Guide for Tax Professionals

Secure File Transfer for Tax Preparers

Whether you're a solo enrolled agent, an H&R Block franchisee, or running a multi-preparer firm, your clients are trusting you with their most sensitive data. Here's how to protect it during tax season and destroy it when you're done.

View pricingSee all features

IRS requirements for tax preparers

IRS Publication 4557, "Safeguarding Taxpayer Data," is not optional guidance. It outlines the data security plan every tax preparer is required to implement under federal law (Gramm-Leach-Bliley Act, FTC Safeguards Rule).

Failure to protect taxpayer data can result in IRS penalties, FTC enforcement actions, state-level fines, and personal liability for data breaches. Here are the core technical requirements:

Encryption of taxpayer data

Pub 4557 requires encryption of PII both in transit and at rest. This includes SSNs, financial records, and any data that could identify a taxpayer. Standard email does not meet this requirement.

Access controls & authentication

You must limit access to taxpayer data to authorized individuals only. This means unique credentials, not shared logins, and the ability to restrict who can view or download specific documents.

Audit trail & activity logging

The IRS expects you to be able to demonstrate who accessed what data and when. A written data security plan must include procedures for monitoring and logging access to taxpayer information.

Data disposal & destruction

Pub 4557 explicitly requires proper disposal of taxpayer data after your retention period. Simply deleting a file is not sufficient. You need a verifiable destruction process.

Source: IRS Publication 4557 (Rev. 2024). This is a summary, not legal advice. Consult with a compliance professional for your specific situation.

The tax season file transfer workflow

From document collection through post-season cleanup, every step is encrypted and auditable.

1

Collect documents from clients

Send a secure upload link to your client. They upload W-2s, 1099s, bank statements, and prior returns through an encrypted portal. No account required on their end.

2

Prepare returns securely

Download client documents from the encrypted box. All files are protected with AES-256-GCM encryption at rest. Full audit trail tracks every access.

3

Deliver returns with payment gate

Upload completed returns and set a payment gate for your preparation fee. Client pays via Stripe before downloading. No more chasing invoices.

4

Auto-destruct post-season

Set deadlines aligned with your retention needs. After the deadline, encryption keys are destroyed and taxpayer documents become permanently unrecoverable.

Why email isn't enough

Most tax preparers know email isn't ideal. Here's why it's actually a compliance liability.

Unencrypted SSNs in transit

Standard email sends Social Security numbers, EINs, and bank account numbers as plaintext. A single intercepted email exposes your client to identity theft and you to liability.

No audit trail

You cannot prove who accessed a document, when it was downloaded, or whether it was forwarded to a third party. If the IRS or a client asks, you have no records.

No data destruction capability

Once you send an email, you lose control of the attachment. It lives in sent folders, recipient inboxes, backup servers, and forwarded threads indefinitely.

Forwarding and CC risk

Clients forward tax documents to spouses, assistants, or the wrong email address. One mistyped address sends an entire tax return to a stranger.

How DeadVault fits the tax prep workflow

Each tax prep need maps directly to a DeadVault feature. No workarounds, no improvising.

What you needHow DeadVault handles it
Collect W-2s, 1099s, and bank statementsEncrypted upload portal with no client account required
Gate return delivery on paymentStripe-powered payment gates on any drop
Destroy data after tax seasonCryptographic erasure: encryption keys are destroyed on deadline
Meet IRS Pub 4557 encryption requirementsAES-256-GCM encryption on every file, in transit and at rest
Prove who accessed what and whenComplete audit trail with timestamps and IP logging
Brand the client experienceCustom branding with your firm logo and colors

Note on compliance: DeadVault's architecture is designed to meet the technical requirements outlined in IRS Publication 4557. It is not "IRS certified" (no file transfer product is). Pub 4557 compliance requires a comprehensive data security plan that includes technology, policies, and training.

Frequently asked questions

Common questions from tax preparers evaluating secure file transfer solutions.

DeadVault's architecture is designed to meet the technical requirements outlined in IRS Publication 4557: encryption of taxpayer data at rest and in transit, access controls, audit logging, and verifiable data destruction. However, Pub 4557 compliance also requires a written data security plan, employee training, and physical security measures that are outside the scope of any software tool. DeadVault handles the technology layer; you still need the organizational policies.
Yes. DeadVault plans are month-to-month with no annual commitment required. Many tax preparers subscribe from January through May and cancel after extension season wraps up. Your account data is preserved if you resubscribe the following year.
When a box's deadline expires, the per-file encryption keys are permanently destroyed through cryptographic erasure. This makes the encrypted files mathematically unrecoverable, even by us. This is the same principle used by enterprise data destruction: rather than trying to overwrite every copy of a file, you destroy the only key that can decrypt it.
No. Clients receive a secure link and can upload or download documents directly. They never need to create a DeadVault account, remember a password, or install any software. You can add PIN protection for an extra layer of security.
When you create a box to deliver completed returns, you set a payment amount. The client sees the box contents are ready but must pay via Stripe before downloading. Funds are deposited directly to your connected Stripe account. Once paid, the download unlocks immediately.
You can grant one deadline extension per box. The extension adds half the original duration, up to a hard cap of 45 days from the box creation date. This gives clients breathing room without leaving documents exposed indefinitely.
Every file is encrypted with AES-256-GCM (Galois/Counter Mode), which provides both confidentiality and authenticity. Each file gets its own unique encryption key, and those keys are wrapped with a master key stored separately. This is not a marketing claim. It is the actual cryptographic implementation.

Protect your clients. Protect your practice.

Subscribe for tax season, cancel when you're done. No annual contracts, no setup fees. Set up your first secure drop in under 2 minutes.

Get startedView pricing