Secure Client Portal

A secure client portal gives each client one place to send documents to the firm and to receive them. The client signs in through a browser or an app. They see the matters they belong to and nothing else. The firm's staff see the same matters from their side.

Three things separate a portal from sending files. The document does not travel. It stays in one store, and people come to it. Access belongs to an account, so the firm can add or remove a person without touching the files. Each action leaves an entry in a record kept by the portal.

Most portals add functions around that core. Common ones are requests for documents with a due date, messages tied to a matter, forms, approval steps and electronic signing. Some are part of practice management or accounting software. Others are separate products.

"Secure" is a description and not a standard. No law or certification defines when a portal may use the word. In practice it should stand for a short list of things a firm can check: encryption in transit and at rest, an individual account for every user, a second login factor, permissions set per matter, and a record of access.

The three differ most in where the document ends up and in what the firm can show afterwards. Email copies the file to every mailbox it reaches. A shared drive and a portal both keep one copy and bring people to it. The portal ties that copy to a client account and a matter. The table sets the three side by side on the points a firm is most often asked about.

Two rows deserve a second look. A portal does not stop a client from downloading a file, so control ends at that point, as it does with a shared drive. A portal also identifies the client only as well as its login does.

No EU law requires a client portal, and none forbids email. The law sets results the firm must achieve with personal data, and the firm stays responsible for them whichever tool it picks.

Under the GDPR the firm is normally the controller of its clients' data, since it decides why and how the data is used (Article 4(7)). A portal supplier that stores the data on the firm's behalf is a processor (Article 4(8)). Both must apply technical and organisational measures that give a level of security appropriate to the risk. Article 32(1) names encryption, the ongoing confidentiality, integrity and availability of systems, the ability to restore access after an incident, and regular testing of the measures.

The firm may use only processors that provide sufficient guarantees (Article 28(1)). The two must have a written contract. Article 28(3) lists what it must say. The processor acts only on the firm's documented instructions, keeps its staff under a duty of confidentiality, helps the firm meet its security and breach duties, deletes or returns the data at the end, and allows audits. It may not bring in another processor without the firm's written authorisation (Article 28(2)).

The Anti-Money Laundering Regulation adds a duty for firms it covers, from 10 July 2027. Where a firm processes special categories of personal data for anti-money laundering purposes, it must adopt measures of a high level of security, in particular in terms of confidentiality (Article 76(2)(d)). The documents obtained in customer due diligence must be retained for five years after the business relationship ends (Article 77). A portal that holds those documents has to keep them retrievable for that long.

A firm should require evidence on six points before it puts client files in a portal. Each can be answered in writing by the supplier.

The first is accounts. Every user has their own login with a second factor, and the firm can see and remove every account. The second is permissions. Access is set per matter, and staff see only the clients they work for. The third is the record. The portal logs logins, views, downloads and changes, keeps the log as long as the documents, and lets the firm export it.

The fourth is location. The supplier states the country where the data is stored and names its own sub-processors. Any transfer of personal data outside the EU has to meet the conditions of Chapter V of the GDPR (Article 44). The fifth is the contract. The supplier offers processor terms that cover the points in Article 28(3), including help with breaches and with requests from data subjects.

The sixth is the way out. The firm can export all documents and the access record in a usable format, and the supplier deletes its copies afterwards. A portal that is easy to enter and hard to leave becomes a risk of its own.

A firm that handles identity documents or signs with clients has two more questions. How does the portal establish who each client is? What kind of electronic signature does it produce?

Most portals know the client by an email address. The firm types the address, the portal sends an invitation, and the person who opens it sets a password. That proves control of a mailbox. It does not prove that the person is the client named on the file.

For many uses that is enough. The firm may have met the client, or checked their identity by another route. It matters more when the portal is the firm's only contact with a new client, or when the documents exchanged could be misused by an impostor.

Some portals check each user's identity document before the account opens, and some of those also offer qualified electronic signatures. Trust Circle is one such portal: each client is identity-verified before access and signatures are qualified. The category is sometimes called a verified client workspace.

A verified login is not the same as customer due diligence. Article 22(6) of the Anti-Money Laundering Regulation sets out how an obliged entity obtains the information to verify a customer's identity: an identity document with information from reliable and independent sources, or electronic identification means at assurance level substantial or high and relevant qualified trust services. Whether a portal's check meets that test depends on the method it uses. Identity is also one measure among several. Article 20(1) lists the others, which include identifying beneficial owners, understanding the purpose of the relationship and ongoing monitoring. The firm must keep the record of what was done (Article 21(3)).

Often, yes. The legal weight of the result depends on the kind of signature the portal produces. The eIDAS Regulation defines an electronic signature broadly, as data in electronic form that is attached to other data and used by the signatory to sign (Article 3(10)). A tick box or a typed name inside a portal can qualify.

Such a signature cannot be refused as evidence solely because it is electronic or because it is not qualified (Article 25(1)). The firm may still have to prove who made it, and the portal's own access record is then the main evidence. Only a qualified electronic signature has the equivalent legal effect of a handwritten signature (Article 25(2)). It needs a qualified certificate issued by a qualified trust service provider.

The question for the supplier is therefore specific. Is the signature simple, advanced or qualified? If it is qualified, which provider issues the certificate? That provider's status can be checked on the EU Trusted List.

A portal works only if clients use it, and it controls only what stays inside it.

Each portal is one more account for the client. A client who works with several advisers may have a different portal for each, and some will reply by email regardless. Portals that verify identity ask more at the start: the client needs an accepted identity document and usually a smartphone. Some clients will not complete that step.

The portal still depends on email. Invitations and notices arrive there, so an attacker can imitate them, and a password reset is often only as safe as the mailbox. A downloaded file is outside the portal's control and outside its record.

The firm also takes on a supplier. Client files, the access record and sometimes signatures sit with one company, so the processor contract and the ability to export matter. A portal does not replace the firm's document management or its anti-money laundering procedures. For a firm with few clients and low-risk documents, the cost and the change in habits may outweigh the gain.