The answer to that is generally no. So why are forms not safe to exchange passwords with your bookkeeper?

The form encrypts data as it travels to your account, but that’s the only protection. After that, the submission is saved as plain text on the contact record, and stays there indefinitely. Anyone with access to your account can see it, along with anyone who gets into your account later. Notification emails usually include the submitted answers, so the password also ends up in an inbox, and possibly on a phone. They’re built for business communication, not for storing secrets.

The right way:

Your bookkeeper should have their own login for each account.

Nearly everything a bookkeeper touches lets the client invite her as a separate user.

How does the bookkeeper get access?

QuickBooks Online: Client uses “Invite your accountant.” Bookkeeper signs up for the free QuickBooks Online Accountant account, and every client’s books show up in one place.

Aplos: Client adds her as a user with a bookkeeper or accountant role.

Bank accounts: Mostly through bank feeds connected to QuickBooks or Aplos. If the bookkeeper needs direct access, most business banks can add a view-only user.

Bill pay (Bill.com, Melio, etc.): Client invites her as a user. The client approves payments and she prepares them.

Payroll (Gusto, ADP, Paychex): Accountant or bookkeeper access, granted by the client.

Receipts: Shared folder, or a receipt-capture tool like Dext or Hubdoc. (We also have a client portal to share docs, with your own login.

Verification codes: Codes from two-step login go to directly to the bookkeeper's phone, not the client’s. With a shared login, bookkeepers would have to text the client every time they log in.

Audit trail: The software records what the bookkeeper does, which protects the bookkeeper and the client if something goes wrong.

Easy to end: The client can remove her access in one click when the engagement ends. No password changes needed.

Bank terms: sharing a login can break a bank’s terms of service and can complicate fraud claims. A user that has been invited doesn’t have that problem.

When a password truly can’t be avoided:

Some small banks or older systems don’t support extra users, in that case we would take every measure to make sure your personal information stays protected.