- Tax season crushes a year of compute into 14 weeks, breaking on-prem capacity plans.
- Hosted environments let firms scale users and storage per engagement without hardware.
- File isolation, audit trails, and IRS Pub 4557 controls are easier under managed cloud.
- Vendors offering a hosted tier reduce churn from firms outgrowing the closet server.
A small CPA firm with 600 to 1,200 individual returns runs a workload almost no other industry produces. From mid-January through April 15, concurrent users triple, document volume spikes, and engagement files balloon. Then on April 16, the curve collapses. The closet server sized for that ridge sits idle for eight months and now counts as a compliance liability with a fan.
The shape of tax season demand
Most capacity planning assumes a daily peak and a weekly trough. Accounting firms add a third dimension: the annual peak. Graph concurrent sessions across the year and you get a flat plain with a sharp ridge in Q1.
Concurrency, not throughput, is the constraint. A preparer reviewing a return holds an interactive session for 20 to 90 minutes, pinning RAM and a CPU thread. Doubling client volume in March doubles concurrent sessions. Storage I/O is bursty too, with dozens of small reads and writes per minute per user as preparers jump between working trial balances, depreciation schedules, and linked workpapers.
On-prem sizing for that curve means buying hardware that is 60 to 70 percent idle for eight months. Hosted environments let firms rent the ridge and release it in May.
Multi-client isolation and compliance
Accounting workloads carry a structural risk that most line-of-business software does not: one client’s data corruption can poison shared resources. A malformed file can crash a preparer’s session. When that session runs on a shared host with twelve other preparers, the blast radius is twelve people.
A properly designed hosted environment isolates at two layers. Each preparer’s session runs in its own user context, profile, and process tree, so a crash in one does not propagate. Client engagement files live on per-client storage paths with explicit ACLs tied to preparer identity, and every access is logged centrally.
That access model is what the 2025 IRS Security Summit guidance and the FTC Safeguards Rule expect a firm to be able to prove. The 2024 AICPA PCPS survey ranked technology and cybersecurity ahead of staffing for small firms for a reason. The evidence trail is easier to produce when the platform supplies it by default.
What clients and vendors now expect
Client expectations shifted permanently. A 2025 Accounting Today survey of small business clients found 71 percent expect a secure portal for document exchange, and 54 percent expect to see return status without emailing the firm. Email-as-portal is no longer competitive, and a client uploading a 1099 at 11pm on a Sunday in February is the median case, not the exception.
For software vendors, the accounting, tax, and document stack is increasingly evaluated as one unit. Firms ask how a tax product integrates with secure file exchange, e-signature, and engagement letters. Hosted delivery answers the uptime question by inheriting the underlying cloud SLA, and shared storage plus shared identity make integration a matter of file paths rather than fragile export-import scripts.
Hosted versus closet server
| Dimension | Hosted environment | On-prem closet server |
|---|---|---|
| Q1 scaling | Add capacity for tax season, release in May | Sized for peak, idle 8 months |
| Multi-client isolation | Per-engagement ACLs, isolated sessions, central audit log | Shared profiles, mixed permissions |
| Portal uptime | Inherits cloud SLA, 24/7 | Tied to office power and ISP |
| Disaster recovery | Geo-redundant backups, documented RPO/RTO | Backup tape in the partner’s car |
| Compliance evidence | Inherited from platform | Firm builds every control itself |
Frequently asked questions
Is hosted accounting software acceptable under IRS Publication 4557 and the FTC Safeguards Rule?
Yes, when the environment provides documented access controls, encryption at rest and in transit, audit logging, and incident response. The firm still owns its Written Information Security Plan, but the hosted environment supplies most of the technical evidence. Ask for a SOC 2 Type II report and a shared-responsibility matrix.
What happens to performance during the last week of tax season?
A hosted environment that scales horizontally adds session hosts as concurrency rises, so a firm running 30 preparers in February can run 45 in April without touching a server. The platform and the application vendor need to have load-tested together.
How does multi-client file isolation work in practice?
Engagement files live on per-client storage paths with ACLs tied to preparer identity. Sessions run isolated per user, so a hung process in one does not affect others. Access is logged centrally, which gives the firm one place to answer who opened a client’s file in March.
What is the typical migration window for a firm moving off a closet server?
Plan the cutover for the May-to-September window, after tax season closes and before extensions compress the calendar. A 15-to-30-user firm typically completes migration in 6 to 10 weeks, including parallel running and a cutover weekend.
The firms that came through the last three tax seasons intact stopped treating infrastructure as a partner-track distraction. If you build accounting, tax, or workflow software, the question is whether your customers get a hosted option from you or from a competitor who shipped one first.