The contract that gets printed, signed, scanned and emailed back has not disappeared from Quebec’s small and mid-sized businesses. It simply coexists with online tools adopted one need at a time, with no overall plan. Digital transformation for SMBs often happens this way, in successive layers, and that is exactly what makes it fragile. According to Statistics Canada’s survey on the impact of cybercrime released in October 2024, roughly one Canadian business in six was hit by a cybersecurity incident in 2023, and half of the businesses affected were targeted by a scam or fraud. Recovery costs reached about $1.2 billion, double the 2021 figure. Going digital without securing anything simply moves the risk elsewhere. Three concrete projects make it possible to move forward in the right order: document signing, email protection, then the software that ties everything together.
What digital transformation changes, and what it doesn’t
The temptation is strong to start with the most visible tool, usually a new management system. Wrong order. A brand-new ERP fed by documents that still travel as unprotected attachments inherits every weakness of the old setup. The reverse logic works better: secure exchanges with the outside world first, since that is where fraud comes in, then organize what happens inside.
A legal framework adds to that logic. Since September 22, 2023, most of Quebec’s Law 25 on the protection of personal information has applied to businesses in the province. Administrative penalties can reach $10 million or 2% of worldwide turnover, and penal fines $25 million or 4%. Few SMBs face amounts like these, but the obligation to know where their customers’ and employees’ data is stored applies to all of them. An employment contract sitting in a personal email inbox is poorly protected personal information.
E-signatures, the first measurable gain
Quebec law has recognized electronic signatures since 2001, when the Act to establish a legal framework for information technology was adopted. An electronic signature carries the same weight as a handwritten one as long as it identifies the signer, shows their consent and guarantees that the document was not altered afterwards. Those are the three functions a serious platform documents: identity verification, a time-stamped audit trail and document sealing.
Why data hosting matters
Choosing a tool comes down to more than the price per user. For an SMB subject to Law 25, where signed contracts are stored matters as much as ease of use. An e-signature solution designed for small businesses that hosts data in Canada simplifies the privacy impact assessment the law requires before personal information is entrusted to a provider outside Quebec. The public sector is moving too: Le Devoir reported that Investissement Québec had adopted a Quebec-made secure signature software to replace DocuSign.
The gains show up quickly. A purchase order signed in ten minutes instead of three days, a non-disclosure agreement returned before the meeting ends, a consent form sent to two hundred employees in a single operation. Nothing spectacular. But it is time recovered every week, and one complete file instead of three versions of the same PDF.
Questions to ask the provider
Before signing up with a platform, a few checks prevent unpleasant surprises. Is multi-factor authentication included in the base plan or billed as an option? Can the audit trail be exported with the signed document, so it can be produced in court if a client disputes it? Does the provider hold an independent audit report, such as SOC 2, on its security controls? Does support answer in French? And is pricing based on users or on envelopes sent? An SMB that has many documents signed by a few people does not benefit from the same model as a firm where each professional sends a handful of contracts a month.
Email, the front door for fraud
E-signatures handle how documents circulate. They do not protect against the fraudulent email that impersonates the company president and requests an urgent transfer to a new supplier. This type of fraud, known as business email compromise, often contains no malicious link and no attachment. Standard filters let it through. It relies on urgency and authority.
The most effective defence costs nothing and fits in one written rule: any request to change banking details, or any unusual transfer, is confirmed by phone, at a number already on file and never the one shown in the email. The rule must apply to the boss as well. Fraudsters count precisely on an employee’s reluctance to call the head of the company to double-check.
SPF, DKIM and DMARC, three acronyms that protect your name
Three protocols prevent a fraudster from using your own domain name to write to your customers. SPF declares which servers are allowed to send on behalf of the domain. DKIM signs each message. DMARC tells receiving servers what to do with an email that fails those checks: let it through, quarantine it or reject it. The Canadian Centre for Cyber Security has devoted dedicated implementation guidance to the subject.
Since February 2024, Google and Yahoo have also required a DMARC record from senders who send large volumes. An SMB that neglects these settings therefore sees its legitimate emails end up in spam more often. Moving to a strict DMARC policy does, however, require identifying every service that sends on the company’s behalf, from the newsletter to the billing software. That is where DMARC management to protect your domain name saves weeks, because aggregate reports become readable and configuration errors surface before they block a legitimate send.
Contrary to a common belief, employee training does not replace these settings, and the reverse is just as true. A staff member who can spot a suspicious transfer request remains the last line of defence when the fraudster writes from an address that has nothing to do with yours.
Management software, the last stage of the transformation
Once exchanges are secured, the question of a central system comes up. Orders, purchasing, inventory, production, invoicing: in many SMBs, these flows still live in spreadsheets synchronized by hand. The day two people edit the same file, the inventory lies.
Two paths open up. Off-the-shelf software, quick to deploy, imposes its own processes on the business. Custom-built software fits existing processes, but requires an upfront investment and time. A custom-built ERP is generally planned over four to twelve months depending on complexity, according to figures published by a specialized Montreal firm. My recommendation: before choosing, map your flows on a sheet of paper, from order to payment. If the map looks like your competitors’, an off-the-shelf package will do. If it contains steps nobody else performs, that is probably where your edge lies, and a generic tool risks erasing it.
Data migration, the underestimated step
The project does not end at go-live. Customer records, order history and inventory have to move from the old system to the new one, and that transfer almost always reveals duplicates, poorly filled fields and inconsistent product codes. Serious integrators plan a field-by-field mapping and test imports that the client validates before the switchover. Set aside internal hours for this work: nobody knows your data better than the employees who enter it every day.
The following table summarizes the three projects, with what each one solves and the most common pitfall.
| Project | Problem solved | Typical setup time | Metric to track | Common pitfall |
| E-signatures | Lost documents, signing delays | A few days | Average time between sending and signing | Keeping a paper process running in parallel |
| Contract hosting | Compliance with Law 25 | A few weeks | Share of centralized files | Contracts scattered across personal inboxes |
| SPF and DKIM | Spoofing of the company’s address | A few days | Rate of authenticated messages | Forgetting a third-party sending service |
| Strict DMARC | Fraud in the company’s name, deliverability | Several weeks | Moving the policy from “none” to “reject” | Blocking legitimate sends for lack of an inventory |
| Employee training | CEO fraud, phishing | Ongoing | Click rate in simulations | A single session never repeated |
| Management software | Multiple spreadsheets, wrong inventory | Four to twelve months for custom builds | Time spent on manual data entry | Choosing the tool before mapping the flows |
Frequently asked questions
Does an electronic signature carry the same legal weight as a handwritten signature in Quebec?
Yes, in the vast majority of cases. Since 2001, the Act to establish a legal framework for information technology has recognized that value when the signature identifies the signer, establishes their consent and ensures the integrity of the document.
Where should an SMB start its digital transformation?
With what touches the outside world: document signing and email security. Both projects can be rolled out in a few days or weeks and quickly reduce the risk of fraud, before tackling a longer project such as management software.
What is DMARC, and does my SMB need it?
DMARC is a protocol that tells mail servers how to handle emails that claim to come from your domain without being authorized to. Any business that emails its customers benefits from it, if only to keep its legitimate messages from being flagged as spam.
Does a custom ERP cost more than off-the-shelf software?
Up front, often. Over several years, the comparison depends on licences, add-on modules and the time lost working around a poorly suited tool. The right calculation is based on total cost, not entry price.
contributed post
