Document Permissions and Access Control for Accounting Firms

Consider a firm that has just lost a staff accountant. The exit is amicable, the laptop is returned, the email account is closed by lunch. What the partner cannot produce, when asked that afternoon, is a list of everything the departed employee could open: which client files, which shared folders, which documents that were copied into a personal workspace two years ago and never cleaned up. The firm can name every client whose affairs must be kept confidential. It simply cannot say who, at this moment, has access to them.

This is the gap that matters, and it is rarely the one vendors talk about. The market is full of sensible advice about encryption, retention schedules, and where servers are hosted. All of it assumes a prior question has been answered: who can see what, right now, and can you prove it. A permission structure that lives in the memory of whoever set it up is not a control. It is a hope with a password.

Access control is not a feature to be admired in a demo. It is the quiet, unglamorous discipline of knowing — without asking around — which of your people can open which documents, and being able to change that answer in a minute rather than an afternoon. Firms that cannot do this are not being careless. They have simply never been shown the alternative.

The query underneath the search

Nobody types “what is document management” into a search bar at eleven o’clock at night. They type some version of: how do I stop the wrong person from opening the wrong client file. The phrasing varies — “restrict folder access,” “secure client portal,” “document permissions for accounting firm” — but the question underneath is always the same, and it is rarely a technical one. It is a question about certainty.

Consider a firm that has just hired a new staff accountant. Someone creates a login, adds her to the shared drive, and, because the folder tree is long and the afternoon is short, grants access to the whole client folder rather than the four engagements she will actually touch. Nothing bad happens. That is precisely the problem. Nobody knows whether anything bad could happen, and nobody can find out without clicking through forty folders and reading the inherited permissions on each one.

This is the quiet anxiety of professional practice. An accounting firm worries about matter-level confidentiality and the audit trail on tax workpapers. A law firm worries about ethical walls — a lateral hire who must not see matters involving a former client’s adversary. An insurance brokerage holds policyholder financials and claims notes. A financial adviser holds statements that HR, of all departments, should never stumble across, yet often does, because HR set up the drive. In each case, the exposure is not malice. It is architecture.

A folder tree can tell you where a document lives. It cannot tell you who can see it. That distinction matters most at four moments: a new hire arrives, a trusted employee departs, a client asks for their own file, and a regulator or professional-liability insurer asks, politely, who has had access and when. Firms running their files through a consumer cloud drive — Dropbox Business, Google Drive, Box — discover the gap at exactly these moments, because those tools were built for collaboration first and matter-level control second. SharePoint can be configured to answer the question, though the configuration tends to require an administrator the firm does not employ. NetDocuments and SmartVault were built for this world, as was ShareFile, and each carries its own assumptions about how a firm works.

The buyer is not shopping for features. The buyer is shopping for the ability to answer, without hesitation, a question a partner can already ask: who can open this file right now.

What permissions actually do — and what they do not

Permissions are the answer to a specific question: who can do what, to which document, under which circumstances. The discipline has its own vocabulary, and it is worth learning before you evaluate any product.

There are two broad approaches. Role-based access assigns rights by job function — every associate sees the same set of folders, every paralegal another. Per-folder grants assign rights to specific people for specific locations, which offers finer control at the cost of more administration. Most firms end up with a hybrid: roles for the general population, individual grants for the exceptions that professional practice inevitably produces.

Inheritance is the mechanism that makes either approach tolerable. A folder passes its permissions to everything inside it, so you set rules once at the level where they make sense rather than file by file. The trouble begins when someone breaks inheritance — grants an exception to a subfolder and forgets — and the exception outlives its reason. A permission granted for a March engagement should not survive into August because nobody revoked it.

Permissions also distinguish between actions that look similar but are not. Viewing a file is not downloading it. Downloading is not sharing it onward. Sharing is not deleting it. A well-configured system lets you separate these, so the temp who can read a client folder cannot also email it to a personal account or empty the folder on their way out. This is the principle of least privilege: give people the minimum access their work requires, and nothing they might use later for convenience.

Honesty requires saying what permissions cannot do. They reduce accidental exposure and make intent explicit — an auditor can see who was supposed to have access, which is rather the point. They do not stop a determined insider with legitimate access from misusing a file; a person permitted to read a document can still read it. And they are only as reliable as the offboarding discipline behind them. A departed employee whose access lingers for ninety days is not a technology failure. It is a process failure that technology was politely asked to cover for.

No tool — not EEZYDOCS, not ShareFile, not NetDocuments — fixes a structure nobody maintains. Permissions reward the firms that treat them as a practice, not a setup task.

What EEZYDOCS does with a document set

EEZYDOCS is, at its core, three verbs: store, share, and control. What matters for a partner with a locked-down client list is how those verbs behave in practice.

Store means the document set lives in a structured space rather than a folder tree that grew by accident. Files are organized so that a firm can keep client work, internal records, and compliance material in a coherent arrangement — one that a new hire can be shown rather than left to reverse-engineer.

Control means access is set per person or per group. A partner can decide that a given client file is reachable by the engagement team and no one else, and that decision holds until it is changed. This is the direct answer to the question that opened this article: instead of guessing who can reach a file, you define it. If a matter involves a conflict wall or a sensitive estate, that definition is the point.

Share means granting access is a deliberate act, not a default. When you send a client file to an outside party, you are extending a permission, not attaching a document to an email and hoping. What EEZYDOCS does not claim is equally worth stating: if your firm needs a full audit trail of every view and download, or document versioning with check-in and check-out, those capabilities are not part of the product as described. The product site at eezydocs.net is the place to confirm current functionality.

Search works across what you are permitted to see. An employee searching for a client name will find the files their permissions allow — and will not surface what they cannot reach. This is the quiet corollary of access control: the system enforces the boundary in both directions.

For firms that have outgrown shared drives but do not need the full apparatus of NetDocuments or SharePoint, EEZYDOCS at $10 per user per month occupies a deliberate middle ground. It does not try to be a practice-management platform. It is a place where documents are kept, access is explicit, and the partner’s list of sensitive clients maps to an actual setting rather than a hopeful assumption.

The price, stated once and plainly

EEZYDOCS costs $10 per user per month. That is the whole of it. There is no tier to decode, no feature matrix to consult, no promotional rate that expires the moment you have committed your files. For a firm accustomed to enterprise software quotes that arrive with a cover letter and a follow-up call, the plainness is almost disorienting.

The honest budgeting exercise is equally plain. Per-seat pricing scales with headcount, which means the number that matters is not the payroll but the count of people who genuinely need to touch client documents — the practitioners, the administrators, the partners who review rather than merely sign. A twelve-person firm where eight people work in the files pays for eight seats. The arithmetic takes less time than the meeting it would take to approve it.

What that figure buys, in the language of the preceding sections, is the ability to answer the access question — who can open this file, and why — without an IT ticket. Weighed against the unpriced alternative, an open shared drive where permissions are inherited, forgotten, and silently cumulative, ten dollars a seat is a line item. The cost of the other arrangement does not appear on any invoice, which is precisely what makes it expensive.

Against the alternatives a firm will likely evaluate: SmartVault, ShareFile, Box, Dropbox Business, Google Drive, Microsoft SharePoint, and NetDocuments each carry their own pricing structures, most of them tiered by feature set or storage. Their published rates are on their respective sites, and EEZYDOCS makes no claim to undercut them. The comparison that matters is not the sticker but the shape of the commitment — whether the price quoted is the price paid, and whether the person approving it can state it from memory.

For any other EEZY product a firm considers alongside this one, pricing is on the site.

The first week with a real folder tree

Consider a firm that has decided to stop treating its shared drive as a junk drawer. The first week is not about uploading; it is about deciding. Begin with an inventory of document types: client files, contracts, HR records, compliance materials. The list is usually shorter than expected, which is precisely the point. A folder structure built around four or five categories will hold. One built around thirty will not.

Decide the top-level structure before a single file moves. This is the moment to define who should reach each area and write it down — not in a policy binder, but in a sentence per folder. “All staff” for the compliance library. “Partners and the office manager” for HR. “Assigned team only” for client work. The writing-down matters more than it seems. A permission scheme that exists only in someone’s head will be forgotten by the person who replaces them.

Then migrate one category, not everything. Client files are the usual candidate, since they carry the clearest confidentiality obligations and the most obvious access boundaries. Upload, assign permissions, and live with it for a few days. Resist the urge to accelerate. A structure that survives its first week of real use is probably sound; one that produces three access requests by Wednesday is telling you something.

Before inviting the rest of the staff, test from a sample login — an account with the permissions a typical junior employee would hold. Confirm what is visible, what is searchable, and what is absent. This step is skipped more often than any other, and it is the one that reveals whether the written policy matches the enforced reality.

The underlying truth is that permissions are a policy decision wearing software clothes. EEZYDOCS, SmartVault, ShareFile, NetDocuments — the tool will faithfully enforce whatever structure, sensible or muddled, you hand it. The software is not the hard part. The deciding is.

The honest alternatives

The market for document control is not short of credible options, and pretending otherwise would be a disservice. The question is not which product is best in the abstract but which one matches the size and temperament of your firm.

General cloud drives — Google Drive, Dropbox Business, Box — are where most small companies already keep their files, which is no small thing. The incumbency is real: your staff know how to use them, and the ecosystem fit with everything else you run is hard to argue with. The friction arrives when you try to impose a permissions structure that reflects a firm’s actual hierarchy of responsibility. Shared drives and folder-level access controls exist, but they tend to drift, and reconstructing who can see what after a year of organic growth is a project nobody volunteers for. Pricing is on their sites.

Client-portal and accounting-oriented tools — SmartVault, ShareFile — were built with professional services in mind, and it shows in the workflows. They handle the client-facing exchange of documents with more discipline than a general drive. The honest friction here is pricing that typically requires a conversation with a salesperson, and feature sets that can exceed what a two-partner practice will ever touch. For firms that need depth, that is money well spent. For those that do not, it is overhead.

Practice-management and dedicated legal DMS — NetDocuments, Microsoft SharePoint — offer genuine depth for large practices with compliance obligations and IT staff to match. SharePoint in particular rewards organizations that can commit to an implementation project and ongoing administration. That capability is real, and so is the cost in time and attention. NetDocuments, similarly, is built for firms whose document volumes justify enterprise-grade structure. Pricing for both is on their sites.

EEZYDOCS occupies a narrower position: $10 per user per month, with permissions and a searchable structure, for a small company that wants control without an implementation project. It will not replace a legal DMS at a two-hundred-lawyer firm, nor should it try.

Where it sits in a small company’s stack

A document store with permissions does not replace the systems a firm already runs. It sits beside them. The accounting platform keeps the ledger. Practice management keeps the matters, the deadlines, and the client records. Email remains where most of the noise lives. Backup remains the last line against catastrophe, and it is not a permission model, whatever the marketing suggests. The document layer’s job is narrower: to hold the files themselves, to say who may open them, and to keep that answer current as people join, leave, and change roles.

This is the point at which buyers tend to overcorrect. A firm that has outgrown a shared drive often assumes the next step is an enterprise implementation, with committees, consultants, and a rollout measured in quarters. It rarely is. The realistic buyer is a small professional firm, or a small company with contracts, HR files, and compliance records, that needs a searchable structure and working permissions without the apparatus of a large deployment. Products such as NetDocuments or Microsoft SharePoint serve firms that want that apparatus, or already have the staff to run it. Dropbox Business, Box, Google Drive, and SmartVault occupy the ground closer to the shared drive, with varying degrees of control. ShareFile has its adherents among accountants.

EEZYDOCS is built for the middle case: a structured store with permissions, at $10 per user per month, for a company that wants to know who can see a file without hiring someone to manage the answer. It belongs to the EEZYVERSE family, so a company using other EEZY products signs in once and sees one central bill at eezycloud.com/account/. Support hours are published at eezycloud.com/support (Monday–Friday 9 AM–8 PM, Saturday–Sunday 9 AM–12 PM Eastern), and sites are hosted on Microsoft Azure. None of this is a reason to buy. It is simply the context a buyer needs before deciding whether the fit is right.