Confidential data, it fills our office on a daily basis. Once it comes in, we guard it voraciously, but once we’ve completed our work we need to get the confidential data back to our clients. There are many ways to do this, from physically handing it to them to sending it to them over the internet.Which is the safest? Before answering that question it is important to understand four aspects of confidential data: document lifecycle, transfer, access, and services.

Document Lifecycle
Every document has a lifecycle, I know it sounds like I’m revisiting biology, but understanding the document lifecycle is important when protecting confidential data. Every document is created, stored, transferred, sometimes encrypted, and eventually destroyed. When considering how you manage confidential data, knowing how a service handles your documents will help you make an informed decision.

Transfer
The way you get your client the confidential data. Understanding how data is transferred is important. Now, you don’t need to become an IT wizard, but you need to be educated so you can properly protect your clients’ confidential data. Remember the burden of protecting your clients’ data falls to your firm. Don’t become another data breach statistic. The mechanism of transferring your data is a network connection, whether it is locally (in your office) or externally (the internet), you need to be mindful of the security while moving data from one location to another. Some online services will copy your file to their servers (this is what document lifecycle is) then copy them to multiple servers for backup or additional types of access and storage. This practice is common but it is important to know that the service provider is securing the process properly. Also, while sending a file to an online service, ensure the connection is encrypted, always protecting your data.

Access
The best way to understand access to confidential data is to think of having a singular locked box (the file) and you having a unique key to unlock the box; but the client, the client’s employees, and the client’s banker need access to the same locked box (the file). You don’t want give them your key because your key has access to other boxes that don’t belong to the client. Having this type of flexibility will help shape which service you choose because you shouldn’t have to constantly manage keys and files.

Service
So now you feel more confident, you understand lifecycle, transfer, and access of confidential data. It’s not over, now that you understand what you need to choose a service or method for delivering the data. How do you choose though? Let me break it down, because your method options are rather limited but your vendor option is huge. You can have your client come into your office and physically pick up the data but this requires scheduling and you have to verify identities. If you have a small book of clients it’s easy, but if you have a sizable amount, don’t assume your staff members will remember everyone. You can also burn a CD or DVD and mail it to the client, this is great but remember you can’t confirm that the client received the package. Also, don’t forget about how many letters or checks have been lost in the mail, never be delivered. You could always use email but security has always been an issue with email, with so many accounts getting hacked or compromised, it’s difficult to manage and to require your client to adhere to industry standards. Email encryption is definitely a strong option and works great but is very difficult to manage amongst all the access levels.

Now, you could opt to use an online storage service but often this type of service is difficult to manage and isn’t meant to manage confidential data but only to store simple spreadsheets or collaborative marketing presentation. The security and compliance standards are usually lacking because those companies are chasing new technologies not security. One of the best methods that maintains security, compliance, ease of management, and your sanity is using a document web portal. This method allows you to upload a file to a private online location, only the people with correct privileges will have access to it. The file is encrypted when sending and receiving so security and compliance is always upheld. Email is used only to notify both parties when either party updates the account. This method enables you to focus on your firm not files, uploads, downloads, comments, emails, pickup times, encryption, etc. Stop worrying about files and get back to working on what matters most to you and your firm.

I recommend using a service made by our parent company, Office Tools Professional, called Client Portal. The integration is slick, simple, and easy to use. If you opt for email then I suggest using PGP, it takes a little to get yourself and clients set up but it’s the most secure email client solution.