The word secure is doing a lot of unexamined work in this category. Every vendor uses it and it rarely comes with a definition, which leaves practices comparing marketing rather than substance. For an accounting practice moving tax documents, three specific properties are what the word should mean, and each one is answerable in a demo if you ask directly.
A secure portal for tax documents: encrypted in transit and at rest
The baseline is that documents travel over an encrypted connection and are stored encrypted rather than sitting readable on a disk. This is table stakes and almost universally true, which is precisely why it should not be where your evaluation stops. A vendor that leads with encryption and becomes vague about access and logging has answered the easy question loudly to avoid the harder two, and the harder two are where practices actually get into difficulty.
Access that can be revoked, and seen
An accounting client portal grants standing access to financial records, often to more than one person per client, and those people change. The properties that matter are being able to see who currently has access to a given client, granting access per client rather than per folder, and revoking it in a single action that takes effect immediately. If answering who can see this client's documents requires reasoning about permissions inherited from somewhere, the honest answer is that nobody knows, and that is the answer a client will eventually ask for.
A log, because the question arrives later
The questions that make a portal valuable are retrospective: was this document made available, when, and who opened it. A portal that records access gives a plain answer; one that does not leaves the practice reconstructing from memory and email. This matters most in exactly the situation you least want, which is a dispute about whether something was provided in time. Ask whether access is logged, whether the log is visible to you rather than only to support, and how long it is kept.
Questions people ask about secure portal for accountants
What should secure actually mean here?
Encrypted transport and storage, access granted per client and revocable in one action, and a log of who opened what that you can read yourself. Encryption alone is the easy third of it.
Is emailing tax documents to clients acceptable?
It is the common practice and the weakest link: mailboxes are widely accessible, rarely logged usefully and retained indefinitely. A portal's main advantage is that access can be withdrawn, which email never offers once sent.
How long should portal documents be retained?
A decision to make deliberately rather than inherit from a default. Set it against your own retention policy, and check the vendor lets you configure it instead of keeping everything forever by default.