Every CA firm holds login credentials for dozens—sometimes hundreds—of client portals: GST portal, income tax e-filing, TRACES, MCA21, EPFO. Storing these in WhatsApp chats, sticky notes, or unencrypted spreadsheets is a serious security and liability risk. Here is the right approach for 2026.
The Real Risk of Insecure Password Storage
When a CA firm stores client credentials insecurely, it faces exposure on multiple fronts:
- Data breach liability: Under IT Act Section 43A, firms that negligently store sensitive personal data face compensation claims.
- Client trust damage: If a client's GST or income tax account is compromised, the CA firm is the first suspect.
- Regulatory scrutiny: ICAI's Code of Ethics requires members to maintain client confidentiality—password leaks are a disciplinary matter.
- Ransomware risk: An unencrypted Excel with 200+ passwords is an attacker's goldmine.
Common (Unsafe) Methods and Why to Avoid Them
| Method | Risk Level | Why Unsafe |
|---|---|---|
| WhatsApp group / chat | Critical | Messages synced to multiple devices; no access control; chat logs can be exported |
| Google Sheet / Excel | High | Unencrypted by default; shared with "anyone with link"; no audit trail |
| Sticky notes / physical diary | High | No backup; anyone in office can read; lost if stolen |
| Browser autosave | Medium-High | Sync'd to Google account; all staff browsers have access; no role control |
| Email drafts | High | Email accounts regularly compromised; no encryption at rest |
The Right Solution: Team Password Vault
A dedicated team password manager provides encrypted storage, role-based access, sharing controls, and audit logs. The leading options for small CA firms:
| Tool | Price (per user/month) | Key Features for CA Firms | Best For |
|---|---|---|---|
| Bitwarden Teams | ~₹250 | Open-source, self-hostable, collections by client, audit log | Budget-conscious firms |
| 1Password Teams | ~₹350 | Travel mode, team vaults, guest access for specific items | Firms wanting premium UX |
| Dashlane Business | ~₹450 | Dark web monitoring, SSO, admin console | Larger firms |
| Keeper Business | ~₹300 | Role-based enforcement, compliance reports | Regulated environments |
How to Organise Client Credentials in a Team Vault
Step 1: Create a Collection per Client
Most team password managers allow "collections" or "folders." Create one folder per client and store all their portal credentials there: GST username/password, income tax login, TRACES, MCA21, state VAT (if applicable), EPFO, bank logins.
Step 2: Assign Role-Based Access
Not every staff member needs every client's credentials. Assign access by team or work allocation:
- GST team → access only to GST client folders
- Income tax team → access only to IT client folders
- Senior CA → read-only to all; edit permission to managers
Step 3: Enable Audit Logging
Enable audit logs so you can see who accessed which credential and when. This is critical for insider threat detection and for demonstrating due diligence to regulators.
Step 4: Set a Credential Rotation Policy
After a staff member leaves, rotate all credentials they had access to. Most team vaults show exactly which items a departing user could access.
What to Do with Credentials Already in Spreadsheets
- Export from the spreadsheet to your chosen password manager using their CSV import feature.
- After confirming all credentials are in the vault, permanently delete the spreadsheet (empty the Recycle Bin/Trash).
- Ask clients to change passwords that were stored insecurely, especially for the income tax and GST portals.
TaxZeo integrates with your firm's workflow to keep client portal access organised. Combine with a team password vault for complete credential security.
See How TaxZeo WorksFrequently Asked Questions
Is it legal to store client portal passwords in India?
There is no specific law prohibiting it, but ICAI's Code of Ethics requires client confidentiality, and the IT Act 2000 (Section 43A) imposes liability for negligent handling of sensitive personal data. Best practice is to use encrypted, access-controlled storage and to have a written data handling policy shared with clients.
Should we share client passwords over email?
Never in plain text. If you must share credentials over email, use your password manager's secure share link feature, which creates a time-limited, view-only link that expires and can be revoked. Alternatively, share the password via phone call and the username via email—never both together in plain text.
What if a client wants to change their own password?
Good practice is to have the client own their own credentials and provide you a read-only or limited-permission access where the portal allows (e.g., GSTIN sub-user accounts). For portals where this is not possible, update the vault immediately whenever the client changes their password.