Web Hosting for Accountants

The document nobody should have emailed

Here is the sequence. A prospective client finds your site in January. The contact page says "send us your documents and we will take a look". So they attach last year's return and a completed organiser, both of which carry their social security number, their spouse's, and their children's, and they hit send from a free webmail account.

That file now exists in their sent folder, in your inbox, and on at least two mail servers in between. It will still be there in five years. Nobody encrypted it. Nobody can recall it. If either mailbox is ever breached, and free webmail accounts are breached constantly, that is a disclosure of taxpayer data that traces straight back to a sentence you wrote on your own website.

The uncomfortable part is that the client did exactly what you asked. This is not a client education problem. It is a wording problem on a page you control, and it takes an afternoon to fix.

The same applies to a contact form with a file upload field bolted on. If the form emails you the attachment, you have built the identical problem with extra steps.

What the website should do instead of accepting files

The website's job in this workflow is not to receive documents. It is to hand the client off to something built to receive them, in as few clicks as possible, without them ever seeing an email address as the easier option.

Most firms already pay for that capability inside their tax software or practice management suite. The portal is usually sitting there unused because the link is buried three pages deep and the contact page offers a friendlier alternative.

1. Take the invitation off the site

   Search your own pages for the words attach, email us, and send us. Rewrite every one. "Email us your documents" becomes "upload your documents to the client portal". This single edit does more for your risk position than any product you can buy.

2. Put the portal link where people already look

   Main navigation, contact page, and the footer of every page. If a returning client has to search the site to find it, they will use email, and you will have earned that.

3. Say what happens next in plain words

   First-time users abandon portals because nothing tells them what to expect. Two sentences on the page covering how they get their login and roughly how long the upload takes will save you a season of phone calls.

4. Give the mailbox its own boundary

   Use a real firm address on your own domain, not a free account, and keep it separate from the address on your personal phone. Our business email and Microsoft 365 pages cover the difference between a mailbox that lives with the hosting and one that does not.

5. Write the refusal script

   Somebody will still email you a W-2. Have a saved reply that thanks them, asks them to upload it, and tells them to delete the sent message. Then delete it your end. The habit is the control, not the technology.

Notice that none of these steps is a hosting upgrade. This is the honest shape of the problem in this trade. The hosting is trivial and the wording is everything.

Who should not spend more on web hosting for accountants

If your practice never touches a return, you have a lighter version of everything above. A bookkeeping-only practice still handles bank detail and payroll figures, which deserve care, but the taxpayer-data expectations that sit on preparers are not the same weight. That case is covered on hosting for bookkeepers, and the short difference is this: bookkeepers are protecting a business's financial records, preparers are protecting an individual's identity documents. The second one is what makes the portal non-negotiable.

If you are a seasonal preparer running a storefront practice for a few months a year, hosting for tax preparers is the closer fit. That page deals with the marketing site that has to appear in January and stay useful in June. This page is aimed at a firm with year-round clients and a portal in the workflow.

For everyone here, the spending advice is unglamorous.

• You do not need a large plan. Your site is text. Storage is not your constraint and it never will be.
• You do not need a security product bolted onto a brochure site that holds no client data. Spend that money on the portal you already pay for actually being used.
• You do not need a separate host for the portal. It is a service you log into, not something you install.
• You probably do need somebody to rewrite the pages that invite email, and to confirm the site is served over HTTPS everywhere rather than on the home page only.

Where spending more is genuinely justified: you run client-facing tools on your own site rather than linking to a hosted portal, you have several offices with separate pages and staff who each need access, or you publish enough advisory content that the site has become a real acquisition channel. Number of clients on its own is not a reason.