Client Portals and Cloud Tax Software: How San Antonio CPA Firms Secure Remote Work

Most portal conversations start with the vendor’s security page. My view is that the bigger exposure sits in the logins around the portal, and it grows when preparers work from home, a client’s plant, or a laptop on a Stone Oak patio. That’s the gap. This guide covers who owns each control, what vendors really publish, and how a seasonal workforce changes the job. It’s one piece of our wider look at IT services for accounting firms in San Antonio.

What makes a client portal secure for a CPA firm?

A secure client portal is a login-protected place where a CPA firm and its clients exchange tax documents without email attachments. It encrypts files in transit and at rest, requires multi-factor authentication, gives every person their own account, keeps an activity log, and deletes files on a schedule the firm sets.

Why does the IRS care how files move? Because plain email is a weak way to move a return. Publication 4557, the IRS guide to safeguarding taxpayer data, says to send only password-protected, encrypted documents by email, or to use Secure File Transfer Protocol instead. A portal is that advice made usable for clients who’ve never heard of SFTP. Simple as that.

It likely makes the vendor your service provider under the rule. That matters next.

Who owns portal security, the vendor or the firm?

Both, and the Safeguards Rule splits the job in 3. Under 16 CFR 314.4(f), a tax preparer has to take reasonable steps to pick service providers that can protect customer information, require those safeguards by contract, and periodically assess each provider based on the risk it presents. Select. Contract. Reassess. A firm that stops after the first one hasn’t finished.

Look at one row twice. The rule requires multi-factor authentication for “any individual accessing any information system,” unless your Qualified Individual approves an equal control in writing. Does a client viewing their own return count, given that the IRS guide says to require it for anyone accessing customer information on your system, and 314.4(c)(1) separately mentions customers reaching their own information? It’s a fair question. Our reading is to turn it on for clients too. Confirm that with counsel.

What do portal vendors publish about their own security?

We read the public security pages of 2 well-known portals, Drake Portals and SmartVault, on November 2, 2026. We haven’t audited either product. Everything below is the vendor’s own marketing claim, and a “not mentioned” cell means the page didn’t say, not that the control is missing.

Slow down. Read the table before you read anything into it. The product page doesn’t mention it, but Drake’s knowledge base has an article on multi-factor authentication for Drake Portals, so the page undersells the product. Ask the vendor and read the documentation, not just the marketing page. Both sources are linked, Drake Portals and the SmartVault security page, so you can check whether they’ve changed.

I’m not ranking them. A vendor that publishes more isn’t automatically safer. But a vendor that says nothing about a control hands the question to you, and 314.4(f) says you’re the one who has to ask, so the sensible move is a short email to the vendor with 3 or 4 specific questions, sent before tax season starts. Put it in writing. File the answer.

Does cloud tax software change what you secure?

It moves the perimeter. When tax software, a hosted desktop, or a portal lives in a vendor’s environment, the login is the front door, and a stolen password opens it from anywhere. Cloud tax software security comes down to that login. The IRS tells preparers to always enable multifactor authentication within tax software products and cloud storage services, and Publication 4557 warns that thieves pose as the provider to steal credentials.

Count the layers between a preparer and a return. First the laptop sign-in. Then remote access, whether a VPN or a hosted desktop. Then the tax software or the portal itself. Each one is its own login, and each needs its own second factor. Two of 3 isn’t enough.

Vendors carry duties too. Publication 4557 says online providers must follow the 6 security and privacy standards in IRS Publication 1345, so ask any online tax software vendor how it meets them and keep the answer. Uprite supports Lacerte, ProSeries, QuickBooks, and Sage, including multi-user hosting and permissions, though a bug inside the software still belongs to its vendor.

What does remote access security look like for a San Antonio accounting firm?

It looks like a floor, and the IRS has written it down. A San Antonio preparer might work from an Alamo Heights office on Monday, a client’s plant on Tuesday, and a spare room in Boerne at night, and each of those places needs the same files, the same software, and the same security rules applied the same way. Publication 4557 says multi-factor authentication and a secure VPN should be the minimum standard for remote access to the firm’s network. It also says not to use public Wi-Fi for business email or sensitive documents. Plain enough.

Then comes the laptop. Section 314.4(c)(3) requires encryption of customer information both in transit over external networks and at rest, unless your Qualified Individual approves another control in writing. A stolen laptop with an unencrypted drive is exactly the exposure that rule addresses. Encrypt it. The IRS guide also notes that some firms issue laptops to remote employees to control the environment.

My take is firm-owned laptops for anyone who touches returns. A personal machine can work, but only with antivirus, drive encryption, multi-factor sign-in, and a written telecommute policy, and the written policy is the piece that’s easiest to put off.

What happens to every login when tax season ends?

They pile up. Then they get closed. Bureau of Labor Statistics Quarterly Census of Employment and Wages data shows Bexar County tax-preparation offices employing 968 people in February 2025 and 449 in August, a swing of 519 jobs, or 116% above the August low. Between April and May alone the count fell from 941 to 473, a loss of 468 jobs in 1 month. It climbed back to 771 by December.

That series covers tax preparation services as a whole, so it includes retail-chain offices and not only CPA firms. CPA offices are steadier, at 3,176 jobs in January and 2,892 in December. Your own swing may be smaller. But if you add 5 or 10 preparers each January, you close 5 or 10 sets of accounts each May. Count yours.

Every person who leaves holds a set of logins. Email. A tax software seat. A portal account. An e-signature account. Remote access. A phone with mail. Publication 4557 says to prevent terminated employees from reaching customer information by deactivating their passwords and user names immediately, so our closing order below starts with the accounts that can reset all the others.

1. Disable email and the mobile device first, since that’s where password resets land.
2. Remove the VPN or remote access account.
3. Deactivate the tax software seat and the portal account, and reassign any open client conversations.
4. Close the e-signature account and any shared storage links the person created.
5. Where available, check the weekly EFIN and PTIN return counts, because Publication 4557 says to review them weekly and deactivate unused EFINs.
6. Record who closed what, and when.

It’s an annual job. Put it on the calendar. Uprite’s offboarding checklist reaches tax software, portals, and phones as well as the inbox, since those are the accounts nobody remembers.

Why is email still the weak point around a secure portal?

Because attackers follow the clicks. IRS release IR-2025-88 counted nearly 300 data breaches reported by tax professionals in the first half of 2025, affecting as many as 250,000 clients, and it describes fraudsters posing as prospective clients to push malicious attachments and links. Publication 4557 adds that the sender may pose as your tax software provider, your data storage provider, or the IRS. The FBI’s 2025 Internet Crime Report puts business email compromise at about $3.05 billion in reported losses.

Here’s my take. Your portal’s notification email is the best phishing template an attacker will ever get, because clients are trained to click it in March. So tell clients the exact sender address and subject line, tell them you’ll never ask for a Social Security number by email, and tell them to phone you about any new-client attachment before opening it. The IRS guide says the same about unknown senders. A short call is cheap.

Do small firms get out of the portal rules?

Not the ones that matter. Section 314.6 exempts firms holding customer information on fewer than 5,000 consumers from 4 provisions, which include the written risk assessment, the testing clause, the written incident response plan, and the annual report to the board. It leaves multi-factor authentication, encryption, access controls, service provider oversight, and the FTC breach notice clause in place. By our reading, a 4-person shop owes its portal the same controls as a 40-person one. That’s our reading, not legal advice.

For what the testing clause costs when it does apply, see our guide to accounting firm IT costs in San Antonio. For who enforces each rule, read our piece on IRS cybersecurity requirements for CPAs.

What should you ask a portal vendor or IT provider before April?

7 questions. Put them in writing and file the answers next to the contract.

1. Does every login, staff and client, require multi-factor authentication, and can I see the setting?
2. Where is client data stored, and is it encrypted in transit and at rest?
3. Can I get an independent audit report, and when was it issued?
4. What does the activity log record, and how long is it kept?
5. How do I delete a client’s files, and what happens to them if I cancel?
6. How fast will you tell me about a breach on your side?
7. Who closes seasonal accounts, how fast, and who verifies it?

Question 7 is where managed IT earns its keep. Say a preparer quits on a Wednesday. Somebody has to know which logins that person held and close every one by Thursday. That’s the job of Uprite’s offboarding checklist, and it sits alongside multi-factor authentication on firm-managed devices and conditional access in Microsoft 365. Fully Managed starts at $138 per user per month, with portal and tax software licenses billed separately. If you already employ an IT person, co-managed IT in San Antonio runs from $100 per user. Hold any proposal you’re comparing up against Uprite’s published plan prices.

Client portal security questions from San Antonio CPA firms

Do CPA firms have to use a client portal?

Does the Safeguards Rule require clients to use multi-factor authentication?

Is Drake Portals secure enough for client files?

What should a portal vendor contract say?

How fast must a firm report a portal breach?

Can preparers work from home on personal computers?

When should seasonal accounts be closed?

The rest of the stack sits on our IT services for CPA and accounting firms page, and monitoring costs are in the San Antonio cybersecurity cost guide.