years after the close of the return period under 26 U.S.C. 6107(b). The Safeguards Rule asks for secure disposal two years after information was last used, with exceptions for business need and legal requirements. Most firms set one retention period in their written security plan and apply it to mail.

How soon must a CPA return a client’s records after receiving the request?

The AICPA Code sets an outer limit of 45 days from the request, and expects the records back sooner where that’s practicable. Its rule is the Records Requests interpretation, ET sec. 1.400.200. Anyone practicing before the IRS must also return client records needed for federal tax compliance promptly, under Circular 230 section 10.28. The email’s date starts the clock. Give each request one owner and a dated task the day it arrives.

Does a CPA firm have to report an email breach?

If unencrypted customer information on at least 500 consumers is taken without authorization, 16 CFR 314.4(j) requires notice to the FTC within 30 days of discovery. The IRS asks tax professionals to report client data theft to their local IRS stakeholder liaison. State notification laws can apply too, so check each state where you prepare returns.