Client tax files on Dropbox

[Greenbriar]

I think it's been a while since this was discussed and there was some concern about security of clients' tax files residing in Dropbox, but I'd like to know if anyone is using DB or Google Drive to store the active tax files. I use DB to move and access other files but not tax files although it would help me a lot - sole practitioner going from desktop to laptop and back, etc. Thanks.

[Koss]

Dropbox

This may not be the answer you're looking for...

It is not clear whether the encryption and security used by Dropbox meets the minimum standards of the financial services industry. It also isn't clear whether those standards are even applicable to tax pros, because we are not financial institutions (unless you have an insurance or securities license).

Dropbox has had more than one embarrassing episode in which passwords were leaked or otherwise circumvented. The following news article is from October, 2014:

http://arstechnica.com/security/2014/10/7-million-dropbox-usernamepassword-pairs-apparently-leaked/

I would not recommend storing sensitive files in the consumer version of Dropbox.

Dropbox for Business--which is not free--has more controls, such as multiple users for the same account, and tracking features that allows you to monitor who is accessing each file. This does not, however, mean that the entire platform is more secure than the consumer version. It is still the same basic technology, the same encryption, and the same servers.

At one point, Dropbox had an option that allowed the user to store their own encryption key, instead of having it stored by Dropbox. This concept appeals to privacy freaks, because if it works the way it is supposed to, it means that even the IT folks at Dropbox could not get into your files, even if they were served with a subpoena. But if your username and password are compromised, someone else is still going to have access to the files you have stored, even if you hold your own encryption key.

If you don't understand the subtle but important distinction between Dropbox holding your encryption key and you holding your own encryption key, then you should take the time to read up and understand it before you use Dropbox to store anything other than your own personal data.

I know it's an old cliche: You get what you pay for. With any free product, you have very limited recourse against the provider if something goes wrong.

A product that is free probably should not be used for storing sensitive data that you have a fiduciary duty to protect.

So if you're still reading, and you are prepared to pay a reasonable fee for a professional-grade file storage platform, you should find out what is available from your tax software vendor. Drake has a product called SecureFilePro that is $100 per year for 250 MB of storage. It allows you to build a folder for each client, and you can use the platform to exchange documents with your client. According to Drake, it meets the security requirements of the financial services industry.

You don't even have to be a Drake software user to purchase and use the service.

BMK

[Koss]

File Sharing

In the original post, Greenbriar wrote:

I use DB to move and access other files but not tax files although it would help me a lot - sole practitioner going from desktop to laptop and back, etc.

This implies that he may only wish to use Dropbox to move files between his own computers.

Even with this limited scope, I would not recommend Dropbox. But for anyone even thinking about using Dropbox to share files with clients...

that is, anyone who thinks that Dropbox is a "secure" method of sending a PDF of a tax return to their client--

This article from May, 2014 should scare the living daylights out of you:

http://grahamcluley.com/2014/05/dropbox-box-leak/

This article actually concludes that the business version of Dropbox is indeed more secure than the consumer version. But I still wouldn't use it for client files.

BMK

[Greenbriar]

Great report on Dropbox

Thank you so much for your comprehensive reply on Dropbox. I'm not using the free version, I'm paying 99 per year for a terabyte and don't come close to capacity. I like the program and I find it very useful - no flipping floppies, I mean thumb drives, anymore, but I'll heed your advice and will not use it for clients' files. Thanks again, really appreciate it. Paul Brush

[ACCURATETAX]

Thank you so much for your comprehensive reply on Dropbox. I'm not using the free version, I'm paying 99 per year for a terabyte and don't come close to capacity. I like the program and I find it very useful - no flipping floppies, I mean thumb drives, anymore, but I'll heed your advice and will not use it for clients' files. Thanks again, really appreciate it. Paul Brush

you may want to look at QBOX its designed for Quickbooks but may also work? Not sure