The accounting data room for client documents, workpapers and tax returns
Collect PBC items and tax-season documents into a secure folder for each client, share workpapers, returns and QoE reports on links you can watermark and revoke, and see which pages each client, lender or buyer read: one secure room per engagement.
The data room purpose-built for CPA firms, audit teams, and tax professionals. Organize engagement documents, control access per client, and survive tax season without the chaos. Set up in under 5 minutes; the median time from sign-up to first uploaded document is 4 min 19 s.
No credit card · 7-day Data Room trial that never auto-charges · clients view free, no account · 24/7 support
Last updated October 2026
8,000+ customers in 60+ countries · $44.7B in client assets
Peony staff can't open your documents, your documents aren't used to train AI, and Peony has had no data breach since launch.
What is an accounting data room, and how does Peony run one for CPA firms?
Peony is a virtual data room that accounting, audit and tax firms use to collect client documents, share workpapers, returns and QoE reports behind an NDA, and see which pages each client reads.
An accounting data room is a secure online space where a firm collects client source documents, shares workpapers, returns and reports with verified access and page-level read tracking, and runs diligence when a client is bought or sold. It typically holds trial balances, general ledgers, bank statements, tax forms and returns, engagement and representation letters, and quality of earnings reports.
Peony gives you client-specific document portals, engagement-level access controls, and AI-powered search across all your workpapers — at a fraction of legacy VDR pricing. A firm serving many clients runs on Data Room: $52 per admin per month billed yearly ($75 monthly), with unlimited client rooms and upload folders, and clients view free with no account.
- Collect documents client by client: each client gets its own upload folder or room, and adds W-2s, 1099s, K-1s, bank statements, trial balances and PBC items from a link, with no account.
- Share files you can take back: workpapers, draft returns and financial statements open after an emailed one-time code, carry the viewer's name in a watermark, and stop opening when the engagement closes.
- Run QoE and transaction diligence: one group per buyer or lender behind a signed NDA, the target's uploads in request folders, Q&A in the room, and a record of every page each party read.
Peony at a glance
- Built for
- CPA firms, audit and assurance teams, tax practices, outsourced accounting and CFO firms, forensic accountants and transaction services teams, sharing with clients, their lenders and attorneys, and buyers in a deal.
- Typical plan
- Data Room, $52 per admin per month billed yearly ($75 monthly): unlimited rooms, documents and storage, a group with its own folder permissions for each client, client upload folders, dynamic watermarks, Screenshield, a custom domain, the per-client audit trail, Visitor Q&A, AI room generation and Index documents.
- Pricing
- Business $30, Data Room $52 and Deal Team $64 (minimum 4 admins) per admin per month billed yearly ($44, $75 and $89 monthly); Enterprise is custom. Free ($0) covers 50 documents and 500 MB as tracked single-file links; data rooms start on Business.
- Clients
- Clients are unlimited and free on every plan and don't need a Peony account. You pay per admin, not per viewer.
- Rooms and storage
- Unlimited data rooms, documents and storage on Data Room and above, and no per-file size cap on any plan. Business includes 3 data rooms per admin, 1,000 documents per admin and 100 GB of storage, with no per-file size cap.
- Per client or engagement
- One room per client or engagement, or one room with a group per client and its own folder permissions (Data Room). Duplicate a data room copies its files and folders into a copy you convert to a data room from its menu; groups, links and analytics start clean.
- Client uploads
- Grant Upload on a client's folder and the client adds files with no account; each upload is attributed to the link and viewer (Data Room). Anyone who can upload to a folder can also open it, so each client gets its own folder or room.
- Search and AI
- AI document Q&A answers questions across ledgers, workpapers and K-1s and cites the page (Business and up; on after the trial). On Data Room, text extracted from each upload makes the whole room searchable, and Index documents numbers every file.
- Activity records
- Page-level views on every plan; CSV export of views, sessions and downloads (Business); a per-client audit trail (Data Room). Logs are kept 1 year on Business, 2 years on Data Room and with no time limit on Deal Team and Enterprise.
- Engagement letters
- Unlimited e-signatures from Business for engagement letters; a signed NDA that emails a signed PDF to both sides on Data Room.
- Redaction
- Redaction boxes on PDFs remove SSNs, account numbers or client names permanently from a new copy before it goes to an outside reviewer (Deal Team).
- Works alongside
- Your tax software, audit platform and practice-management system stay the systems of record; Peony is the controlled exchange layer for the documents that move between your firm and clients, lenders and buyers.
- Hosting
- AWS US (us-east-1); EU-region hosting on Enterprise. A standard DPA with SCCs is available on request on Deal Team and Enterprise.
- Security
- AES-256 at rest, TLS 1.2+ in transit. Peony staff can't open your documents, your documents aren't used to train AI, and Peony has had no data breach since launch. Peony's incident-response policy commits to telling affected customers within 72 hours of confirming an incident that affects customer data. SOC 2 Type II-ready and ISO 27001-ready, with both audits underway. Compliance and certifications
- Setup
- Median 4 min 19 s from sign-up to first uploaded document (State of M&A Data Rooms, Q3 2026 edition).
- Trial
- 7-day Data Room trial you start yourself: no credit card, and it never auto-charges. Rooms, files, links, analytics and NDA settings carry over when you upgrade. AI features switch on after you upgrade.
- Support
- 24/7 support, handled directly by the Peony team across Europe, US and Asia hours, with no outsourced tier. Everyone you speak to on Peony support has M&A experience at elite boutiques or bulge-bracket banks, VC experience, or has raised $1M+ themselves.
- Customers
- 8,000+ customers in 60+ countries, with $44.7B in client assets.
Why do accounting firms move client documents off email and shared drives?
Accounting firms move client documents into a data room such as Peony because email and shared drives scatter client financials, can't limit who sees each engagement, and keep no record of who opened what.
Accounting document management is broken: client financials scattered across email, portals, and USB drives, audit workpapers without proper access controls, and tax season deadlines with hundreds of clients and thousands of documents. It does not have to be this way.
Scattered client documents
Trial balances, general ledgers, and bank statements arrive via email, Dropbox links, and even USB drives. Tracking what you have and what is missing wastes hours.
Weak workpaper controls
Audit workpapers need SOC 2-level access controls, but most file-sharing tools cannot restrict who sees what at the engagement level.
Tax season chaos
Hundreds of clients, dozens of documents each, and tight filing deadlines. Form 1040s, K-1 packages, and 1120s pile up with no central system to manage them.
Manual review workflows
Partner review and sign-off processes rely on email chains and spreadsheet trackers. Engagement letters and management representation letters get lost in the shuffle.
Which accounting firms use a data room, and for what?
CPA and tax practices, audit teams, QoE providers and forensic accountants use a Peony data room to collect client documents, send workpapers and reports, and run diligence when a business changes hands. Peony is built for how accounting firms actually work: a room or upload folder per client, access set per engagement, and one tracked link for every outside party.
CPA and tax practices
A room or upload folder per client for tax-season documents (W-2s, 1099s, K-1s, brokerage statements), with draft returns sent back for review on view-only links. Data Room ($52/admin/mo billed yearly) covers unlimited clients.
Audit and assurance teams
A room per engagement for the PBC list, with request folders the client uploads into, staff limited to their own engagements, and representation letters behind email verification (Data Room).
Transaction services and QoE providers
A diligence room per deal: the target uploads ledgers and support, buyers and lenders get their own groups behind a signed NDA, and Visitor Q&A carries follow-ups. See the quality of earnings guide.
Outsourced accounting, bookkeeping and fractional CFO firms
Monthly close packages, board decks and lender reporting sent as tracked links, with each client's bank statements and receipts collected into its own upload folder.
Forensic accountants
Investigation files in a room only the investigation team and counsel can open, with dynamic watermarks naming every viewer and a per-viewer audit trail (Data Room).
Firms selling or merging a practice
One room with a group per bidder behind a signed NDA when you sell or merge a CPA firm. For the advisors who run those sales, see our accounting firm M&A advisor guide.
How do you collect tax documents securely from clients?
On Peony's Data Room plan, give each client its own folder with Upload permission behind email verification; the client adds tax documents from a link with no account, and Peony logs who sent each file.
Stop chasing clients for missing documents. Send each client a secure upload link with pre-built folder structures for trial balances, bank statements, and supporting schedules. Each upload is attributed to the link and the viewer who sent it. Upload also lets that client view and download what's in the folder, so give each client its own upload folder or room rather than one shared drop folder. Turn on Hide new content by default and files you add stay hidden from every link until you release them, and add an allow list so only the client's own addresses get in. NDA-gated access keeps sensitive financials protected from day one.
Personalized upload links
Give each client a branded, secure link to upload their general ledgers, bank reconciliations, and tax documents into their own folder (Data Room). No more chasing attachments across email threads.
Organized folder structures
Pre-built engagement folders for audit workpapers, tax returns, and advisory documents, from a template room you duplicate or AI room generation. Every Form 1040, 1120, and K-1 package has a home before the client even uploads.
Dynamic watermarks on workpapers
Every audit workpaper and financial statement is stamped with the viewer's identity and timestamp (Data Room). If a document leaks, you know exactly who shared it.
What should a tax-season request list include?
Income
W-2s, 1099-NEC, 1099-INT, 1099-DIV and 1099-B, 1099-R for retirement distributions, and K-1s from partnerships, S corporations and trusts
Deductions and credits
Form 1098 mortgage interest, 1098-T tuition, charitable receipts, childcare and medical costs
Identity and prior year
Government ID, last year's return, IRS and state notices, estimated-tax payment records
Business clients
Trial balance, general ledger, bank and credit card statements, payroll reports, fixed-asset additions
The full workflow, including the controls tax firms map to their WISP, is in how to send tax documents securely and how to collect documents from clients securely; the product setup is in file collection.
Can Peony be the secure client portal for an accounting firm?
Yes. On Peony's Data Room plan, each client gets a branded room on your firm's domain, opens it with an emailed one-time code and no account, and uploads into the folders you set.
Document platforms such as SmartVault offer a branded client portal for document sharing and requests, for clients who log in. A firm also shares with people who never get a portal login: a client's lender or attorney, a buyer's diligence team, an outside reviewer. Peony reaches them with a link, shows which pages each one read, and lets you switch access off. Your logo, cover image and brand card come with Business; your own subdomain, such as clients.yourfirm.com, with Data Room.
Keep in your practice-management system
- Workflow, deadlines, time and billing
- Organizers and tasks your tax software generates
- Documents for clients who already log in there
Send and collect through Peony
- Tax documents collected client by client into upload folders
- Draft returns and financial statements you need to know were read
- Financials for a client's lender, attorney or investors
- PBC requests and audit workpapers, per engagement
- QoE data requests and the final report for buyers and lenders
- Interactive models built in Claude or ChatGPT, rendered live
The longer comparison is in data room vs client portal. If you're replacing a general file-sharing portal, our ShareFile alternatives guide compares the options.
How do audit teams share PBC requests and workpapers in a data room?
Run one Peony room per audit engagement: the client uploads PBC items into request folders, your team reviews them in place, and staff see only the engagements they're assigned to.
Not every team member needs access to every client. Set granular permissions per engagement (Data Room), require 2FA, an emailed one-time code, for partner-level materials like management representation letters and SOC reports, and auto-expire access after filing deadlines pass. Inside your firm, put each engagement team's rooms in its own team and add partners to every team. For audits and reviews of SEC issuers, Rule 2-06 of Regulation S-X requires workpapers to be kept for seven years; your audit platform stays the record, and Peony keeps activity logs 2 years on Data Room and with no time limit on Deal Team and Enterprise.
Per-engagement permissions
Staff auditors see only their assigned engagements. Partners get full visibility across all clients. Forensic accountants access only the investigation files they need.
2FA for partner-level materials
Require two-factor verification before anyone can view engagement letters, management representation letters, or SOC audit reports: the viewer types a one-time code sent to their inbox (Business and up). An extra layer of protection where it matters most.
Auto-expire after deadlines
Set access to automatically revoke after tax filing deadlines or audit completion dates. No manual cleanup — links expire on schedule so stale access never lingers.
See page-level analytics and visitor groups.
"The team at Peony put craft into everything they do; from the product to their support, they shine through how much they care."
Germain Brion
Founder, Veritai
Mark Petrov
Head of Financials, Loop
Peony is by far the simplest and most intuitive way to populate and share data rooms with investors and partners. All the key analytics and features integrated into a sleek interface!
How do QoE and transaction services teams run a diligence data room in Peony?
Run one Peony room per deal with a folder per request category: the target uploads ledgers, buyers and lenders get their own groups behind a signed NDA, and every page they read is logged.
Give the target Upload on the request folders and View on the rest (Data Room), and use Visitor Q&A for follow-up questions so they stay in the room instead of an email chain. AI document Q&A finds a figure across the target's uploads with the page cited. When the report is final, share it view-only with each buyer or lender, watermarked with their name, and page-level analytics show which sections each one read. To keep customer names out of an early round, redaction boxes on PDFs remove them from a new copy (Deal Team).
What goes in a QoE data request?
Ledgers and statements
Monthly trial balances, general ledger detail, audited or reviewed financial statements, management accounts
Cash and debt
Bank statements and reconciliations, debt and lease agreements, owner and related-party transactions
Revenue and customers
Revenue by customer and product, top customer contracts, deferred revenue schedules
Working capital
AR and AP agings, inventory reports, accrued liabilities
Payroll and people
Payroll registers, owner and executive compensation, headcount by month
Tax
Federal and state income tax returns, sales and payroll tax filings, open notices. See the tax due diligence checklist
For what buyers test in the numbers, see our quality of earnings guide and the financial due diligence guide; for the deal-room mechanics in full, see the M&A data room guide.
Can AI search tax returns, K-1s and audit workpapers?
Yes. Peony's AI document Q&A answers plain-English questions across a room's ledgers, workpapers and K-1s and cites the page each answer comes from (Business and up).
Stop digging through filing cabinets of PDFs. Ask questions across your entire document library and get instant, sourced answers from general ledgers, trial balances, and engagement files. Your tax software stays where the return is prepared; Peony is where the source documents arrive, get found and get shared. Your documents aren't used to train AI: Peony's LLM providers work under data-handling agreements that prohibit training on customer content. AI features, such as AI document Q&A and AI room generation, switch on once you're on a paid plan.
Chat with financial documents
Ask questions across trial balances, general ledgers, and audit workpapers. AI retrieves answers with exact source references — no more manual cross-referencing.
Find specific transactions
Search your data room in plain English. Find specific journal entries, account reconciliations, or revenue recognition details without remembering file names or folder paths.
Automated client Q&A
Let AI handle routine client inquiries: turn on AI document Q&A for a client's group (Business and up) and the client gets cited answers about the documents in their room, while questions for your team go through Visitor Q&A (Data Room). Free up your team to focus on analysis, not admin.
What does the FTC Safeguards Rule require of CPA and tax firms?
The FTC Safeguards Rule requires accountants and tax preparers who complete income tax returns to run a written information security program that encrypts customer information, uses multi-factor authentication, logs user activity and oversees service providers.
- An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution under the rule (16 CFR 314.2). IRS Publication 5708 says tax and accounting professionals are covered regardless of size, and that the written plan, the WISP, is a requirement.
- Customer information must be encrypted both in transit over external networks and at rest (314.4(c)(3)), and multi-factor authentication is required for any individual accessing any information system unless the firm's Qualified Individual approves equivalent controls in writing (314.4(c)(5)).
- Firms must monitor and log the activity of authorized users (314.4(c)(8)), and dispose of customer information no later than two years after it was last used for the client, unless it's needed for business operations or another legitimate business purpose or the law requires keeping it (314.4(c)(6)).
- Firms must select service providers that can maintain appropriate safeguards, require them by contract, and periodically assess them (314.4(f)).
- Since May 2024, a notification event involving at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery (314.4(j)).
- Firms that hold customer information on fewer than 5,000 consumers are exempt from four provisions (16 CFR 314.6), but not from the written program, encryption or multi-factor authentication.
Where does Peony fit in a tax firm's WISP?
If you put client documents in Peony, Peony is one of the service providers your program oversees. These are the controls you can show in that review; your Qualified Individual and counsel decide how they fit your written plan.
Encrypt customer information in transit and at rest (314.4(c)(3))
AES-256 at rest, TLS 1.2+ in transit. A Peony link keeps the return or statement itself out of the email.
Let only authorized users in (314.4(c)(1))
Email verification with a one-time code and an allow list (Business); a group per client with its own folder permissions, where a file at No access is absent from that client's view (Data Room).
Multi-factor authentication (314.4(c)(5))
Admins sign in with an emailed one-time code or Google, with no password fallback. Clients verify with an emailed one-time code (Business). Your Qualified Individual decides how this fits your MFA policy.
Monitor and log authorized users' activity (314.4(c)(8))
Page-level view logs on every plan, a CSV export of views, sessions and downloads (Business) and a per-client audit trail (Data Room); logs are kept 1 year on Business, 2 years on Data Room and with no time limit on Deal Team and Enterprise.
Dispose of customer information on a schedule (314.4(c)(6))
Link expiry on every plan; deleting a room, folder or file removes it immediately and permanently.
Oversee service providers (314.4(f))
Peony completes your security questionnaire or vendor-risk form and provides a standard DPA with SCCs, on request on Deal Team and Enterprise. Peony's incident-response policy commits to telling affected customers within 72 hours of confirming an incident that affects customer data. Peony is SOC 2 Type II-ready and ISO 27001-ready, with both audits underway. Peony has had no data breach since launch.
IRS Publication 4557, Safeguarding Taxpayer Data, is the IRS guide to the same safeguards; our tax document guide maps them control by control.
Is Peony secure enough for client financial data?
Yes. Peony encrypts files with AES-256 at rest and TLS 1.2 or higher in transit, Peony staff can't open the documents in your room, and Peony has had no data breach since launch.
- Your documents aren't used to train AI: Peony's LLM providers work under data-handling agreements that prohibit training on customer content.
- Viewers read documents in the browser; files never leave Peony unless you allow downloads on a link.
- Peony's incident-response policy commits to telling affected customers within 72 hours of confirming an incident that affects customer data.
- Peony is SOC 2 Type II-ready and ISO 27001-ready, with both audits underway. A standard DPA with SCCs is available on request on Deal Team and Enterprise.
- Admins sign in with an emailed one-time code or Google, with no password fallback; Deal Team adds OAuth SSO (Google and Microsoft), and Enterprise adds SAML SSO, BYOK and EU-region hosting.
Hosting, access control and audit logs are in the security overview, the audit status in compliance and certifications, and the controls in Peony security.
How do you set up an accounting data room in Peony?
Setting up an accounting data room in Peony takes five steps: pick the plan, build an engagement template, set access per client, invite each client, then track activity and close the engagement.
The median time on Peony from account creation to first uploaded document is 4 min 19 s (State of M&A Data Rooms, Q3 2026 edition).
Pick the plan
Data Room ($52/admin/mo billed yearly) for client upload folders, per-client permissions and unlimited rooms. Business ($30) for sending tracked links and up to 3 data rooms per admin.
Build an engagement template
Folders for source documents, workpapers, drafts and final returns or reports, plus an upload folder; or let AI room generation draft them from one line. Duplicate a data room copies its files and folders into a copy you convert to a data room from its menu; groups, links and analytics start clean.
Set access per client
One group per client with email verification and an allow list, Upload on the client's own folder, and Hide new content by default; add a watermark and an NDA where the documents call for one.
Invite each client
List the client's emails in the group and Peony emails them an invitation; everyone not listed is blocked. Clients open it in the browser with an emailed one-time code and no account.
Track and close
Page-level analytics and an email on every open; Upload new version keeps the updated draft at the same link; expiry or switching the group off when the engagement closes.
What does Peony cost for an accounting firm?
On Peony, an accounting firm serving many clients runs on Data Room at $52 per admin per month billed yearly ($75 monthly), with unlimited rooms; clients, lenders and buyers view free.
You pay per admin, not per client, so a firm with three admins pays $1,872 a year on Data Room however many clients and engagements it runs. Legacy VDRs like Ideals charge thousands per month.
Business
$30/admin/mo
3 data rooms per admin
Tracked links, screenshot protection, NDA gate, AI document Q&A
Data Room · Most popular
$52/admin/mo
Unlimited rooms and storage
Client upload folders, per-client permissions, watermarks, custom domain
Deal Team
$64/admin/mo
Minimum 4 admins
Redaction, OAuth SSO, API access, standard DPA on request
Try Data Room
7 days free
No credit card, never auto-charges
Set up a client room and invite a client to test uploads
Prices per admin per month, billed yearly. Clients are free and unlimited on every plan. Business includes 3 data rooms per admin, 1,000 documents per admin and 100 GB of storage, with no per-file size cap.
Frequently asked questions
What is Peony, and is it a good fit for accounting, audit and tax firms?
Yes. Peony is a virtual data room that accounting, audit and tax firms use to collect client files by upload, share workpapers behind an NDA and see which pages each client reads. Data Room, the most popular plan, is $52 per admin per month billed yearly ($75 monthly), with unlimited rooms and storage; inviting clients is free and unlimited.
Can I try Peony before I pay?
Yes. Peony's Data Room plan has a 7-day free trial you start yourself, with no credit card, and it never converts to paid on its own. Rooms, files, links, analytics and NDA settings carry over when you upgrade. AI features, such as AI document Q&A and AI room generation, switch on once you're on a paid plan.
What documents belong in an accounting data room?
An accounting data room typically includes trial balances, general ledgers, bank statements and reconciliations, audit workpapers, engagement letters, management representation letters, tax returns (Form 1040, 1120, K-1 packages), SOC reports and supporting schedules. Peony lets you organize all of these with pre-built folder structures per engagement and granular permissions so each client, auditor, and partner sees only what they need (Data Room). Peony's auto-indexing extracts the text of every upload and builds a full-text search index automatically, so your team can locate any transaction across hundreds of client files, and AI document Q&A cites the page it came from. AI room generation drafts the folder structure for an engagement, and Index documents numbers every folder and file (1, 1.1, 1.2) so staff and clients can say "open 2.3" (Data Room).
How does Peony help CPA firms during tax season?
Peony streamlines tax season by giving each client a personalized, secure upload link into its own folder, so W-2s, 1099s, K-1s and statements land there instead of in email threads (Data Room). Instead of chasing attachments across email threads, clients upload directly into organized structures, with pre-built folders for their specific documents from a template room you duplicate for each client or from AI room generation. Clients upload with no account, each upload is attributed to the viewer who sent it, and Hide new content by default keeps files you add hidden until you release them. Peony's AI document Q&A (Business and up) lets your team find specific transactions or schedules across hundreds of client files instantly, with the page cited, saving hours during peak filing periods. Data Room is $52 per admin per month billed yearly, with unlimited rooms and storage.
Can CPA firms control client document access at the individual engagement level?
Yes. Peony supports granular folder-level and document-level permissions per engagement (Data Room), so staff auditors see only their assigned engagements, partners get full visibility across all clients, and forensic accountants access only investigation files. Give each client or engagement its own group with its own folder permissions; inside your firm, put each engagement team's rooms in its own team and add partners to every team. Peony also includes two-factor authentication to protect partner-level materials like management representation letters and SOC reports: viewers verify with a one-time code sent to their inbox before the document opens (Business and up).
How does Peony protect confidential financial documents from leaking?
Peony stacks screenshot protection, dynamic watermarks with the viewer's identity, an NDA gate, email verification, link expiry and instant revocation, so a leaked financial statement traces back to one viewer. Peony combines screenshot protection to block screen captures of client financials, dynamic watermarks stamped with the viewer's identity and timestamp on every page, NDA-gated access with integrated e-signatures, two-factor authentication, link expiry, and instant access revocation. All data is secured with AES-256 encryption at rest and TLS 1.3 in transit, on SOC 2 Type II-ready and ISO 27001-ready infrastructure, with both audits underway. Peony is GDPR, CCPA, and HIPAA compliant. Peony also supports controlled redaction to permanently black out sensitive PII or financial figures before sharing workpapers with external reviewers (Advanced Redaction is available on the Deal Team plan). Screenshot protection, Simple NDA gates, and AI document Q&A are available on the Business plan ($30/admin/month), and dynamic watermarks and the signed NDA on Data Room ($52/admin/month) — a fraction of what legacy VDRs like Firmex or Digify charge. Peony staff can't open, move or edit the documents in your room. Peony has had no data breach since launch.
Can access to tax documents expire automatically after filing deadlines pass?
Yes. Peony's link expiry, on every plan, revokes access automatically on the date you pick, such as the day after a filing deadline or an audit completion date. No manual cleanup required — links expire on schedule so former clients and external reviewers lose access automatically, reducing your compliance risk. From Business, you can also switch a link or group off at any time, and access stops the next time the viewer loads it.
How does AI help accounting firms organize and review audit workpapers?
Peony's AI document Q&A lets auditors ask plain-English questions across trial balances, general ledgers and workpapers and returns sourced answers with exact page references (Business and up). Find specific journal entries, account reconciliations, or revenue recognition details instantly. On Data Room, AI room generation drafts the engagement folder structure and Index documents numbers every file. Peony's AI document Q&A is available on the Business plan ($30/admin/month) — far less than Ideals or Firmex charge for similar capabilities. Your documents aren't used to train AI: Peony's LLM providers work under data-handling agreements that prohibit training on customer content. AI features, such as AI document Q&A and AI room generation, switch on once you're on a paid plan.
How much does a data room cost for a CPA firm managing multiple client engagements?
Peony charges per admin, not per client: Data Room is $52 per admin per month billed yearly ($75 monthly) with unlimited rooms, so a firm with three admins pays $1,872 a year for every engagement. Legacy VDRs like Ideals charge thousands per month. Business is $30 per admin per month ($44 monthly): 3 data rooms per admin, 1,000 documents per admin and 100 GB of storage, with no per-file size cap. It adds screenshot protection, an NDA gate and AI document Q&A. Data Room adds unlimited rooms, documents and storage with no per-file cap, client upload folders, granular permissions, dynamic watermarks, the Advanced NDA with signed PDF and audit trail, and the full audit trail. Deal Team ($64, or $89 monthly, minimum 4 admins) adds redaction, OAuth SSO, API access and a standard DPA on request; Enterprise is custom. You pay per admin, not per viewer and not per data room, with no click, recipient or storage fees on paid plans. No per-viewer, per-page, or per-link limits on any plan, so costs stay predictable across hundreds of client engagements. Free ($0) covers 50 documents and 500 MB as tracked single-file links; data rooms start on Business. Setup takes under 5 minutes; the median time from sign-up to first uploaded document is 4 min 19 s.
Does Peony provide SOX-ready audit trails for accounting and tax compliance?
Yes. Peony logs every document interaction with a timestamp, IP address, device details and page-by-page view duration, supporting SOX audit requirements and regulatory compliance documentation. These exportable compliance reports, a CSV of views, sessions and downloads on any paid plan, show exactly who accessed which client financial documents and when; the full per-viewer audit trail, with NDA acceptance and e-signature events, is on Data Room, and a copy is available on request. Logs are kept 1 year on Business, 2 years on Data Room and with no time limit on Deal Team and Enterprise. Peony is SOC 2 Type II-ready and ISO 27001-ready, with both audits underway; self-serve security documentation is available on the Deal Team plan, with a standard DPA on request on Deal Team and Enterprise.
Can Peony work as a secure client portal for an accounting firm?
Yes. On Peony's Data Room plan, each client gets its own room or folder on your firm's domain, opens it with an emailed one-time code and no account, and uploads into the folders you set. Your logo, cover image and brand card come with Business; your own subdomain, such as clients.yourfirm.com, with Data Room. A Peony link also reaches the people a portal login leaves out, such as a client's lender or attorney or a buyer's diligence team, and page-level analytics show which pages each one read. Clients are unlimited and free on every plan; you pay per admin. If you're replacing a file-sharing portal, our ShareFile alternatives guide compares the options.
How do I collect tax documents from clients securely?
Give each client a Peony folder with Upload permission behind email verification: the client adds W-2s, 1099s, K-1s and statements from a link with no account, and Peony logs who sent each file (Data Room). Upload also lets that client view and download what's in the folder, so give each client its own folder or room rather than one shared drop folder, and turn on Hide new content by default so files you add stay hidden until you release them. Add an allow list so only the client's own addresses get in. The FTC Safeguards Rule requires tax preparers to encrypt customer information in transit and at rest; Peony encrypts files with AES-256 at rest and TLS 1.2 or higher in transit. The full workflow is in how to send tax documents securely.
Is it safe to email tax returns, W-2s or financial statements to clients?
Not as a plain attachment: an emailed return can't be revoked or tracked once sent, and the FTC Safeguards Rule requires tax preparers to encrypt customer information both in transit and at rest. A Peony link keeps the return out of the email: the client verifies with an emailed one-time code, downloads can stay off, you see which pages they opened, and you can switch the link off or let it expire (Business and up). Peony encrypts files with AES-256 at rest and TLS 1.2 or higher in transit. See how to send confidential documents via email.
Do clients need a Peony account to open or upload documents?
No. Clients open your Peony link in the browser and upload into the folders you grant, with no Peony account; with email verification on, they type a one-time code sent to their inbox. Clients, their lenders and their attorneys are unlimited and free on every plan; you pay per admin. Uploading needs a folder set to Upload, which is on Data Room ($52 per admin per month billed yearly).
Does the FTC Safeguards Rule apply to CPA firms, and where does Peony fit?
Yes. The FTC Safeguards Rule treats accountants and tax preparers who complete income tax returns as financial institutions, so they need a written information security program; Peony is a service provider that program oversees. IRS Publication 5708, the Security Summit's sample written information security plan (WISP) for tax and accounting practices, says this applies regardless of size. The rule requires encryption of customer information in transit and at rest, multi-factor authentication for anyone accessing an information system unless your Qualified Individual approves equivalent controls in writing, logging of authorized users' activity, and oversight of service providers; since May 2024, a notification event involving at least 500 consumers must be reported to the FTC no later than 30 days after discovery. Peony's controls for that review: email verification with a one-time code (Business), per-client folder permissions (Data Room), per-viewer page logs, AES-256 encryption at rest and TLS 1.2 or higher in transit, staff who can't open documents, and a standard DPA with SCCs, on request on Deal Team and Enterprise. Peony's incident-response policy commits to telling affected customers within 72 hours of confirming an incident that affects customer data. Peony has had no data breach since launch. Your Qualified Individual and counsel decide how Peony fits your WISP.
How long must an accounting firm keep audit workpapers, and can Peony hold them?
For audits and reviews of SEC issuers, Rule 2-06 of Regulation S-X requires the accountant to keep workpapers and related records for seven years after the audit or review concludes. Peony keeps your rooms and files for as long as your account is active, with no age-based purge, and keeps activity logs 2 years on Data Room and with no time limit on Deal Team and Enterprise. Your audit platform or document archive stays the record of the engagement file; Peony is the controlled exchange layer for the documents that move between your firm, the client and outside reviewers. Deletion in Peony is permanent, so retire a finished engagement's room only when your retention policy allows.
How do you run a quality of earnings (QoE) data request in Peony?
In Peony, a QoE request runs as one room with a folder per request category: the target uploads trial balances, ledgers, bank statements and agings, and your team reviews them in place. Give the target an upload folder per category (Data Room), keep buyers and lenders in their own groups behind a signed NDA, and use Visitor Q&A for follow-up questions. AI document Q&A finds a figure across the target's uploads with the page cited (Business and up). When the report is final, share it as a watermarked, view-only file with each buyer or lender, and page-level analytics show which sections each one read. See our quality of earnings guide and the financial due diligence guide.
Can Peony extract K-1 data and organize tax workpapers?
Peony's AI document Q&A finds K-1 figures across a client's uploads and cites the page each one came from; AI room generation drafts each client's folder structure (Data Room). Ask for the ordinary business income on each K-1 in the room and every answer paragraph cites its source document and page. Index documents numbers every folder and file, and Upload new version replaces a workpaper in place at the same link while keeping every earlier version. Your tax software stays where the return is prepared; Peony is where the source documents arrive, get found and get shared. AI document Q&A is on Business and up and switches on after the trial.
Where do these rules and figures come from?
- 16 CFR 314.2 (Safeguards Rule definitions): an accountant or tax preparation service that completes income tax returns is a financial institution
- 16 CFR 314.4 (Safeguards Rule elements): encryption, MFA, disposal, logging, service-provider oversight and FTC notification
- 16 CFR 314.6: provisions that don't apply below 5,000 consumers
- FTC, FTC Safeguards Rule: What Your Business Needs to Know (tax preparation firms; breach notice effective May 2024)
- FTC press release (October 27, 2023): Safeguards Rule amended to require breach reports for 500 or more consumers
- IRS Publication 5708 (Rev. 8-2024), Creating a Written Information Security Plan for your Tax & Accounting Practice
- IRS Publication 4557, Safeguarding Taxpayer Data
- IRS, Protect your clients; protect yourself (tax professionals)
- 17 CFR 210.2-06 (Regulation S-X Rule 2-06): seven-year retention of audit and review records
- SmartVault, homepage: branded client portal (read October 17, 2026)
Sources checked October 17, 2026.
Organize your engagements. Survive tax season
Join accounting firms already using Peony to collect client documents, manage audit workpapers, and meet filing deadlines — securely and affordably.
- Clients, lenders and buyers never need a seat or an account.
- Unlimited client rooms on Data Room: 300 engagements cost the same as one.
- Live in minutes (median 4 min 19 s to first upload); the 7-day trial never auto-charges.
No credit card · 7-day Data Room trial that never auto-charges · clients view free, no account · 24/7 support
Last updated: October 2026