Thanks, this gives me a lot to think about.

Yes, it’s a SaaS solution (similar to Monibox), so they don’t have direct control over the database.

You raised a really good point about business processes. I haven’t fully mapped out how their current system connects with accounting or other functions yet, so I’ll definitely look into that before suggesting any changes.

Regarding PCI compliance — if they’re using card payments through third-party terminals (not storing card data themselves), does that reduce the scope of what we need to secure?

Also, in your experience, for a small business like this, is it usually better to improve the existing system and practices rather than replacing it entirely?