Who else is reading your client's tax return? Email Security Guide for Canadian CPAs 2026

Most data breaches don't start with sophisticated cyberattacks. They start with a single email, clicked by one person, on an otherwise ordinary Tuesday. For a CPA practice, that one click sits in front of an inbox containing T1 returns, Social Insurance Numbers, RRSP histories, family business financials, and complete financial identities — protected by infrastructure that was never designed to keep them private. This course examines the email security gap most Canadian CPAs don't know they have, explaining what "encrypted" actually means on Gmail and Outlook, why both platforms leave client data legally accessible to US authorities under the CLOUD Act, and what the documented pattern looks like when things go wrong.

It also presents the solution: end-to-end encrypted email built on zero-knowledge architecture, available at entry-level pricing identical to Gmail, with setup that takes approximately one hour and leaves the email address, Outlook, and existing workflows unchanged. The course covers the full platform comparison — Google Workspace, Microsoft 365, and Proton Mail — across provider access, data jurisdiction, and cost, and provides a step-by-step decision framework tied to PIPEDA, Law 25, and the CPA Code of Professional Conduct. Every question that matters gets a specific answer, with the numbers, the comparison, and a clear process to act on it.

Learning Objectives

By the end of this course, participants will be able to:

1. Explain why standard encryption on Gmail and Outlook does not provide client-grade confidentiality, and describe what it means for a provider to hold the master key.
2. Describe the legal framework of the US CLOUD Act and its implications for Canadian CPA practices using American-owned email platforms.
3. Identify the specific threat landscape facing CPA practices, including why accounting inboxes are deliberate targets and how AI has changed the sophistication of phishing attacks.
4. Distinguish between standard encryption and end-to-end encryption using zero-knowledge architecture, and explain how the difference affects a practice's exposure in a breach, a legal demand, or a lost device scenario.
5. Compare Google Workspace, Microsoft 365, and Proton Mail across provider access, data jurisdiction, and cost, and identify which platform provides a complete answer to PIPEDA, Law 25, and CPA Code obligations.
6. Apply a practical decision framework to determine the right email platform for their practice, including when Microsoft is the defensible choice and what documentation PIPEDA requires.
7. Outline the steps to migrate a CPA practice to Proton Mail, including what changes and what stays the same.

Ready to make the switch? Start your free 14-day trial here: https://now.getproton.me/hrfjs8infz4q-o3hzta