What happens to files clients upload

Which checks Achekam runs on files a client uploads through a request link, what a file fingerprint proves, and what staff still have to check themselves.

By Achekam · 11 October 2026 · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya

A client uploads forty files on a Sunday evening in answer to a year-end request. Some are PDFs from the bank, some are phone photos of slips, one is a spreadsheet with macros the client's previous accountant built, and one is a file with a name nobody recognises. On Monday morning a junior opens them one by one.

Before that happens, Achekam has already done some checking. It is worth knowing exactly what, because the checks are useful but narrow, and the rest of the checking is still the firm's job. This article sets out both.

Blocked file types and size limits

On a request page, the client can upload files or whole folders and answer the firm's questions. Two limits apply at the door:

• Executable file types are blocked. Programs and similar files that could run on a computer are refused at upload, so a client cannot send one even by accident.
• Files are limited in size, 100 MB per file by default. Very large files, such as high-resolution scans of a whole year's slips in one document, may need splitting.

These limits catch the obvious problems. They do not judge whether a permitted file type is safe or whether its content is what it claims to be.

Virus scanning, and when it runs

Every upload passes a malware check, but the depth of that check depends on how the server is set up. Files are virus-scanned with ClamAV only when the server operator has configured it. Otherwise, a built-in heuristic and structural check runs instead, and the upload's record says which check was applied.

That difference matters to a firm that needs to be able to say a file was scanned. Do not assume; read the record on the upload. If your firm's policy requires anti-virus scanning of client files, confirm how your Achekam server is configured, and treat files checked only structurally with the same care as an attachment from an unknown sender.

Files that pass either check can still carry risk. Office documents with macros, password-protected archives and PDFs with embedded content are all permitted types. Open them only when needed, with macros disabled unless you know why they are there.

Fingerprints on stored files

Every file Achekam stores gets a SHA-256 fingerprint: a value calculated from the file's exact content. If even one character of the file changed, the fingerprint would be different.

Be clear about what that proves. A fingerprint shows that the stored file has not changed since it was stored. It does not show that the file is genuine. A bank statement edited before upload has a perfectly valid fingerprint of the edited version.

Fingerprints matter most for documents the firm itself produces or completes. When everyone has signed an e-signing envelope, Achekam produces the signed PDF with a completion certificate listing each signer's e-mail, times, IP address and browser and the document's fingerprint, and files it in the client's 'Signed documents' folder. Anyone can later show that the signed document is the one that was signed.

Where each file is filed

What a client sends through a request is filed in that client's vault folder in the Document Centre, which keeps a folder per client and lead. Staff can upload files and folders there too, keep versions, tag, archive and restore with a reason, and search. Files sent for intake processing are filed as originals in the client's 'Uploads for processing' folder.

A few habits keep the folder useful:

1. Rename unhelpful file names when you accept an item, so "IMG" and a number becomes "Bank statement, cheque account, March".
2. Tag files with the year and the area of the file they support.
3. Upload a corrected document as a new version of the old one, rather than as a separate file.
4. Archive rather than delete, so the history stays.

How versions and folders work in more detail is covered in vault folders and versions.

What a person still checks

Achekam's checks are about the file. The firm's checks are about the content. For every upload a person should ask:

For audit work, the last two questions are part of judging the reliability of the evidence. A copy supplied by the client is generally less reliable than evidence obtained directly from a third party, and signs that a document may have been altered call for more work, not less. The IAASB is revising its audit evidence standards, and its ISA 500 series project page tracks that revision of the ISA 500 series, with board papers and current status. How uploads fit into audit evidence is discussed in client uploads as audit evidence.

A worked example in words: a client uploads a year-end bank statement as a PDF. It passes the upload checks and is filed in the client's folder. The senior notices the font of the closing balance differs from the rest of the page. Rather than accept it, she asks the client to download the statement again from online banking during a video call, and requests a bank confirmation directly. The confirmation shows a different balance, and the matter goes to the partner.

The short version for staff

Achekam stops dangerous file types, checks every upload in the way the server allows, and fingerprints what it stores. Staff decide whether the content is right. Make that division of labour explicit in your firm's training, so nobody mistakes a passed upload check for a checked document.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.