What is the safest way for a landlord to share rental books with a CPA?

Why an email attachment is the weak spot

At tax time a landlord sends a lot: a profit and loss, a rent roll, a depreciation schedule, loan statements, insurance bills and sometimes a spreadsheet of tenant names. Sending that as email attachments feels normal, but each message sits in two mailboxes, and often on several phones and backups, for years. If either mailbox is hacked, every old attachment is exposed together.

The IRS's guidance for tax professionals says strong passwords and encryption should be standard in any data security plan, and that data stored in the cloud should be encrypted before upload. A CPA following that advice should offer you something better than email. Ask for it.

Options, from safest to least safe

1. Give the CPA their own login to your books with a role that fits the job, such as accountant or view only. Nothing is copied and you can end access with one click.
2. Upload files to the CPA's client portal, which usually encrypts files and logs who opened them.
3. Use a shared folder in a business file service with a link that needs sign-in and an expiry date.
4. Send a password-protected file, with the password sent a different way, such as a call.
5. Plain email attachments, only for documents with no personal or account numbers.

Send what the return needs, and trim the rest

The return needs income by property, expenses by category, depreciation details, loan interest and any 1099s. It does not usually need a tenant's Social Security number, a full application or a photo of a driver's license. Before you send a rent roll, remove columns the CPA does not use. Show only the last four digits of any tax ID or account number.

Ask your CPA what they need. Their list is the right size. A short, specific request also stops the common habit of sending the entire shared drive. For a checklist of the documents themselves, see our post on what to send your CPA at tax time.

Protect your side of the exchange

• Use two-factor sign-in on your email, the books and the portal.
• Confirm any change to wire or payment instructions by calling a number you already have. Fake bank change emails target landlords and their bookkeepers.
• Do not send a tax ID by text message.
• Keep a list of what you sent, to whom and when. It helps if you ever need to tell people about an exposure.

The IRS's Publication 4557 describes the steps a tax professional should take to safeguard taxpayer data, so you can ask which of them your CPA follows.

After filing, close the door

When the return is filed, remove the CPA's access or move it to view only, delete files you uploaded to temporary folders, and keep the final return and support in your own records. The IRS says to keep records until the period of limitations for the return runs out, so keep your copy, not a trail of shared links.

In DoorKeeping, an accountant can be given a role in the books without any power to send money, and every change is in the audit log. DoorKeeping gives no tax or legal advice, so your CPA decides what the return needs.

Sources

1. IRS, Tax Security 101: strong passwords and encryption, read Oct 30, 2026
2. IRS, Publication 4557, Safeguarding Taxpayer Data, read Oct 30, 2026
3. IRS, Publication 583, Starting a Business and Keeping Records, read Oct 30, 2026

Questions

Is it ever fine to email my CPA a file?

For documents with no tax IDs or account numbers it carries little risk. For anything sensitive, use a portal or a login to the books.

Should my CPA have my bank login?

No. Give them access to the books or a statement export. Keep the power to send money with you.

How long should my CPA keep access?

Until the return is filed and any questions are answered, then end it or reduce it to view only.