Email Attachments vs. Client Portal

A client sends you their W-2 as a photo of a screen. Another one replies to the wrong thread and forwards your draft return to three people who were not supposed to see it. A third messages you on WhatsApp because the attachment was too big. These are not edge cases. For most small professional-services firms, email is the default file-transfer tool -- and it works, until it really does not.

When Are Email Attachments Good Enough?

Email is fine for quick, low-stakes files: a short invoice, a signed single-page form, a calendar link. If the document is under 10 MB, not sensitive, and you do not need to know whether the client opened it, email does the job with no friction.

The problem is that most of what a professional-services firm exchanges with clients does not fit that description. Tax returns run to dozens of pages. High-resolution deliverables from a photography session can top 20 GB. Legal exhibits come in dozens of files, versioned and renamed across a thread. And once the stakes rise, every weakness in the email channel becomes a real risk.

Where Does Email Break Down?

Here is what goes wrong once files get heavier or more sensitive:

• Attachment size limits. Gmail caps at 25 MB; Outlook varies by server. A set of high-resolution photos, compiled audit workpapers, or a multi-year archive of tax returns easily blows past that limit. You end up switching to a link-sharing tool mid-thread, adding a second system to manage -- and another step to explain to clients.
• No record of who downloaded what. Once you hit Send, the document is out of your hands. You cannot see if the client opened it, forwarded it, or saved it to a personal device. For firms handling financial data, the FTC Safeguards Rule requires that client financial data be protected even after it leaves your office.
• Reply-all accidents. A client or colleague hits Reply All on a thread that includes a tax return or contract. It happens constantly, and depending on what was attached, the consequences range from embarrassing to a reportable incident. There is no undo once it reaches a third inbox.
• Spam filters and size bounces. Large attachments trigger spam filters. Even when they do not, the message sometimes shows delivered on your side and never appears on theirs. Confirmation requests become a standard step in your workflow, and you have no way to prove delivery if a dispute arises.
• No access control after sending. Once the file is sent, you cannot revoke access. If a client relationship ends or you later discover you sent the wrong version, the document stays in their inbox indefinitely. Email was designed for communication, not document custody.

What Does a Client Portal Do Differently?

A client portal flips the model. Instead of pushing files into an email thread, both sides upload and download from a shared, persistent space. See how ProjectSend Cloud handles file exchange. In practice, here is what changes:

• Files do not expire on a portal of your own. No 7-day links. The folder stays accessible until you choose to archive the client.
• Both sides can upload. Your client submits source documents directly to the portal. You get a notification when something arrives -- no more chasing attachments across reply threads.
• A complete download log. You can see who downloaded what, and when. If a client later disputes receipt, you have a timestamped audit trail exportable to CSV.
• Your brand, not a third party. The portal your clients see has your logo and your domain. The delivery experience is part of your firm image. For the full product story, see our launch post.

From a data-handling standpoint, access logging matters beyond the receipt-confirmation question. The NIST Cybersecurity Framework, used by organizations of all sizes as a baseline, identifies access logging and least-privilege controls as core practices. A client portal addresses both out of the box: files are accessible only to the clients you invite, and every download is on the record.

Is a Dedicated Portal Worth It for a Small Firm?

The follow-up email asking whether a file arrived, the re-sent attachment, the client who sends a photo of a tax form on WhatsApp -- each one is a small operational tax on your time. For a solo practitioner handling 30 clients at tax season, that overhead adds up to hours. For a small agency delivering work under a deadline, a misrouted file can mean a re-do.

If you have two or three clients and the files are low-stakes, email probably covers you. Once you have recurring relationships, files over 10 MB, or anything confidential enough to worry about in a forward, the math shifts.

ProjectSend Cloud's Free plan -- $0, no credit card, no time limit -- gives you a personal account with 2 GB of storage and a private link for every file, kept for 30 days; a portal of your own with client accounts starts at $19 a month with Pro. The software powers over 4,000 self-hosted instances worldwide. It is built on the projectsend.org open-source project (GPLv2), which means the exit is always open: migrate your data to a self-hosted install at any time, or start self-hosted and move to Cloud for free in under 48 hours. The code is open. So is your exit.

For a firm of five, per-seat pricing on tools like ShareFile or SmartVault adds up fast -- those tools charge per seat or per client account (pricing as of September 2026). With ProjectSend Cloud, your clients never pay and need no license. You pay for active client accounts, not per person. Full plan details at /plans.

If email is becoming the weak link in your client workflow, you can set up a dedicated portal today. Start free -- no credit card, no time limit.