# Client Confidentiality in Bookkeeping: Practical Rules

- Author: AutoBankConvert (https://www.autobankconvert.com)
- Published: 2026-08-15
- Updated: 2026-08-15
- Category: Security and trust
- Canonical: https://www.autobankconvert.com/blog/client-confidentiality-in-bookkeeping

> Client confidentiality in bookkeeping: who may see a client's statements, what to put in the engagement letter, and how to share files with the client's CPA.
Client confidentiality in bookkeeping means a bookkeeper uses a client's statements and records only for the agreed work, shows them only to people the client has approved, and does not repeat what they reveal. In practice that comes down to written terms on access, sharing, retention and software use.

## What does client confidentiality cover for a bookkeeper?

Client confidentiality covers everything a bookkeeper learns about a client's finances through the work: statements, ledgers, payroll, tax details, and the client's own explanations. It also covers the fact that the person is a client at all, which some clients would rather keep private.

### More than the files

Confidentiality is a duty about information, not about file formats. The same fact is protected whether it sits in a PDF, a spreadsheet, a phone call or a chat. A bookkeeper who tells a friend that a local restaurant is behind on its payroll taxes has broken confidentiality without touching a file.

The duty usually has four parts:

- **Use**: client information is used only to do the client's work.
- **Access**: only people who need it to do that work can see it.
- **Disclosure**: it goes to no one else without the client's say, apart from what the law requires.
- **Care**: it is stored and sent in ways that make leaks unlikely.

### Where the duty comes from

The duty comes from three places: the engagement letter you signed, any professional body you belong to, and the law where you and your client are. These vary. A bookkeeper with no professional credential still has the contract. A CPA or enrolled agent has extra rules from their licensing body. This post gives practical habits and does not replace advice from a lawyer or your professional body about the rules that apply to you.

### What it does not cover

Information that is already public is not confidential, and a client may choose to share their own information with whomever they like. The duty is the bookkeeper's, so the bookkeeper is the one who asks before sharing, and does not assume.

A good habit is to ask one question before any disclosure: did this client tell me I may share this with this person? If the answer is not a clear yes, you do not share it.

## Confidentiality terms in a bookkeeping engagement letter

An engagement letter should say, in plain words, who may see the client's records, how they are shared, how long you keep them, and what tools you use. Writing this down protects the client and you, because it replaces assumptions with terms both sides agreed.

### Engagement letter clause checklist

Use this as a checklist when you draft or update a letter. The wording is for you to adapt, and a lawyer should review the final text.

| Topic | What the clause should say | Example wording (adapt) |
| --- | --- | --- |
| Purpose | Records are used only for the agreed services | "We use your records only to provide the services in this letter." |
| Who has access | Named roles inside the practice | "Only our staff who work on your books can open your files." |
| Software | Tools that process records are named by type | "We use online software to convert and categorize your bank statements." |
| Software and training | Whether records may be used to train software | "We do not allow your records to be used to train any software." |
| Sharing | Who the client approves | "We share your records only with your CPA and anyone else you approve in writing." |
| Outside help | Contractors follow the same terms | "Anyone who helps us is bound by these same terms." |
| Retention | How long you hold copies and what happens next | "We keep working copies for two years after we finish, then delete them." |
| Return of records | The client can ask for their files | "On request, we return your records in a standard format." |
| Required disclosure | The exception for legal demands | "We disclose records only if the law requires it, and we tell you first where we can." |
| Incidents | You tell the client if records are exposed | "If your records are exposed, we tell you promptly." |

### Keep it short

A clause nobody reads does not protect anyone. Put these terms in a short section, in sentences a client can follow, and walk through them in the first meeting. The retention clause ties to the post on [how long to keep client bank statements](/blog/how-long-to-keep-client-bank-statements), which gives a table of periods per file type.

### Update when your tools change

If you add an online converter, a new cloud drive or an outsourced reviewer, update the letter and tell existing clients. A letter that names no software while you run three tools is a gap waiting to be found. Telling clients early gives them the chance to object before their files go through the new tool.

## Sharing a client's files with their CPA confidentially

Sharing with a client's CPA is a normal part of year-end, but it is still a disclosure. Share only after the client agrees to it, send only the files the CPA needs, and use a named, expiring link or a secure portal instead of a plain email attachment.

### Before you send

1. **Confirm the client approved the CPA** by name, in writing. An email reply is enough.
2. **Confirm the CPA's contact details** from the client, not from an inbound message. A request that arrives by email asking for "all statements, urgently" is a common tactic of someone pretending to be the CPA.
3. **Decide what the CPA needs.** A year-end package of reconciled statements and reports is usually enough. The CPA does not need your rules, your notes on other clients, or the whole folder.

### How to send

Use a secure share that you can switch off. Share with the CPA's email address, not an open link. Set the link to expire, and remove access when the CPA confirms receipt. If the CPA asks for the data in an accounting file instead, give access as a separate user with a role, so the client's own login stays private.

After sending, keep a record of what went to whom and when. If the client later asks who has seen their books, you can answer.

### The other direction

CPAs also send you files: adjusting entries, prior-year returns, notes. Handle those with the same care, and keep them in the client's folder rather than your inbox. For the year-end handoff steps themselves, the practical rules in the checklist for [tools and habits that protect client data](/blog/bookkeeping-data-security-checklist) apply to every file that moves.

## Confidentiality slips with family and shared accounts

Most confidentiality slips are ordinary: a spouse reads a screen, a family member shares a login, a statement for a joint account goes to the wrong person. They happen because the people involved are close to the client, and nobody thinks of it as a disclosure.

### Common situations

- **Joint accounts.** Two people own the account, but only one hired you. Ask who may receive information, and get both names in the file if both will ask questions.
- **A client's spouse or relative who calls.** A friendly voice asking about balances is still a third party. Ask the client first.
- **A business partner who wants to see a partner's personal spending.** Business and personal records may belong to different people. Keep them apart.
- **Family business with a bookkeeper who is also family.** Roles blur. Put the terms in writing anyway.
- **Your own household.** Do not work on client files where family can see your screen, and do not let someone borrow the laptop that holds them.

### Shared accounts inside your practice

Shared logins create the same problem inside the practice. If two staff use one login for a client, you cannot show who opened what. Give each person their own account and remove it when they leave.

### Mixed personal and business statements

A sole proprietor often pays personal expenses from the business account. The bookkeeper sees the owner's personal life in those lines. Treat those lines as confidential too. Categorize them, ask the client how to treat them, and do not discuss them with staff who do not need to know.

## Can a bookkeeper use client data to train software?

No, not without the client's clear agreement. Client statements are given for the client's books. Using them to teach a model or improve a product is a different purpose, so it needs permission, and the safest default is to say no in the engagement letter.

### Two questions, not one

There are two separate questions. The first is whether you, the bookkeeper, would use client files to build or tune your own tools. The second is whether a vendor you upload to can use your uploads for its own purposes. You cannot control the second unless you ask, and you answer to the client for both.

Ask every software vendor in writing whether uploaded files are used to train models or are shared with anyone else. A good answer is a plain no. The questions are in the post on [uploading client statements securely](/blog/upload-client-bank-statements-securely#questions-to-ask-before-uploading-client-statements).

### Rules that learn from your own client

Some learning is inside one client's books: a rule learned from a client's past coding applies to that client only. AutoBankConvert describes its categorization this way, with rules you write once plus each client's own past coding, and keeps each client's accounts, rules and history in their own workspace. That is a different thing from using one client's data to benefit another.

### What to do now

Add a line to your engagement letter, as in the table above. Check each tool you use. If a vendor will not answer, treat that as an answer, and choose another. When a client asks, you can then say exactly where their statements go. As you take on new clients, put this in the [onboarding checklist](/blog/bookkeeping-client-onboarding-checklist) so every client hears the same terms, and see [AutoBankConvert](/) for how a per-client workspace keeps each set of rules apart.

If a file will not convert and someone suggests trying a free site you have not vetted, see [why a statement is flagged as unsupported](/blog/unsupported-bank-statement-flagged) first. Sending a confidential file to an unknown service is the worst way to fix it.