What clients should expect from a document portal

Clients are being asked to upload bank statements, payroll data and tax forms to links they receive by email. That deserves more scrutiny than a shared drive folder.

Questions worth asking

Before adopting a portal, ask how it handles each of these:

• Are upload links unique, expiring and revocable?
• Is file type actually validated, or only the extension?
• Who can see uploaded files, and is every download logged?
• Where are files stored, and is encryption at rest enabled?
• Can a client request deletion, and does deletion include backups?
• Is there a data processing agreement available?

The minimum bar

For financial documents, the minimum bar is expiring links, real file validation, per-tenant isolation, audit logs and a documented retention policy. Anything less shifts risk onto the client relationship.