Sharing client documents securely: email, portals and links compared
Small RIAs usually share client documents in one of four ways: ordinary email attachments, encrypted email, secure file links, or a client portal. Ordinary attachments are the easiest and the weakest, because files sit in inboxes indefinitely and can be forwarded. A secure link, encrypted email or portal keeps sensitive documents out of ordinary inboxes and lets you control access. Pick one secure route for anything containing account numbers, Social Security numbers or statements, write it into your procedures, and tell clients.
A client emails a PDF of their old brokerage statement, account number and all, to ask whether you can take it over. You reply with a transfer form attached, already filled in with their Social Security number. Both files now live in two inboxes, on two phones, and in every backup of both. Nothing has gone wrong yet.
What are the options?
| Method | How it works | Strength | Weakness |
|---|---|---|---|
| Ordinary email attachment | File attached to a normal email | Easy, familiar | Sits in inboxes indefinitely; easy to forward or misdirect |
| Encrypted email | Email service encrypts the message; recipient opens it securely | Works from your normal email | Recipients sometimes find the extra step confusing |
| Secure file link | File stays in storage; you send a link with access control | You can expire or revoke access | Needs a storage tool with sharing controls |
| Client portal | Client logs in to send and receive documents | Everything in one controlled place | Clients need to log in; adoption takes effort |
Which should a small firm use?
One secure route for sensitive documents, used consistently. The best choice is often the one your clients will actually use. A portal nobody logs into ends with documents back in email.
A simple policy you can adopt
- Define sensitive. Account numbers, Social Security numbers, statements, tax documents, ID copies.
- Pick one secure route for sending and receiving sensitive documents.
- Tell clients at onboarding how to send you documents, and repeat it when they don't.
- Move, then tidy. When a sensitive file arrives by ordinary email, move it to secure storage and handle the email copy under your retention rules.
- Review access. Expire links and remove access for people who no longer need it.
A worked example
Take a hypothetical two-person RIA with about 120 households. It chooses secure links from its document storage service for anything sensitive. At onboarding, clients get a one-page note: "Please don't email statements or ID. Use the upload link we send you." When a client emails a statement anyway, the assistant saves it to the client's folder, replies with the upload link for next time, and logs it. Links expire after 14 days. Once a quarter, the firm reviews who has access to shared folders.
Don't forget the record
A secure channel doesn't change what you must keep. Messages about advice, money, orders or performance are records whatever channel they use. If clients send instructions through a portal, make sure those messages are captured too. See which client emails an RIA has to keep.
When is this overkill?
A firm that rarely exchanges sensitive documents still needs the policy, but it can be a paragraph. The habit that matters most is not sending Social Security numbers and account numbers as ordinary attachments.
How Advorra fits
Advorra keeps each firm's data separate from every other firm's at the database level and encrypts it in transit and at rest. Your document-sharing route is a separate choice; put it on your vendor list and in your procedures. See the product page, or read Regulation S-P for small RIAs.
One thing to do this week: search your sent folder for "SSN" or "account number" and see how many sensitive attachments went out by ordinary email this year.
An operations comparison, not legal or compliance advice.
Questions advisors ask
Is ordinary email ever fine?
For messages with no sensitive personal or account information, such as scheduling, usually yes. The question is what's in the attachment, not the channel alone.
What counts as sensitive?
Social Security numbers, account numbers, statements, tax documents, ID copies and anything that combines a name with financial details. Your privacy policy and compliance consultant should define it for your firm.
What about clients who send sensitive files by ordinary email anyway?
Thank them, move the file into your secure storage, delete it from the inbox if your retention rules allow, and point them to the secure route for next time.
Does using a portal mean I don't need to keep the emails?
No. Communications that relate to advice, funds, orders or performance still need to be kept under the books and records rules, whatever channel they used.
Is this legal or compliance advice?
No. It is an operations comparison. Your compliance consultant decides your firm's policy.
See it on a demo firm
Advorra is practice software for independent RIAs: clients, models, IPS, billing and compliance records in one place, on top of the custodian you already use. Built by The CollabHub.
Get in touch