A small professional firm covers nine jobs in software. Most firms end up owning fifteen or twenty products to do it, and that’s not carelessness. Software is sold one job at a time, and nobody ever hands you the list. Here’s the list, which jobs your existing platform already covers, what each pricing model does to your bill, and the order to buy in.
- The nine jobs are fixed. The number of products moves. One purchase routinely covers three jobs, and two purchases routinely cover the same job twice.
- The pricing model matters more than the price. Accounting software is usually flat per company. Payroll is a base plus a headcount fee. Payments take a cut of what you collect, and everything else charges per seat. Hire one person and every per-seat line goes up that day. Nothing else moves.
- Three of the nine are genuinely mandatory. Three are usually already paid for. Three are where firms spend money on a problem that hasn’t arrived yet.
- If your firm handles clients’ financial information, the law adds requirements. They shape which products you can buy and what your contract with each one has to say.
The nine jobs a firm has to cover
Start from jobs rather than products. A product is a bundle of jobs somebody else chose, and every vendor chose a different bundle.
- Mail, calendar, files, meetings and identity. One platform, meaning Microsoft 365 or Google Workspace. Staff accounts are created and closed here too, which makes it the load-bearing purchase.
- The books. Where revenue, expenses, the balance sheet and the numbers on the tax return come from.
- Getting paid. Sending an invoice and accepting money against it.
- Paying people. Payroll, the tax filings that come with it, and benefits if you offer them.
- The client record. Who they are, what you agreed, what stage they’re at, and what you promised.
- The work record. What’s due, who has it, and how long it took if you bill by the hour.
- Signatures. Engagement letters, contracts, consents, anything a client has to sign.
- Credentials. A password manager and a second factor on every account.
- The front door. A website, a way for a stranger to contact you, and a way for someone to book time.
Nine jobs, and every firm past two people is doing all nine, whether or not it has bought anything for them. The ones running without software run on a spreadsheet, on somebody’s memory, or on nothing. That works for a while. It’s worth knowing which ones you’re carrying that way, because the failure is quiet. Nobody sends you a notice saying your client record is a person’s recollection.
What you already own before you buy anything
The largest single saving available to a small firm is free. It’s reading your own plan’s feature list before you buy in a category.
Your platform already covers job 1 by definition, and it usually covers pieces of four others. File storage, video meetings, forms, shared notes and a basic intranet come with both Microsoft 365 and Google Workspace at every business tier. Storage is the one that varies enough to matter. Google lists (Google Workspace pricing, checked September 7, 2026):
- 30 GB of pooled storage per person on Business Starter
- 2 TB per user on Business Standard
- 5 TB on Business Plus
A professional firm’s shared drive fills up for as long as the firm exists.
Signatures are the clearest example of a job most firms buy twice. Google’s admin documentation lists the editions where eSignature in Docs and Drive is supported (Google Workspace Admin Help, checked September 7, 2026):
“Business Standard and Business Plus; Enterprise Standard and Enterprise Plus; Education Plus; Enterprise Essentials and Enterprise Essentials Plus”
A firm on Business Standard that also pays per seat for a signing product is paying for job 7 twice. That happens for a good reason. The person who bought the signing product in 2023 was solving a real problem on a plan that didn’t cover it yet.
The general form of that mistake is worth stating once, because it’s the most expensive habit in small-firm software. A tool bought to solve a gap outlives the gap. Nobody goes back to check whether the platform closed it. That whole subject, and how to run the check without breaking anything, belongs to cutting overlapping subscriptions.
Which tier of which platform to be on is the other half of this, and it’s a longer decision than it looks. Retention, holds and the ability to search years of old correspondence are sold as a tier, so you choose them when you sign rather than flipping a switch afterward. Where email sits in the stack works that through properly. For now, one practical instruction. Before you buy anything in any of the nine categories, open your own plan’s comparison page and look.
Four pricing shapes, and which one you are on
Two products at the same monthly price behave completely differently as the firm changes. The shape of the price tells you what your bill does in three years, and there are four shapes.
Flat per company. Accounting software is the main example. Xero’s US plans run $25 a month for Early, $55 for Growing and $90 for Established, and the pricing page states plainly that there are “No per-user license fees” (Xero pricing, checked September 7, 2026). QuickBooks Online is nominally flat too, and it caps users by plan (QuickBooks pricing, checked September 7, 2026):
- Simple Start, $38 a month, 1 user
- Essentials, $85 a month, 3 users
- Plus, $140 a month, 5 users
- Advanced, $340 a month, 25 users
The cap is the real price. A firm of three on Essentials is one hire away from Plus and a $55 monthly increase. A firm of five on Plus is one hire away from Advanced and a $200 one.
Watch the limits inside a flat plan too. Xero’s Early plan covers “Send quotes and 20 invoices” and 5 bills a month, which suits a sole proprietor. A practice sending forty invoices at month end outgrows it in the first week.
Base plus headcount. Payroll. Intuit lists its combined payroll and accounting plans as “$88 + $6.50/employee” at the entry rung, rising to “$203 + $10/employee” at the top (QuickBooks payroll pricing, checked September 7, 2026). This shape is honest. It grows with the thing it does work on, and it grows slowly. It also quietly replaces your books line, because the plan bundles both. If you’re pricing payroll separately from accounting, check whether you’re about to own two general ledgers.
A cut of what you collect. Payment acceptance. QuickBooks Payments advertises rates “without monthly fees or minimums” on a pay as you go basis (QuickBooks Payments pricing, checked September 7, 2026), and the whole category works this way. You buy no seats and you cancel nothing, which makes this the one line on your stack that costs nothing in a slow month. The cost also stays invisible until you total a year of it, and on a practice collecting $80,000 a month that total is large.
Per seat. Everything else. The platform, the password manager, scheduling, signing products, and any assistance layer you add on top of mail. Bitwarden’s business plans are “$4 per month / per user billed annually” for Teams and $6 for Enterprise (Bitwarden business pricing, checked September 7, 2026). 1Password lists Business at “$8.99 USD per user, per month. Paid annually.” (1Password business pricing, checked September 7, 2026).
Per seat is the shape that scales hardest, because one hire lands on every per-seat line on the same day. It’s why a firm that doubles from six to twelve people finds its software bill more than doubling. The flat lines held. Every per-seat line went up together, and one of them crossed a tier boundary on the way.
One more thing the price page leaves out. The list price is what you pay at renewal, and the figure you paid at signup is usually lower. QuickBooks fronts “50% off for 3 months” and Xero currently offers “90% off your plan for your first 6 months” to firms that buy by September 30, 2026. Both are real offers and both end. Put the renewal date and the list price in a calendar entry on the day you sign up, so you meet them on your own terms rather than in month seven, on a card statement, in a week with plenty else going on.
The three you cannot skip
Of the nine, three are real purchases at almost any size.
The platform. Job 1, and it’s how staff accounts exist, which is what makes it a purchase rather than a preference. A firm running on personal Gmail addresses has no way to close an account when somebody leaves. Firm mail stays live on a former colleague’s phone, and nobody holds the key.
The books. Job 2, and the decision is usually a shared one. If you have an accountant or a bookkeeper, the right product is very often the one they already work in. The hours they’d spend in an unfamiliar system come back to you on a bill. Ask them before you compare feature grids. If you do the books yourself, either of the two above will do, and the choice hinges on how many people need to be in it. That’s the seat cap question, and it settles things faster than the feature grid.
Credentials. Job 8, and the cheapest line in the whole stack for what it prevents. A password manager at four to nine dollars a seat gives you three things: shared credentials that survive somebody leaving, a record of what exists, and one place to revoke from. Without it, a firm of eight runs on an unknown number of accounts secured by an unknown number of reused passwords, and the only inventory is what people remember.
Payroll joins this list the day you have an employee rather than a contractor. Signing joins it the day a client asks for something your platform can’t produce, and as above, that day often comes later than you’d think.
The four most firms get wrong
The remaining jobs are where the money goes, and where it’s most often wasted. Each one has a category of expensive software marketed at firms much larger than yours.
The client record. A spreadsheet genuinely is the right answer for a while. The moment it stops being right is specific. It’s the moment a second person needs to know the current state of a client without asking somebody. Below that threshold, a CRM is a second place to type what’s already in your head, and it goes out of date within a month. A stale record is worse than no record, because people trust it. Above the threshold, buy something. The question that decides it is whether anyone will maintain it on a Friday afternoon.
The work record. Same test, different failure. General project tools are built for teams that hand work between people. Professional practice management is built around a client, an engagement and time. If your work is a set of engagements with deadlines you didn’t choose, practice management fits better and costs more. If your work is projects with phases, a general tool is fine. Firms that buy the wrong one keep it, use it badly, and then buy a second thing.
The all-in-one. Every category above has a vendor selling all of it in one product: books, client record, work record, signing, a portal and a payments integration. These are real products, and some firms are very happy on them. The trade is concentration. You get one bill, one login and one set of conventions. You also accept that leaving means moving five jobs at once, and that when their weakest module is the one you use most, it stays. It’s a better deal for a firm with no strong opinions than for a firm with one specialist workflow it cares about.
Everything sold on a fear. Analytics dashboards, marketing automation, standalone archiving, HR suites and intranets are all real products for firms with a real version of that problem. At eight people, a named person and a recurring calendar entry usually cover your version of it. Here’s the test that holds up. Can you describe, in one sentence and in your own words, the thing that went wrong last quarter that this would have prevented? If you can name the week it happened, buy it. If you can’t, you’re buying a hypothesis.
All of that is a rule about timing. Buy once the problem has a date on it. What to keep takes the same test to a stack that has already grown.
What the Safeguards Rule adds, if it applies to you
This section governs some readers and leaves others alone, so start with which.
The FTC Safeguards Rule implements the Gramm-Leach-Bliley Act, and it applies to “financial institutions,” a term that reaches much further than banks. The FTC’s own business guidance names tax preparation firms among the covered entities (FTC Safeguards Rule guidance, checked September 7, 2026). The IRS is blunter: “Under the GLBA and Safeguards Rule, tax and accounting professionals are considered financial institutions, regardless of size” (IRS Publication 5708, Rev. 8-2024, checked September 7, 2026). The same publication says of a written information security plan that “the law requires you to have one.” Run a management consultancy or a coaching practice that stays clear of clients’ financial accounts, and this is very likely somebody else’s rule. Read it for context and build your stack on the sections above.
For firms it does cover, two provisions change what you can buy.
The first is multi-factor authentication, at 16 CFR 314.4(c)(5): “Implement multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls.” That one applies at every size. 16 CFR 314.6 lists exactly what drops away for a small institution: “Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.” Those four are the written risk assessment, the continuous monitoring and penetration testing requirement, the written incident response plan and the annual report. Multi-factor authentication at (c)(5) stays on the list. A four-person practice under the five thousand consumer threshold still does that one.
In practice, every product on your list has to support a second factor, and somebody has to have turned it on. That’s what makes a password manager a required line in a covered firm. It’s also where the second factor lives for accounts with nothing better available.
The second provision is about vendors, and it’s the one that should change how you buy. 16 CFR 314.4(f) puts three duties on you for every service provider. Choose ones capable of protecting the information. Bind them to it in writing. Go back and check. The middle duty carries the most weight for a small firm, because it’s a contract term rather than a judgment call. The rule’s words are “Requiring your service providers by contract to implement and maintain such safeguards.”
Read that as a limit on the length of your list. Every product touching client information gets chosen deliberately, papered, and looked at again later, and that’s real work per vendor. It’s the strongest argument in this whole guide for owning fewer things. It also puts a price on the free tool somebody signed up for with a firm address. That tool is a vendor holding client data, and nobody assessed it. The questions worth putting to any vendor before you connect it to anything are in what to ask before you connect a tool to client data.
None of this is legal advice. A firm with a specific obligation should read the rule against that obligation rather than against this summary.
Adding it up for eight people
Per-seat pricing hides totals, so it’s worth adding up once. Take a firm of eight, all figures monthly, at published list prices as of September 7, 2026.
Books and payroll together on the QuickBooks middle bundle is $125 plus $6.50 for each of eight employees, which is $177. Credentials on Bitwarden Teams at $4 a seat is $32, or $71.92 on 1Password Business at $8.99. Payment acceptance is a percentage of collections, with no monthly line. Signing costs nothing extra if your platform tier includes it. If your tier leaves it out, it’s a per-seat charge for the two or three people who actually send agreements.
So the non-platform mandatory half of an eight-person stack runs roughly $210 a month, plus whatever you collect payments on.
The platform is the ninth line and the largest, because it’s the one mandatory job charged per seat across the whole firm. Eight seats at a mid or upper business tier is the biggest number on the page, which is exactly why the tier decision gets its own treatment in where email sits in the stack.
Then the optional half. A client record, a work record, scheduling for the people who get booked, and any assistance layer on top of mail all charge per seat, all in the same rough band, and together they routinely cost more than everything above. That’s the shape of the decision. A firm somewhere between $400 and $900 a month paid a fair price on every single line. It said yes to four optional per-seat products over three years, and each one was reasonable on the day.
One cost stays off the invoice. Every product is an account per person to create, a second factor to enroll, permissions to review, something to close on somebody’s last day, and in a covered firm a service provider to assess. That work scales with the number of products rather than the number of seats, which is why the count of vendors matters as much as the sum of them.
What to add at each size
Software follows headcount and obligations more reliably than it follows revenue. Here’s roughly the order things become worth their price.
One or two people. The platform, and the books. That’s it. Your memory is the client record, and it’s genuinely enough. Add a password manager anyway, because the accounts you open in year one are the ones nobody can find in year four.
Three or four, and a first employee. Payroll arrives with the employee, and it’s the one purchase that has to land on its trigger date. This is also where the client record outgrows one person’s head, because two people now need the same answer. A shared document beats a CRM here and costs nothing.
Five to eight. Per-seat lines start to hurt here, and the first real duplicates show up, because you now have enough people that two of them bought the same category. This is the size where the work record earns a product. It’s also where an assistance layer on top of mail starts to pay, because sorting inbound has grown from one person’s morning into several people’s.
Nine to twenty. Practice management or an all-in-one becomes a serious question rather than an aspiration, and the answer turns on whether your work is engagements or projects. Signing, if you haven’t bought it, is usually real by now. Run one audit a year and make it a duplicate review rather than a cost review. The version that leaves everything working is cutting overlapping subscriptions.
At every one of those steps, ask two things before adding a product. Which of the nine jobs does it cover? Does anything you already pay for cover that job? If it covers more than one job, price the overlap rather than the product. Whether a candidate tool actually connects to the mail you already run is its own question, and that connection is where most of the daily friction in a small firm sits.
Which of the nine jobs Point does
Directly, none of them. That’s the honest placement, and a stack article is exactly where it’s worth being precise.
Point is an AI email client. It signs in to the Gmail or Microsoft 365 mailbox your firm already pays for. It sits on top of job 1 rather than replacing it. Your domain, addresses, history and contacts stay where they are. Clients keep the address they already use, and there’s no migration. Your tier decision, your retention and your archive stay exactly as they are, which is the arrangement you want from anything you add at this size.
What Point changes is the traffic that runs across all nine jobs, which in a small firm is where most of the day actually goes. Before you open the list, Point has weighed each message on what it’s worth and what being late costs. The client waiting on an answer outranks the software renewal, and how that ranking works is a subject of its own. Every conversation carries a short summary you can read in place of opening it. A buried ask comes out as a dated task, with the conversation attached. Say once that you want to hear when a document lands, and you hear about it the moment it arrives. Finding a slot four people can make stops being an email chain. Clients book against availability checked against the calendar you actually keep. Work and personal sit in their own lanes. A second business you run stays apart from the first, and seats go on and come off as the firm changes.
Two of those overlap with lines already on your stack. Scheduling is the obvious one. If a booking tool charges per seat for people whose calendars Point is already reconciling, that’s a duplicate to price. What a booking link should do covers where a link is still the better instrument. The other is whatever personal task app people use for things that arrived by email. That one tends to empty out on its own.
Hold the controls against the service provider question above. Autonomy is set separately for each kind of action, and the setting has three positions: suggest-only, review, and fully handled. Everything starts at review out of the box, and it’s worth reading what raising one really means before you move any of them. Whatever Point handled lands in a log with a timestamp, and most entries can be reversed from that log. One limit is shared by every product in this category: mail that has already reached the recipient’s server is beyond recall. Pricing is private beta and per seat, so it belongs in the per-seat column when you do the arithmetic above.
Point leaves all nine jobs where they are. Your books, your payroll, your client record, your work record, your signing product and your website all stay as they are. A shared inbox with queues, assignment rules and first response time reporting is a different kind of product, and a firm whose inbound genuinely is a support queue wants that one. Everything Point does is the full inventory, and what an AI email client is marks out the category if you’re comparing several. If your firm is a tax practice, a consultancy or a coaching practice, the version written for your trade starts closer to your actual week.
Common questions
How many SaaS tools does a small firm actually need?
Count jobs, not products. There are nine: the platform, the books, getting paid, paying people, the client record, the work record, signatures, credentials and the front door. A firm of eight covers those with four or five products, because the platform covers several jobs and payroll usually bundles with the books. Firms that own fifteen products are still covering nine jobs, and some of them twice.
What software does a five-person professional firm need first?
Microsoft 365 or Google Workspace, accounting software, and a password manager. Payroll the day you have an employee. Everything else, a CRM included, waits until you can name the specific thing that went wrong without it. At five people the client record usually still fits in a shared document, and a CRM nobody maintains is worse than no CRM because people believe it.
Is QuickBooks or Xero better for a small firm?
Ask your accountant before you compare features, because the hours they spend in an unfamiliar system come back to you as a bill. The price shapes differ in a way that matters. Xero states it has no per-user license fees. QuickBooks caps users per plan at 1, 3, 5 and 25. If you have six people who need to be in the books, that cap is the number to compare rather than the headline price.
Do we need DocuSign if we are on Google Workspace?
Check your edition first. Google lists eSignature in Docs and Drive as supported in Business Standard and Business Plus, along with the Enterprise and Education Plus editions, so a firm on Business Standard paying separately per seat for signing is covering the same job twice. A dedicated signing product is still the right answer if you need things Google’s leaves out, such as heavier identity verification or a specific audit trail your clients ask for.
Does the FTC Safeguards Rule apply to a four-person accounting firm?
Yes. The IRS states that under GLBA and the Safeguards Rule, tax and accounting professionals are considered financial institutions regardless of size. A practice below the five thousand consumer line is excused from four provisions, and 16 CFR 314.6 names them exactly: the written risk assessment, continuous monitoring and penetration testing, the written incident response plan, and the annual report. Multi-factor authentication sits outside that list of four, so it still applies.
How do we stop the software bill growing every year?
Watch the pricing shape rather than the price. Flat per company lines and per transaction lines stay roughly where they are as you grow. Per seat lines multiply by headcount, and that’s where the growth comes from. The other half is promotional pricing running out, so record the list price and renewal date on the day you sign and meet both on your own terms.
Should we buy an all-in-one practice management system?
It depends on whether you have a workflow you care about. An all-in-one gives you one bill, one login and one set of conventions. In exchange, a weak module stays put, because you swap the whole suite or nothing. If your firm has a specialist way of doing one of the nine jobs, keep that job separate and buy the rest as a suite. If you have no strong opinions, the all-in-one is usually the cheaper way to end up organized.
The short version
- Nine jobs, and fewer products than that. The platform, the books, getting paid, paying people, the client record, the work record, signatures, credentials, and the front door.
- Read your own plan before you buy in any category. Google lists eSignature as supported on Business Standard and above, and a firm on that tier paying per seat for signing is buying job 7 twice.
- The pricing shape predicts your bill better than the price does. Flat per company, base plus headcount, a cut of collections, and per seat. Only per seat multiplies when you hire.
- Three are mandatory at almost any size: the platform, the books, and a password manager. Payroll joins them at the first employee.
- The client record and the work record are where money goes on a problem that may still be ahead of you. The threshold is the day a second person needs the current state without asking anybody.
- If your firm handles clients’ financial information, multi-factor authentication is required under 16 CFR 314.4(c)(5), and it stays required at the small-institution threshold. Every vendor you add is a service provider you have to select, contract with and reassess under 314.4(f).
- Roughly $210 a month covers the non-platform mandatory half for eight people. The optional per-seat layers, added one reasonable decision at a time, are what take a firm past $400.
For where email sits in all of this, start with the email layer. For a stack that already grew, what to keep and cutting overlapping subscriptions are the two that undo it.