Secure Client Document Upload Without Login: A Guide for Accountants

Access is not identity

1. 1

   A random token, stored only as a hash

   The token in the URL must come from a cryptographically secure random source with enough entropy that guessing is not a strategy. Critically, the service should store only a hash of it. Then a stolen database backup contains no usable links — the same reasoning that stops you storing passwords in plain text applies exactly here.

2. 2

   Scope checked on every request, not just the first

   Each request should re-establish which firm and which client the token belongs to, and refuse anything outside it. Scope enforced once at page load, then trusted for subsequent API calls, is a common and serious mistake.

3. 3

   Expiry, revocation and rotation

   Three separate things. Expiry is automatic. Revocation ends one link early. Rotation replaces the links for a client in bulk, which is the response to the realistic incident — an email forwarded to the wrong person, or a client changing accountants.

4. 4

   Private storage, always

   Uploaded files must not be readable by an unauthenticated request to the storage host. Staff downloads should go through the application, using short-lived signed URLs or authenticated streaming, with the access check repeated at download time rather than inherited from whoever generated the link.

5. 5

   Validation at upload

   Check the file type by its actual content signature, not its extension. Cap size, count and the number of attempts. An upload endpoint without limits is a free file host, and it will eventually be found and used as one.

6. 6

   A referrer policy that does not leak the token

   The URL contains the secret. If the upload page sends a full referrer to any third party the client clicks through to, the token goes with it. The page should send no-referrer.

7. 7

   An audit log you can export

   Link created, link opened, file uploaded, reminder sent, status changed, request completed — each with a timestamp. This is what answers “did you ask the client?” a year later, and it is worth checking you can get it out of the tool rather than only look at it.

• Token. The public token is random and stored as a SHA-256 hash. Every request checks it against the firm, the client, its expiry and whether it has been revoked.
• Scope.A link belongs to one client of one firm. Opening it loads that client’s eligible open requests, grouped by period — deliberately one link rather than one per request, because three links in an inbox means two get ignored.
• Lifecycle.Links expire, can be replaced, and can be rotated for a client from the firm’s settings. The link is an access link, not identity verification, and our security page says so in those words.
• Storage. Files go to private storage. Staff downloads run through controlled server routes using time-limited signed links or authenticated streaming, and the access check is repeated at download time.
• Upload validation.Two stages. The first validates the link, request, item, filename, type, size, count and quota, reserves the upload and issues a signed private-storage URL. The second verifies the reservation, the storage path, the object metadata and the file’s actual signature before anything is saved.
• Referrer. The client-facing upload routes send no-referrer, so the token cannot leak to a third party through a click.
• Abuse protection. Sensitive public routes sit behind bot and rate protection.
• Audit trail. Requests, link opens, uploads, reminders, status changes and completion are all logged, and a request can be exported as CSV or PDF with its items, uploads and reminders.
• Firm-side access. Separately from the client link, reaching firm data requires sign-in, membership and the right role, with row-level security and server-side checks scoping clients, requests, files, reminders and integrations to the correct firm.

• You need to prove who acted. If your process depends on attributing an action to a named individual — an approval, a declaration, a sign-off — a bearer link cannot do that. Use authentication.
• Documents flow outwards. Releasing accounts, tax computations or payroll data to a client is a higher-consequence action than receiving a receipt. Put a login in front of it.
• The client needs a durable home.If they should be able to come back next March and find last year’s documents, that is a portal, not a link. A scoped link expires by design.
• Several people at the client, with different permissions. A link cannot distinguish the finance manager from the director. Named accounts can.
• A policy or client contract requires MFA. Some sectors and some clients simply mandate it. That is a legitimate requirement and no amount of scoping satisfies it.

Vendor checklist