Getting your documents to us

Method	Protection	Best for
1. Client portal	Encrypted in transit and at rest	Anything sensitive — the default
2. Shared cloud folder	Strong, if shared to one address	Many files, or a year of statements
3. Email	TLS in transit, encrypted at rest	Most documents, password-protected
4. WhatsApp	End-to-end encrypted	A quick phone photo of one document
5. Post	Physical custody	ITIN originals, where nothing else works

1 · The client portal

Our default, and what we would pick for you. Files are encrypted in transit and at rest, only your preparer and reviewer can open them, and there is a record of what arrived and when — which matters if a question comes up about a document years later.

You do not sign up for it. We create the account and send you an invitation, because we verify who you are before anything sensitive moves. Ask and it usually arrives the same working day. Start here.

2 · A shared cloud folder

Google Drive, OneDrive, Dropbox or iCloud all work well, and they are the easiest option when you have a year of statements rather than three documents. Your files never leave your own account — you are lending us a view of them, and you can take it back. Three settings make the difference:

• Share to our email address specifically, not “anyone with the link”. A link that works for anyone is a document sitting in the open for as long as it exists
• Give view access, not edit — we never need to change your files
• Revoke it once we confirm we have everything. Ask us to confirm, then remove our access

Share it with your preparer’s address if you already have one, or with tax@universaltaxfiler.com if you do not — and tell us it is coming, so the invitation does not sit unnoticed in a folder. Set an expiry date too, if your provider offers one.

3 · Email

Plenty of our clients email their documents, and it is a perfectly reasonable thing to do. Our mail runs on Google Workspace: messages are encrypted in transit between mail servers over TLS, encrypted at rest in Google’s data centres, and we can send you a client-side encrypted message where the content is encrypted before it ever reaches Google.

The distinction worth understanding is direction. That protects what we send you. An email you send us is encrypted in transit if your provider supports TLS — Gmail, Outlook and iCloud all do — but it is not end-to-end encrypted, and a copy stays in your sent items and in your provider’s backups for as long as they keep them.

Two habits remove most of what remains:

• Put the documents in a password-protected PDF or ZIP and send the password by text or WhatsApp rather than in the same email. Almost any PDF tool, and both Windows and macOS, can do this
• Never put a Social Security number in the subject line. Subject lines, timestamps and recipients are never encrypted — not even under client-side encryption, which covers only the message body and its attachments

Already working with someone here? Send it straight to your preparer — they are the person waiting for it, and it saves a hop. If you are new, or not sure who that is, send it to tax@universaltaxfiler.com and we will route it. Whatever arrives, by any route, is moved into secure storage on our side.

4 · WhatsApp

End-to-end encrypted, and often the fastest thing you can do: photograph the document and send it. Genuinely useful for a single W-2 or a photograph of an IRS notice when you are away from a computer.

It sits below email here for a practical reason rather than a security one — the photo stays in your phone’s gallery and in the chat history on both devices, which makes it the wrong choice on a shared handset, and a phone photo of a multi-page statement is harder for us to work from than a scan. Message us.

5 · Post

Rarely necessary, but for one thing it is the only option. ITIN applications need original identity documents or copies certified by the issuing agency — the IRS does not accept a notarised copy or a scan. Use a tracked service, and speak to us first so we know to expect it. Our address is on the contact page.