What is the safest way to send a QuickBooks file to an Indian CA firm?

The safest method depends on whether the client uses QuickBooks Desktop or QuickBooks Online. For QBO, add the Indian CA as an accountant user — no file transfer needed, access is logged and revocable. For QuickBooks Desktop, export the Accountant's Copy and transfer via encrypted file sharing (ShareFile, Citrix Files, or password-protected zip via encrypted email). Never send QuickBooks files as plain unencrypted email attachments.

Can I add an Indian CA firm as an accountant user in QuickBooks Online?

Yes. In QuickBooks Online, go to Settings, then Manage Users, then Accounting Firms. Enter the Indian CA's email address. They receive an invitation and access the client's books directly in QBO — no file download or transfer required. Access is logged by Intuit, can be set to read-only or full accountant access, and is revocable at any time. This is the simplest and most auditable transfer method for QBO clients.

Do I need a signed NDA before sending QuickBooks files to an Indian firm?

Yes. A signed NDA and Data Processing Agreement must be in place before the first file transfer. The NDA covers confidentiality obligations. The DPA specifies how client data is stored, who has access, how it is transferred, and when it is deleted after the engagement ends. Sharma Jyoti and Co provides both documents as standard before onboarding begins — the CPA does not need to draft them.

Is it legal to share client QuickBooks files with an Indian CA firm?

Yes, with two requirements in place. First, the client must sign written IRC Section 7216 consent naming the Indian firm before any tax return information is shared — this includes QuickBooks files used for tax preparation. Second, the Indian firm must sign an NDA and Data Processing Agreement before receiving any files. With both documents signed, sharing client data with an Indian CA firm is fully compliant with IRS rules and AICPA confidentiality standards.

How to Send QuickBooks Files to India Securely

Q: What files does an Indian CA firm need to prepare bookkeeping or tax workpapers?

For bookkeeping: QuickBooks file or QBO access, bank and credit card statements for the period, any invoices or receipts the client has not already uploaded to QuickBooks. For tax workpaper preparation: QuickBooks file or QBO access, prior-year return (PDF), all 1099s and W-2s received, any specific documents relevant to the return — mileage log, home office square footage, brokerage 1099-B for capital gains clients.

The Two Questions Every CPA Asks Before Sending Files to India

When a CPA decides to outsource bookkeeping or tax workpaper preparation to an Indian CA firm, the first practical question is not about cost or quality — it is about the mechanics: how do I actually get my client's QuickBooks file to them, and is it safe to do so?

The answer to the safety question is straightforward: yes, with the right legal agreements and transfer method in place. Client financial data has been transferred internationally by accounting firms for two decades. The legal framework — IRC Section 7216, AICPA confidentiality standards, and standard NDA and data processing agreement practice — is well-established. The practical question is which transfer method to use, and that depends on whether your clients use QuickBooks Online or QuickBooks Desktop.

This article covers both scenarios, ranked by security and ease of use, with a pre-transfer compliance checklist at the end that every CPA should complete before the first file goes out.

Method 1 — QuickBooks Online Accountant Invite (Recommended for QBO Clients)

For clients on QuickBooks Online, the accountant invite method is the best option. No file is exported, transferred, or stored on anyone's local device. The Indian CA accesses the client's live QBO file directly through Intuit's platform, with all access logged by Intuit's audit trail.

How to set it up:

In QuickBooks Online, go to Settings (gear icon) then Manage Users then Accounting Firms
Click Invite, enter the Indian CA's email address, and select their access level — Accountant (full access to run reports, make journal entries, and reconcile) or Custom (restricted to specific functions)
The Indian CA receives an email invitation, accepts it, and the client's file appears in their QuickBooks Online Accountant dashboard
Access is revocable at any time — return to Manage Users and remove the user

Security profile: Intuit encrypts all data in transit and at rest. Access is logged — the CPA can see every action taken in the file. No file ever leaves Intuit's servers. The Indian CA works in the same environment as the CPA — the only difference is geography. This is the most auditable method available.

Limitation: Only works for QuickBooks Online. QuickBooks Desktop clients require a different method.

Method 2 — ShareFile or Citrix Files (Best for QuickBooks Desktop)

For QuickBooks Desktop clients, the Accountant's Copy export is the standard method for sharing files with external reviewers. The export creates a file with the extension .QBX — a read-restricted version of the client's company file that the Indian CA can work in while the client continues using the main file. When the Indian CA sends back the Accountant's Changes file (.QBY), the CPA imports it to apply all changes at once.

How to transfer the file securely:

In QuickBooks Desktop, go to File, then Send Company File, then Accountant's Copy, then Client Activities, then Save File
Set a dividing date — transactions before this date are locked for the client; the Indian CA works on everything up to and including this date
Upload the .QBX file to ShareFile (Citrix), a password-protected folder in Google Drive or Dropbox Business, or send via encrypted email using ProtonMail or your firm's encrypted email system
Never send QuickBooks files as plain Gmail or Outlook attachments without encryption — these are unencrypted in transit

ShareFile specifics: ShareFile (now part of Citrix) is the most widely used secure file transfer platform in US accounting firms. It encrypts files in transit and at rest, logs all downloads, and supports expiring links. The Indian CA downloads the file, works in their local QuickBooks Desktop installation, and returns the .QBY changes file via the same platform.

Method 3 — Encrypted Cloud Folder (Google Drive Business or Dropbox Business)

For CPA firms that do not use ShareFile, a shared folder in Google Drive Business or Dropbox Business is an acceptable alternative, provided the account is a business tier with admin controls — not a personal Gmail Drive account.

Setup requirements for secure use:

Use Google Workspace (Business Starter or above) or Dropbox Business — not personal accounts. Business accounts include admin controls, audit logs, and data processing agreements with Google or Dropbox that cover GDPR and standard US data privacy requirements
Create a dedicated folder for the Indian CA firm — do not give access to the entire Drive
Share the folder with the Indian CA's specific email address, not via a public link
Enable two-factor authentication on both sides before sharing access
After the engagement ends, remove the Indian CA's access and archive the folder

This method works well for ongoing monthly bookkeeping relationships where the Indian team needs regular access to a dedicated client folder containing bank statements, receipts, and the QuickBooks file export.

Method 4 — Encrypted Email with Password-Protected Zip

For one-off file transfers where setting up a shared folder is more overhead than the engagement warrants, a password-protected zip file sent via encrypted email is an acceptable method for lower-sensitivity transfers.

How to do it properly:

Compress the QuickBooks file (.QBX or .QBB export) into a zip archive with AES-256 encryption using 7-Zip (free) or WinZip
Send the zip file via email — standard Gmail or Outlook is acceptable for this step since the file itself is encrypted
Send the password in a separate message, or better, via a separate channel (text message or phone call) — never in the same email as the file

When to use this method: Suitable for a single file transfer on a new engagement before a permanent transfer workflow is established, or for sending supporting documents (bank statements, 1099s) alongside a primary file already transferred via ShareFile.

When not to use this method: Do not use this as your primary ongoing transfer method for monthly bookkeeping clients. The overhead of password management and the lack of audit logging make ShareFile or cloud folder access more appropriate for recurring engagements.

What Files to Send — Complete Checklist by Engagement Type

Engagement Type	Files to Send	Notes
Monthly bookkeeping	QBO accountant access or QB Desktop .QBX export; bank and credit card statements for the month; any receipts or invoices not already uploaded	QBO invite is ongoing — no monthly re-sending needed. Desktop requires monthly export.
Tax workpaper preparation (Schedule C)	QuickBooks file or QBO access; prior-year return; all 1099-NEC and 1099-MISC received; vehicle mileage log; home office square footage if applicable	Brief note flagging any known issues — prior disputes, new business activity, major asset purchases
Tax workpaper preparation (S-corp / partnership)	QuickBooks file or QBO access; prior-year return; list of shareholders or partners with ownership percentages; any loan agreements or major transactions	K-1 allocations require percentage confirmation from the CPA before the Indian team can finalise
Catch-up bookkeeping (full year)	QBO accountant access or full QB Desktop company file backup (.QBB); 12 months of bank and credit card statements; any prior-year closing entries or trial balance	Full .QBB backup (not Accountant's Copy) is appropriate for catch-up work where the Indian team needs unrestricted access to fix the entire file
Bank reconciliation only	QBO access or QuickBooks file; bank statements for the reconciliation period	Narrowest scope — QBO custom access limited to reconciliation functions is appropriate

Pre-Transfer Compliance Checklist

Complete all of these before the first file is sent. This is not optional — IRC 7216 violations carry civil and criminal penalties, and AICPA confidentiality standards require the same steps.

IRC Section 7216 client consent signed: Every client whose tax data will be shared must have signed written consent naming the Indian firm and describing the purpose. Embed this in your engagement letter so all clients sign at the start of the year. Standalone consent forms are needed for clients with existing engagement letters that predate the outsourcing arrangement.
NDA signed by the Indian firm: The NDA must be signed before the first file transfer. It covers confidentiality, permitted uses of client data, and what happens to data when the engagement ends.
Data Processing Agreement signed: The DPA specifies how client data is stored, who within the Indian firm has access, how data is transferred (encryption standards), and deletion procedures after engagement end. Sharma Jyoti and Co provides both the NDA and DPA as standard documents — the CPA does not need to draft them.
Two-factor authentication enabled: On all file sharing platforms (ShareFile, Google Drive, Dropbox) and on QBO accountant access. This is a basic security requirement that most firms already have in place for their own accounts.
Access scope confirmed: The Indian CA should have access to the minimum required to complete the engagement — specific client files or specific QBO functions, not broad access to the CPA firm's entire file system or all clients.
Post-engagement deletion confirmed: The DPA should specify a retention period after which the Indian firm deletes or returns all client data. Confirm this is understood and agreed before the first file is sent.

What Happens to the File After the Indian CA Finishes

Once the Indian CA completes the engagement and delivers workpapers or the reconciled QuickBooks file, the data handling obligations continue:

For QBO accountant access: revoke access in Manage Users once the engagement is complete. The Indian CA no longer has access to the file. Intuit logs the revocation.
For ShareFile or cloud folder: remove the Indian CA's access from the shared folder. The files remain in the CPA's folder — only the sharing permission is removed.
For Desktop file exports: the Indian CA firm should delete the .QBX file from their system after returning the .QBY changes file. The DPA should specify this — confirm it was done.
The CPA retains all workpapers per their standard document retention policy. The Indian firm retains no client data beyond the period specified in the DPA.

About This Article
Written by Sharma Jyoti, CA (ICAI) — Founder, Sharma Jyoti and Co. We are an ICAI-registered Chartered Accountant firm providing outsourced bookkeeping and tax workpaper support to US CPA firms. NDA and Data Processing Agreement provided as standard before any files are shared. Learn more about our firm →

Frequently Asked Questions

For QBO clients, add the Indian CA as an accountant user — no file transfer needed, access is logged by Intuit and revocable at any time. For QuickBooks Desktop, export an Accountant's Copy (.QBX) and transfer via ShareFile or a password-protected encrypted zip. Never send QuickBooks files as plain unencrypted email attachments.

Yes. In QBO go to Settings, Manage Users, Accounting Firms, then enter the Indian CA's email. They receive an invitation and access the file directly in QBO — no download or transfer required. Access is logged, can be set to read-only or full accountant level, and is revocable at any time. This is the simplest and most auditable method for QBO clients.

Yes. A signed NDA and Data Processing Agreement must be in place before the first file transfer. The NDA covers confidentiality. The DPA specifies data storage, access controls, transfer methods, and deletion after the engagement ends. Sharma Jyoti and Co provides both documents as standard — the CPA does not need to draft them.

Yes, with two requirements: signed IRC Section 7216 client consent naming the Indian firm before any tax-related data is shared, and a signed NDA and Data Processing Agreement with the Indian firm before the first file transfer. With both documents in place, sharing client data with an Indian CA firm is fully compliant with IRS rules and AICPA confidentiality standards.

For bookkeeping: QuickBooks file or QBO access, plus bank and credit card statements for the period. For tax workpaper preparation: QuickBooks file or QBO access, prior-year return, all 1099s and W-2s received, and any specific documents for the return — mileage log, home office square footage, brokerage 1099-B for capital gains clients. A brief briefing note flagging known issues helps the Indian team prioritise correctly.

How to Send Client QuickBooks Files to India Securely