How to Store W-9 Forms Securely: A Practical Checklist
Where to keep completed W-9s, who should have access, and which FTC Safeguards and IRS Pub 4557 controls to apply, with a storage checklist for small firms.
If you collect W-9s, you are holding Social Security numbers and EINs, and IRS instructions require you to keep that information confidential. In practice: one secure system of record, access limited to those who need the TIN, encryption and MFA, an access log, and secure disposal when retention ends. Firms that prepare tax returns have specific obligations under the FTC Safeguards Rule; other AP teams can use the same controls as a sound benchmark.
General information, not tax or legal advice.
The short answer
Keep every W-9 in one controlled place, not across inboxes, desktops and open shared folders, and give access only to the people who set up vendors and prepare 1099s. Our secure W-9 collection guide covers collecting the form safely.
Why this matters in a real workflow
A business asks for a W-9 because it has to file an information return and must get the payee's correct TIN, which can be an SSN, ITIN, ATIN or EIN (Form W-9, Rev. March 2024). FTC breach guidance warns that thieves with names and Social Security numbers can use them to commit tax identity theft (FTC: Data Breach Response).
The usual problem is sprawl: one W-9 lands in an inbox, Downloads, a shared drive, a paper file and the accounting system. Every copy is another place a TIN can leak from.
What the IRS and FTC say
Every requester: keep it confidential
IRS instructions require payers to keep W-9 identity information, including SSNs and EINs, confidential, and to use it only to comply with the tax laws (IRS General Instructions for Certain Information Returns). The W-9 also warns requesters that disclosing or using TINs in violation of federal law can bring civil and criminal penalties.
Neither passage says how to store the form. For that, look to the FTC Safeguards Rule and IRS guidance for tax professionals.
Firms covered by the FTC Safeguards Rule
The Safeguards Rule implements the Gramm-Leach-Bliley Act and requires covered businesses to maintain administrative, technical and physical safeguards for customer information (16 CFR Part 314). It names an accountant or tax preparation service that is in the business of completing income tax returns as a financial institution. Customer information means any record, in paper, electronic or other form, containing nonpublic personal information about a customer.
For covered firms, the elements that bear most on W-9 storage are:
- Access controls. Implement and periodically review access controls so only authorized users can reach customer information.
- Encryption. Encrypt customer information both in transit over external networks and at rest. If that is infeasible, the firm's Qualified Individual must approve effective compensating controls.
- Multi-factor authentication. MFA is required for anyone accessing any information system, unless the Qualified Individual approves an equivalent or stronger control in writing.
- Activity logging. Monitor and log authorized users' activity and detect unauthorized access to or tampering with customer information.
- Secure disposal. Customer information must be securely disposed of within two years of last use unless it is needed for business or required by law (FTC Safeguards Rule guide).
IRS Publication 5708, written for tax professionals, says a written information security plan (WISP) is required under the Safeguards Rule: "the law requires you to have one" (IRS Publication 5708). The same publication says tax and accounting professionals are financial institutions under GLBA and the Safeguards Rule regardless of size. Firms holding information on fewer than 5,000 consumers are exempt from four provisions (the written risk assessment, pen testing and vulnerability scans, the written incident response plan and the annual report), but encryption, MFA, access controls, disposal and FTC breach notice still apply.
Bookkeeping-only firm or in-house AP team?
The rule names firms that prepare tax returns. Bookkeeping-only firms should confirm with counsel whether it applies to them.
IRS Publication 4557 practices
Publication 4557 is written for tax professionals, but it is a sensible standard for anyone storing TINs.
- The IRS advises encrypting all sensitive files and emails, especially those with taxpayer PII, and using strong passwords (IRS Publication 4557).
- It advises physically destroying old drives and devices and shredding documents that contain taxpayer information.
- The IRS's Taxes-Security-Together checklist recommends two-factor authentication and drive encryption (IRS Taxes-Security-Together checklist).
The FTC adds: use Social Security numbers only for required and lawful purposes, and keep only what your business needs (FTC: Protecting Personal Information).
How long to keep them
The backup withholding regulation requires 3 years from the date the account is opened (26 CFR 31.3406(h)-3); the IRS's independent-contractor page says four years (IRS: Forms for independent contractors). As a matter of practice, many firms keep W-9s at least four years after the last payment; see how long to keep W-9 forms.
Paper vs. digital storage
For covered firms, paper counts too (see the customer-information definition above). Our recommendations for each:
| Paper | Digital | |
|---|---|---|
| Where | Locked cabinet | One system of record with per-user logins |
| Access | Named key holders, sign-out sheet | Role-based permissions, reviewed regularly |
| Protection | Keep files out of general vendor folders | Encryption at rest, MFA on every account |
| Disposal | Cross-cut shredding or a shredding service | Delete from the system, backups and any exports |
Before shredding originals you've scanned, confirm with your tax adviser that the scans meet your recordkeeping needs.
Where not to keep W-9s
These are our recommendations, not IRS rules.
- Email inboxes. An attachment sits in Sent, Inbox, Deleted and backup copies, searchable by anyone who later gets into the mailbox.
- Open shared drives. A folder the whole company can open defeats access controls.
- Desktops, Downloads and USB drives. Rarely encrypted and easy to forget at disposal time.
- Spreadsheets of vendor TINs. Lists get emailed, copied and kept forever.
- Free-text fields. Don't paste a full TIN into email bodies, ticket notes or memo fields.
Who should have access
Our recommendation for a small firm or AP team.
| Role | Access | Why |
|---|---|---|
| AP or vendor setup lead | View, add, replace | Enters and updates the TIN |
| 1099 or tax preparer | View | Needs the TIN for information returns |
| Controller or owner | View; approves access changes | Oversight and periodic access review |
| IT admin or Qualified Individual | Manage permissions and logs | Runs the controls, no routine viewing |
| Everyone else | None | No tax purpose for seeing a TIN |
Recommended workflow
- Choose one system of record (owner or controller). Write down where W-9s live.
- Set permissions (IT admin). Apply the access table above; review it quarterly.
- Turn on MFA and encryption (IT admin). CISA advises small businesses to turn on MFA across email, file storage and remote access, starting with admin accounts and staff who handle sensitive data (CISA: Require multifactor authentication).
- File on arrival (AP lead). Save each W-9 the day it arrives, then delete the email and Downloads copies.
- Replace on change (AP lead). A payee must give you a new W-9 if the name or TIN on the account changes. Mark the old form superseded.
- Review logs (controller). Spot-check who accessed W-9 files.
- Dispose on schedule (controller). Shred or securely delete forms past your retention period, including exports.
Exception path: if a vendor emails a W-9 anyway, file it, delete the message and offer a secure channel next time. If a device holding W-9s is lost, follow your incident plan. Whether FTC notice is required depends on whether the information was unencrypted and acquired without authorization ; if it is a notification event, covered firms must notify the FTC as soon as possible, and within 30 days of discovery, of a notification event involving at least 500 consumers' information. Tax professionals who suffer client data theft should report it to their IRS Stakeholder Liaison.
Example scenario
Example scenario: Maple Ridge Tax & Books, a made-up six-person firm that prepares returns, kept W-9s in a shared inbox, a company-wide drive folder and a paper binder. The owner moved them into one encrypted document system, limited access to the AP lead, the 1099 preparer and herself, turned on MFA, and shredded the binder once her adviser confirmed the scans met their recordkeeping needs.
Common mistakes
- Forgetting paper copies and printouts at disposal time.
- Assuming the Safeguards Rule's small-firm exemption removes the need for encryption or MFA.
Checklist
- One documented system of record for W-9s
- Access limited to named roles and reviewed quarterly
- MFA on every account that can reach W-9s
- Encryption at rest on the storage and on laptops
- Access logging on and spot-checked
- Email, Downloads and USB copies deleted after filing
- Paper copies locked away and shredded at disposal
- Retention period written down and applied
- WISP in place, if your firm prepares tax returns
How W9Vault supports this workflow
W9Vault is a collection channel, not an archive. You send a vendor a secure upload link that expires after 7 days, and the vendor uploads the W-9 as a PDF, JPG or PNG up to 20 MB. Files are encrypted in the vendor's browser before upload, so the server never receives the plaintext file. Your dashboard shows each request as sent or completed.
Uploaded files are automatically deleted 30 days after upload for completed requests. Download each completed W-9 into your own secure records system promptly. W9Vault is designed to support a secure collection workflow; the customer remains responsible for their own tax, recordkeeping and security obligations.
Keep W-9s out of your inbox
Send vendors a secure, expiring upload link, then move each completed W-9 into your own records system.
Frequently Asked Questions
Firms that prepare tax returns are covered. Bookkeeping-only firms should confirm with counsel whether the rule applies to them.
We do not recommend it. Email copies spread across sent folders, inboxes and backups. Move each W-9 into one secure system of record and delete the email.
No. Uploaded files are automatically deleted 30 days after upload for completed requests, so download each completed W-9 into your own secure records system.
Official resources
- Form W-9 (PDF), Rev. March 2024
- IRS General Instructions for Certain Information Returns
- IRS: Forms and associated taxes for independent contractors
- 26 CFR 31.3406(h)-3 (eCFR)
- 16 CFR Part 314, FTC Safeguards Rule (eCFR)
- FTC Safeguards Rule: What Your Business Needs to Know
- IRS Publication 4557, Safeguarding Taxpayer Data
- IRS Publication 5708, Creating a Written Information Security Plan
- IRS Taxes-Security-Together checklist
- FTC: Protecting Personal Information, A Guide for Business
- FTC: Data Breach Response, A Guide for Business
- CISA: Require multifactor authentication
