A firm's technology page should tell a client what they will actually do: how they get into the portal, how they send documents and sign forms, how finished work and messages come back to them, and whom to call when something does not work. Security belongs on the page as a description of specific practices the firm can confirm, not as broad assurances. Whoever owns the firm's security program approves every security sentence before it goes live.
Prospective clients ask about technology for two reasons: convenience and safety. They want to know whether they will be mailing paper or scanning receipts, and whether sending a tax return or a brokerage statement through a website is safe. Some firm sites answer with a vendor logo and a phrase like "bank-level security," which answers neither question.
This page covers how to plan technology content at financial, accounting and tax firms. It is not IT security or legal advice, and which data security rules apply depends on the type of firm, which the firm's compliance owner or counsel confirms.
Describe the client's steps, not the software
Write the page from the client's chair. A new client receives an invitation, sets up an account, adds a second sign-in step, uploads the first documents, signs the engagement letter, and later receives a finished return, a plan, or monthly financials. Each of those moments can be a short paragraph or a numbered step, written in the order the client meets them.
The steps also need an exit. Say what happens to portal access when the engagement ends, how long finished documents stay available, and how a client gets copies before access closes. These are the firm's own policies, so they come from the person who runs the portal day to day.
The help path deserves as much care as the happy path. A partner reviewing the draft might ask the office manager, "If a client gets locked out of the portal at 8 p.m. in March, what do they do, and does our website tell them?" Whatever the honest answer is (a support line, a callback the next morning, a vendor help page) belongs on the page with the hours attached.
Security sentences are claims the firm has to support
Several firm types already have written security obligations, and those obligations make useful raw material. The FTC's guide to its Safeguards Rule names "tax preparation firms" among covered businesses and tells them to "Encrypt customer information on your system and when it's in transit" and to "Implement multi-factor authentication for anyone accessing customer information on your system." IRS Publication 5708, a guide to written information security plans for tax and accounting practices, puts it plainly: "the law requires you to have one."
SEC-registered investment advisers have their own rule set. The SEC announced amendments to Regulation S-P in May 2024 covering "broker-dealers (including funding portals), investment companies, registered investment advisers, and transfer agents." They require written incident response procedures and notice to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, "as soon as practicable, but not later than 30 days" after the firm becomes aware of the incident, with certain limited exceptions. The SEC's small entity compliance guide set compliance dates of December 3, 2025, for larger entities and June 3, 2026, for smaller ones, so the compliance owner confirms which date applied to the firm and where its procedures stand.
None of that turns into marketing copy on its own. A compliance obligation is not a marketing claim, and a page that implies more protection than the firm can show creates a problem the firm did not have. "We require a code from your phone each time you sign in" is a sentence someone can verify. "Your information is completely safe with us" is not.
What to write and what to leave out
| Topic | A sentence the firm can stand behind | What to leave out |
|---|---|---|
| Signing in | The sign-in steps the client will see, including any second factor the firm actually requires | Comparisons such as "bank-level" that nobody can check |
| Sending documents | Where clients should upload files, and what the firm does if a client emails a sensitive document instead | Permission to send anything by ordinary email if the firm's plan says otherwise |
| Signatures | Which documents can be signed in the portal and which, if any, still need paper | Blanket statements that "everything" can be signed online |
| Access and retention | How long files stay available and what happens when the engagement ends | Promises to keep files indefinitely |
| Suspicious messages | How the firm will and will not contact clients, and whom to call to check a message | Details of the firm's security tools or configuration |
The last row matters more than it looks. A client cannot always tell a real message from one that only looks like it came from the firm, so a plain statement of how the firm contacts people, approved by the security owner, gives a client a way to check.
Fictional example: a tax practice in Arizona moving clients off email
A fictional tax practice in Arizona adopted a portal two seasons ago. Its website says "secure client portal" beside the vendor's logo, and clients keep emailing photos of their documents anyway. Nothing on the site tells them why the portal matters or how to use it.
The practice rewrites the page in three parts: getting started, sending and signing, and getting help. The writer should not have to invent the sign-in steps or guess which controls are switched on, so the office manager walks through the portal on a test account while the writer takes notes, and the practice's IT contractor marks up the security paragraph. The final paragraph names the second sign-in step, says documents should go through the portal rather than email, explains what staff do when a client emails a sensitive document anyway, and states that staff will never ask for a portal password by phone or email, which the owner confirms is the practice's rule.
The page now matches what clients experience, and it gives the front desk a link to send instead of a long explanation. It also connects to the practice's page on working with clients remotely, since most of its portal users never visit the office.
Keep the page in step with the software
Portal vendors redesign screens, rename features, and change sign-in methods. Screenshots date quickly, so describe steps in words where possible and date any screenshots the page keeps. Give the page an owner, usually the person who administers the portal, and review it whenever the firm changes vendors, changes its sign-in requirements, or updates its written security plan.
In Hudson South's process, Authority Asset gathers the firm's approved business knowledge and evidence, including the portal steps and the security statements the firm has cleared. Hudson Twenty-One records how the firm communicates across 21 dimensions, so a technical page still sounds like the people clients talk to. Market Intelligence researches the technology questions prospects in the firm's market ask, and AEO Creation turns those inputs into answer-first content. The portal page pairs naturally with the firm's explanation of what happens after the first call.
Find the questions your portal page leaves open
On a free 30-minute call, Hudson South walks through the gaps between your firm's site and the competitors prospective clients compare it with.
Get your free competitor analysisSources
- FTC Safeguards Rule: What Your Business Needs to Know. Federal Trade Commission. Read 2026-10-16.
- Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice. Internal Revenue Service. Read 2026-10-16.
- SEC Adopts Rule Amendments to Regulation S-P to Enhance Protection of Customer Information. U.S. Securities and Exchange Commission. Read 2026-10-16.
- Enhancements to Regulation S-P: A Small Entity Compliance Guide. U.S. Securities and Exchange Commission. Read 2026-10-16.