The Data You Don’t Think of as Sensitive
If you’re a remote bookkeeper, you probably know you handle sensitive data. But you might not realize just how many layers of it pass through your hands on a typical day — or that the rules governing that data are stricter than most independent practitioners assume. A privacy guide for bookkeepers notes that a single engagement can expose you to the full spectrum of a client’s financial life: bank accounts, credit cards, payroll records, vendor payments, tax information, and the metadata that ties it all together. That’s not just account numbers and balances; it’s also folder structures that reveal client relationships, email threads with embedded financial details, and spreadsheets that aggregate everything into one targetable file.
Most of what’s documented here comes from a single privacy guide for bookkeepers, and reading it, I felt that familiar knot tighten. The guide lists Social Security numbers on W-2s, EINs, loan terms, direct-deposit bank details — and then adds “metadata and derived data” like accounting software databases and file names. It’s a lot. And if you’re working from a home office without a formal policy, you’re carrying that responsibility on instinct alone.
The guide walks through what counts as client data: bank statements (account and routing numbers, transaction histories, balances), credit card statements (card numbers, spending patterns, merchant details), invoices and receipts (vendor relationships, pricing, purchase history), payroll records (employee names, SSNs, salary info, direct-deposit accounts), tax documents (W-2s, 1099s, K-1s), loan documents (amounts, terms, collateral), and the accounting software databases that aggregate it all. That’s not an exhaustive list — it’s just the categories the guide considers routine. Most bookkeepers touch every one of these in a normal month.
Why “Common Sense” Isn’t a Privacy Policy
The same guide observes that many independent bookkeepers and small firms operate without formal data privacy policies, relying on common sense rather than structured practices. Common sense tells you not to leave a printed bank statement on a café table. It doesn’t tell you how to evaluate whether a cloud-based document converter uploads your client’s files to a third-party server, or what to do when a client sends a PDF of their tax return via unencrypted email.
A workable policy for a solo bookkeeper doesn’t need to be long. The FTC’s Safeguards Rule and IRS Publication 4557 both provide templates. At minimum, it should list the types of client data you handle, where it’s stored (local drive, cloud, email), the main risks (device theft, email compromise, cloud service breach), the safeguards you’ve put in place (encryption, two-factor authentication, local processing), the third-party tools that touch client data and their security practices, a training note, and an incident response plan. Review it annually.
- List every category of client data you handle (use the list above as a starter).
- Map where each type lives: local device, email inbox, cloud storage, accounting software, converter tool.
- Identify one risk per category (e.g., email compromise exposes years of client documents).
- Document one safeguard per risk (e.g., delete client emails after downloading, enable 2FA).
- Write it down — even a single page counts. Schedule an annual review.
The Regulation You’ve Probably Already Signed Up For
If you handle consumer financial data — and most bookkeepers do — the FTC’s Safeguards Rule under the Gramm-Leach-Bliley Act likely applies to you. The rule defines “financial institutions” broadly enough to include tax preparers, accountants, and professionals handling consumer financial data. The 2023 update requires designating a qualified individual to oversee information security, conducting risk assessments, implementing safeguards, training staff, overseeing service providers, and maintaining an incident response plan. The FTC does not exempt small businesses; the security program must be appropriate to your size and complexity, but every element should exist in some form.
The same guide notes that all 50 states have data breach notification laws requiring disclosure when personal information — including financial account data — is compromised. Notification deadlines range from 30 to 90 days after discovery, depending on the state. If you have clients in multiple states, that’s a compliance map you need to know before an incident, not after.
The IRS also weighs in: Publication 4557: Safeguarding Taxpayer Data recommends a Written Information Security Plan (WISP) with checklists covering encryption, access controls, and security awareness training. And if you work with clients in California, New York, or Massachusetts, those states have their own laws (CCPA/CPRA, SHIELD Act, 201 CMR 17.00) that layer on additional requirements regardless of where you’re physically located. It’s not just federal — it’s increasingly a state-by-state patchwork.
Email: The Vulnerability You’ve Normalized
Standard email (SMTP) is not end-to-end encrypted. Messages pass through multiple servers in transit and may sit in plaintext on intermediate mail servers. A compromised email account exposes every client document ever received or sent — and email is permanent by default. The privacy guide points out that documents sent years ago remain in mailboxes indefinitely unless actively deleted. Forwarding and auto-forwarding can redirect sensitive documents without the sender’s knowledge.
If a client sends a bank statement as an email attachment, your first instinct might be to download it and move on. But that file remains in your inbox — and in your sent folder if you forwarded it — accessible to anyone who gains access to your email account. The guide recommends downloading attachments, saving them to encrypted local storage, and deleting the email within 24 hours. It also suggests asking clients to use a secure file-sharing portal instead, and if they must email documents, request password-protected files with the password communicated separately (by phone or text).
For a natural way to raise this with a client, you might say: “I’ve set up a secure upload folder for our statements — could you send them there instead of email? It keeps everything encrypted and I can process it right away.” Most clients appreciate the extra care once they understand why.
Secure alternatives to email include dedicated client portals, properly configured cloud storage folders with upload-only access, and tools like ShareFile or SmartVault that offer granular permissions and document expiration.
If you don’t have a dedicated client portal, a simple option is a cloud storage folder (Google Drive, OneDrive, Dropbox) set to “upload-only” — clients can drop files but can’t see other files or download anything. Enable two-factor authentication on that account and audit sharing settings regularly. For documents that require extra care, consider zero-knowledge encryption tools like Cryptomator or Boxcryptor that encrypt files before they reach the cloud provider.
Tools That Add Exposure Without You Noticing
Every tool that touches client data is part of your data protection surface. The privacy guide suggests asking a few questions about each one: Does it transmit client data to external servers? What is the provider’s data retention policy? Where is data processed and stored? Does it require an account? Can it function offline? Is the source code auditable? The answers don’t always rule a tool out, but they tell you what risks you’re accepting.
Accounting software like QuickBooks Online and Xero necessarily process data on their servers — that’s generally accepted and comes with SOC 2 certifications. But less obvious tools can create exposure. Consider a bank statement converter: a cloud-based version uploads your client’s statement to a third-party server for processing, adding one more vendor to your oversight list. An on-device converter like LocalExtract processes the file locally, eliminating that exposure point entirely. The guide notes that switching from a cloud converter to a local one removed one third-party vendor from the data handling chain and simplified the WISP documentation — with zero functional difference in the output.
Uploads your client’s bank statement to the provider’s server. Data is encrypted in transit and at rest, but the provider holds the encryption keys. You’re relying on their security practices, data retention policies, and breach notification procedures. Adds a third-party vendor to your FTC Safeguards Rule oversight obligations.
Processes the file entirely on your computer. No data leaves your device. You control the encryption keys (full-disk encryption on your machine). No additional vendor to oversee. The privacy guide reports that the output (CSV) is equivalent to cloud-based alternatives.
This kind of tool choice matters because the FTC Safeguards Rule requires you to monitor and evaluate your service providers’ security practices. Every cloud-based tool adds to that list. Local alternatives reduce it. The same logic applies to communication tools — if you discuss client financial details in Slack or Teams messages, those platforms become part of your data protection surface too. For sensitive conversations, the guide recommends encrypted apps like Signal, or at minimum ensuring your video meeting platform has waiting rooms and restricted recording settings.
For more on securing collaboration, see our guide on secure collaboration for remote teams.
Building a Privacy Practice That Fits a Solo Operation
The privacy guide reports that setting up basic practices — enabling 2FA everywhere, writing a simple WISP, configuring encrypted storage, establishing file handling procedures — took approximately six hours over two days for one bookkeeper. Maintenance runs about 30 minutes per month for audit and review. Most of the improvements are operational, not technical. They don’t require expensive software or deep security expertise. They require consistent habits.
Enable Full-Disk Encryption
FileVault on macOS, BitLocker on Windows. This protects client data if your device is lost or stolen. It’s the single most impactful step for device security.
Turn On Two-Factor Authentication Everywhere
Email, cloud storage, accounting software, client portals, bank statement converters — any service that accesses or stores client data. Use an authenticator app (Authy, Google Authenticator) rather than SMS, which is vulnerable to SIM-swapping.
Create a Written Information Security Plan
Start with the template in IRS Publication 4557. List your data types, storage locations, risks, safeguards, service providers, and incident response steps. Review it once a year.
Adopt a Secure Document Workflow
Receive files via secure portal or upload-only folder, process with local tools when possible, store output in encrypted storage, delete originals from email within 24 hours, shred printed copies with a cross-cut shredder.
Lock Down Your Home Office
Use a privacy screen in shared spaces, set automatic screen lock after 2–5 minutes, keep printed documents out of sight, and consider a dedicated work device separate from personal use.
For device security, a reputable antivirus solution (such as Bitdefender) can add a layer of protection against malware and ransomware that might target client files. If you frequently work from public Wi-Fi or shared networks, a VPN (like ExpressVPN) encrypts your internet connection and reduces the risk of interception. These aren’t mandatory for every setup, but they close gaps that home networks often leave open.
The privacy guide’s conclusion echoes something I’ve found true in my own work: the bar for better privacy practice is lower than most people assume. You don’t need a compliance officer or a dedicated security budget. You need a list of what you hold, a few deliberate habits, and the willingness to ask “where does this file actually go?” before you click upload. That question alone can change how you work — and how safely you hold your clients’ financial lives.
This post contains affiliate links.