Vendor Security Scorecards

QuickBooks Online is one of the most popular accounting platforms for small businesses. Its securiy posture, however, has real gaps that decision makers ought to be aware of. MFA is available but cannot be enforced across its userbase by an administrator, there is no HIPAA BAA available, and QuickBooks Desktop files are a documented target for data theft malware. If your business handles sensitive financial data, consider pairing QuickBooks with deliberate access control policies and endpoint protection.

Dropbox offers solid encryption and a mature compliance program including SOC 2, ISO 27001, and HIPAA BAA availability on Business plans. However, the platform has a documented history of security incidents, including a 2012 breach that exposed 68 million user credentials and a 2024 breach of the Dropbox Sign service. The default product does not include end-to-end encryption, which means Dropbox holds the keys to your files. For businesses storing sensitive documents, the Business or Enterprise tier with thoughtfully configured admin controls is the minimum starting point.

Google Workspace is one of the most thoroughly certified platforms available to small businesses. It holds SOC 2, ISO 27001, FedRAMP High authorization, and offers a HIPAA BAA on Business and Enterprise plans. Administrators can enforce MFA across all users, restrict service access, and configure Data Loss Prevention rules. The platform's main risk for SMBs is complexity. Security features exist, but a non-technical admin may not configure them correctly without guidance.

Microsoft 365 is one of the most feature-rich platforms available from a security standpoint. Conditional Access, Data Loss Prevention, sensitivity labels, and admin-enforced MFA provide granular control over who accesses what and under what conditions. The platform signs a HIPAA BAA, supports CMMC compliance, and holds FedRAMP authorization for its government cloud. The challenge for small businesses is that many of these features require Business Premium or higher licensing, and the admin experience is complex and can be a challenge for small teams to configure correctly.

Zoom offers HIPAA BAA availability, end-to-end encryption as an option, and a solid set of compliance certifications. Its history includes the 2020 Zoombombing incidents that led to an $85 million settlement and a steady stream of vulnerability disclosures, including a critical Windows privilege escalation flaw (CVSS 9.6) patched in 2025. For telehealth and regulated meetings, Zoom works if you configure it deliberately. Out of the box, the default settings leave gaps that a determined attacker or an accidental participant can exploit.

DocuSign is a secure eSignature platform with strong encryption, a court-admissible audit trail on every document, and HIPAA BAA availability on Enterprise plans. The platform has not experienced a major data breach of customer documents. The primary risk to small businesses is not DocuSign itself but the phishing campaigns that impersonate DocuSign notifications to trick recipients into clicking malicious links.

Stripe is the gold standard for payment processing security in the SMB space. It is PCI DSS Level 1 certified (the highest level), holds SOC 2 Type II and ISO 27001, publishes a public SOC 3 report, and has no publicly disclosed breach of its payment infrastructure. Stripe tokenization architecture means sensitive card data never touches your servers, which dramatically reduces your own PCI compliance burden.

Slack is a useful collaboration tool with solid compliance credentials on its Enterprise Grid tier: SOC 2, ISO 27001, and HIPAA BAA availability. But messages in Slack are not end-to-end encrypted, meaning Slack (and by extension Salesforce, its parent company) holds the encryption keys and can technically access message content. For most small businesses, the bigger risk is not encryption architecture but the tendency to share sensitive information in Slack channels without considering who has access or how long messages are retained.

Gusto is a payroll and HR platform built specifically for small businesses, and its user experience reflects that focus. The platform uses AES-256 encryption, holds SOC 2 Type II certification, and processes payroll and tax filings for over 300,000 businesses. Gusto does not sign a HIPAA BAA, which limits its use for healthcare organizations that tie benefits administration to health plan data. For businesses that need a simple, reliable payroll provider with reasonable security, Gusto delivers.

Clio is purpose-built for small and mid-sized law firms, and its security posture reflects the sensitivity of legal data. SOC 2 Type II, ISO 27001, AES-256 encryption, and matter-level access controls are all standard. Clio will sign a HIPAA BAA, which matters for firms that handle healthcare-related legal work. The platform has no publicly disclosed breach. For law firms evaluating practice management software, Clio security credentials are among the strongest in the legal technology market.