Client Documents Too Large for the Office Mailbox

A bounce the office never sees

In February a bookkeeper's clients start sending their slips and statements by email: a phone photo of a tax slip, a scanned bank statement, a year of receipts in one file.

Some of the larger messages never arrive. The client gets a bounce, worded in technical terms, and either misses it or takes it for junk.

The office sees nothing at all. Weeks later a client phones to ask whether everything came through, and it did not.

Every mail server has a size limit

Each mail server sets a maximum size for a single message. The client's server has one for sending, the office's server has one for receiving, and the smaller of the two decides.

Limits vary. Some servers stop at 10 MB, others allow 20 or 25 MB or more, and the people sending rarely know either figure.

A full mailbox causes a similar bounce. Once the office mailbox reaches its storage quota, new messages are refused until someone clears space.

Why attachments grow on the way

Email was designed for plain text. To carry a file, the mail program converts it into text characters, an encoding that makes it about a third larger.

So a 15 MB scan becomes a message of roughly 20 MB. A client who checked that the file was under the limit can still be over it once it is attached.

Scanners and phones add to it. A page scanned in colour at high resolution can run to several megabytes, and a twenty-page statement adds up quickly.

Why email is a poor home for financial documents

Size is only the first problem. Every emailed slip or statement leaves copies in places nobody controls:

• The client's sent folder, on every device that syncs it.
• The client's mail provider, for as long as the account exists.
• The servers in between, some of which pass mail without encryption.
• The office inbox, on every computer and phone that checks it.
• Backups of all of the above.
• A wrong recipient, picked by autocomplete in a hurry.

Each copy holds account numbers, identification numbers and income figures. The documents are needed for a few weeks; the copies can last for years.

What the office can check on its own side

Ask whoever looks after the mail what the receiving limit and the mailbox quota are. Many offices have never been told either number.

Raising both helps for a while. It does nothing for a client whose own server caps outgoing mail at 10 MB, and it adds to the sensitive files piling up in the inbox.

Publishing the limit for clients helps less than it seems. Few people know how large their scans are, and fewer still know about the extra third.

A secure upload page on the firm's own site

The better route is a page on the firm's own website where clients upload documents directly. The file travels from the client's browser to the firm's server, with no mail servers in between.

The page must use an encrypted connection, shown by https in the address bar, so nothing can be read on the way.

Each client signs in, or uses a private link issued to them alone, so nobody sees anyone else's files.

The firm sets the size limit on its own server, high enough for a year of statements, and the page says what that limit is.

What happens after the upload

Uploaded files belong in a folder the web server never publishes, beyond the reach of any web address, and only staff can download them.

The office receives a short notice that a file has arrived, with no attachment. Staff move it into the firm's own records and delete it from the server on a set schedule.

Every upload and download is logged, so the firm can show who sent what and when. Backups of the upload folder need the same care as the files themselves.

A worked example

A study abroad agency helps high school graduates apply to universities overseas. Each student sends transcripts, certificates, reference letters and a personal statement, much of it scanned by parents at home.

Every winter, as deadlines approached, students insisted they had sent documents the agency never received. Large scans were bouncing at the agency's 10 MB receiving limit, and the bounces went to students who rarely read them.

The agency added an upload page to its site, on an encrypted connection. Students sign in with the account they already use to follow their applications, and the page accepts files well above the old email limit.

Advisers get a notice when a file arrives, and the student sees a list of everything received so far. Files leave the server once they are in the student's record.

Students see the result on the page instead of waiting for a bounce, and nothing depends on two mail servers agreeing about size.

Building it properly

An upload page touches security, storage and the server's own settings, from the largest file it accepts to where files are kept and who can read them. Those are hosting decisions as much as design ones.

Test it with real files from real devices: a phone photo, a large scanned PDF, a file with an awkward name. Plan, too, for the day a client uploads the wrong thing.

The counter-case

A firm with a handful of clients who drop off paper in person has little need of an upload page. Paper carries its own risks, but not these.

A firm whose accounting software already provides a secure client portal may not need another one. The job there is making sure clients actually use it.

But any office that asks clients to email sensitive documents is asking them to accept the size limits and the copies. A page on the firm's own site removes both.

Moving documents off email

1. Ask your host for the receiving limit and quota.
2. Search the inbox for documents sitting in mail.
3. Plan an upload page on your own site.
4. Use an encrypted connection and private logins.
5. Store the files outside the public website.
6. Notify staff without attaching the file.
7. Delete from the server on a set schedule.

Step five decides whether the page is secure or merely looks it. A file stored in the public part of a site can be opened by anyone who learns or guesses its address.

A dealer price list anyone can open sets out how to check that files behind a login are protected, and not only the page that lists them.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.