How to Talk to Clients About Data Security Without Scaring Them

Most firms handle the security conversation one of two ways: they avoid it entirely, or they only bring it up when forced to — a breach in the news, a compliance disclosure buried in an engagement letter. Neither approach builds trust. Clients hand over Social Security numbers, bank statements, and full financial pictures to their accountant every year, and staying silent about how that information is protected doesn't make clients feel safer. It just leaves them guessing.

Why Silence Isn't Actually Neutral

It's tempting to assume that not mentioning security avoids making clients nervous. In practice, it does the opposite. A client who never hears anything about how their documents are handled doesn't assume the best — they assume whatever they've absorbed from news stories about data breaches, which is usually worse than reality. A firm that says nothing forfeits the chance to reassure a client with the truth, and leaves that gap to be filled by whatever the client already fears.

Lead With What You Do, Not With Legal Language

The instinct for many firms is to reach for compliance terminology first — citing the FTC Safeguards Rule, referencing a WISP, quoting policy language. That's the wrong opening. Compliance language is written for regulators, not clients, and leading with it signals "we're covering ourselves legally," not "we're protecting your information." A client doesn't need to hear the name of the regulation. They need to hear the plain-language version of what it requires the firm to actually do:

• Documents are stored in an encrypted system, not sitting in a shared inbox
• Access to client files requires two-factor authentication, not just a password
• Every software vendor the firm uses is vetted for how it handles client data before it's adopted
• There's a clear schedule for how long records are kept, and how they're securely disposed of when that period ends

The regulatory reasoning can live in the background. What the client hears should be specific and concrete, not a citation.

Be Specific Without Oversharing

There's a real balance here. Vague reassurance ("we take security very seriously") means nothing and sounds like every other firm's boilerplate. But going the other direction — naming exact software products, server configurations, or internal procedures in detail — doesn't build more trust, it just hands a would-be attacker a map. The right level of detail describes categories of protection a client can understand and verify matters to them, without describing the firm's specific technical setup in a way that becomes useful to someone with bad intent.

Never Promise "Completely Secure"

No system, firm, or vendor can honestly claim to be 100% secure, and saying so creates a problem twice over. It's not true, and it sets an expectation that becomes a liability the moment anything ever goes wrong — even something outside the firm's control, like a vendor incident. The more honest and, in practice, more reassuring framing is that the firm takes specific, real, ongoing precautions, reviews them regularly, and treats data protection as an active practice rather than a box checked once.

Bring It Up Early, Not Reactively

The best time to talk about security is during onboarding, folded naturally into the explanation of how documents get collected and stored — not as a standalone announcement, and not only after a client asks or after something happens elsewhere in the news. Framed as a normal part of "here's how we work together," it reads as routine competence. Framed as a reaction to a breach headline, it reads as damage control, even when the firm has done nothing wrong. Because every firm's document handling, client base, and risk profile are different, this conversation works best when it reflects what your firm specifically does — not a generic script copied from somewhere else.

For the underlying requirements this conversation is grounded in, see our FTC Safeguards Rule breakdown, our WISP checklist for small firms, and our guide to vetting software vendors for client data security. This is also part of our complete guide to AI for accountants.

Frequently Asked Questions