Software tools for starting an online business: the stack, job by job

How to choose any tool in the stack

Pricing pages all look alike, but four questions sort most tools quickly:

1. Can you get all your data out? Look for a full export in a standard format (CSV, XML or JSON) that includes files and history, not only a summary. Test it in the first week, while there is little to lose.
2. How does the bill grow? Free and entry plans are fine for a start. What matters is the unit you pay for once you grow: users, contacts, tasks, transactions or documents.
3. Does it connect to the rest? A built-in integration with the tools you already chose beats a clever feature. Next best is a documented API with webhooks, so an automation tool or a developer can connect it later.
4. Who owns the account? Sign up with a business address, not a personal one or a contractor's, keep at least two administrators, and turn on MFA before any customer data goes in.

The unit you pay for is where most small-business software bills surprise people:

Lock-in is the other cost. It rarely shows on the first invoice. It shows the day you want to leave and find that the export leaves out images, history or attachments.

Domain and website: builder, CMS or store platform

Register the domain in the business's name

The domain outlives every other tool, so register it first, in an account the business controls, with a business address as the contact. If a web designer registers it in their own account, you depend on them to move it: transferring a domain to another registrar needs an authorization code that the current registrar issues to the domain holder. Keep the DNS somewhere you can edit it yourself, because email authentication, site verification and most integrations are set up there.

Choose how the site is built

Three kinds of platform cover almost every new online business:

The export question separates them. Wix says plainly that a Wix site has to be hosted on Wix's servers and cannot run on another host, although the content you build belongs to you. Squarespace exports certain content to an XML file for WordPress, but not everything, because many features rely on the platform's own code. WordPress can export posts, pages, comments, custom fields, categories, tags and users as an XML file (WXR) that another WordPress site imports. None of this makes a builder the wrong choice. It makes a builder the right choice for a site you would be happy to rebuild in a few days, and a CMS the better choice for content you will keep adding for years. A CMS is also software you maintain; our website security checklist covers what that involves.

What to look for in any of them: fast pages on a phone, accessible templates, your own domain on the plan you will actually use, editable titles and descriptions, clean URLs with redirects, a sitemap, and forms that send inquiries to a shared address rather than one person's inbox.

When to upgrade: when the template decides your layout instead of you, when you need customer accounts, portals or workflows that no plugin does well, or when speed and search are costing sales. That is the point where a custom build pays for itself. Our web design and development team designs and builds marketing sites and web applications, and will tell you when a template is still the right answer.

Selling online: store platform and payments

E-commerce platform

If products are the business, start on a store platform rather than adding a cart to a brochure site. Shopify is hosted and runs its own updates; WooCommerce adds a store to a WordPress site you host, with more control and more maintenance. Either way you get products, variants, stock, tax and shipping settings and orders in one place, plus connectors to payment, accounting and email tools. Where online selling is heading, from AI shopping to agent checkout, is in the future of e-commerce.

Check the export before you load the catalogue. Shopify exports products to a CSV file, which is enough to move them, but the product images are not in the file. An import only picks the images up while they are still viewable on a public website, so the old store must stay up until the import is done. Check what customer and order exports include too, before there are thousands of them.

The platform and the payment provider are one decision, not two. Shopify charges third-party transaction fees on outside payment gateways even when Shopify Payments is active (PayPal and manual payments are exempt when it is). A store also brings its own search problems, from filter URLs to discontinued products; our e-commerce SEO guide covers them.

When to upgrade: when you sell through several channels (your store, marketplaces, wholesale) and stock must agree everywhere, or when orders are frequent enough that a manual step becomes someone's job. That is where an inventory or order management system, and integrations between them, join the stack.

Payments

A payment provider such as Stripe, PayPal or Square takes the card, screens it for fraud and pays out to your bank account. The decision that matters most is where the card number is typed. A business whose own pages collect raw card numbers may have to meet more than 300 security controls in PCI DSS, the card industry's data security standard. A hosted checkout, or payment fields embedded from the provider, sends card details straight to the provider without passing through your servers, and your site only learns whether the payment succeeded. You still confirm PCI compliance every year, with far less to prove.

Fees stack. As of September 2026, Stripe's standard US pricing is 2.9% + 30¢ per successful domestic card payment, plus 1.5% for international cards, 1% when currency conversion is needed, 0.5% for manually entered cards, and $15 for each dispute received. If you sell across borders, work out the effective rate on your real mix of customers, not the headline rate.

What to look for: the payout schedule to your bank, the currencies you can settle in, the local payment methods your customers expect, dispute alerts, and a payout report your accounting software can import. Avoid taking business payments through a personal account, which mixes records and makes the payout history hard to hand to an accountant. Upgrade to negotiated pricing once volume justifies it; Stripe, for one, offers custom packages to businesses with large payment volume.

Business email, documents and files

Run email, documents and file storage on one suite rather than separate apps: Microsoft 365 (Outlook, Word, Excel, OneDrive, Teams) or Google Workspace (Gmail, Docs, Sheets, Drive, Meet). Both give you email on your own domain, shared files and video meetings, and both have business plans for up to 300 users: Microsoft 365's Business plans point larger organizations to its enterprise plans, and Google's Business editions cover 1 to 300 users, with Enterprise editions beyond that.

Choose the one whose files your customers and accountant already send you. If contracts arrive as Word documents and the bookkeeper lives in Excel, Microsoft 365 saves conversion friction; if the team works in the browser and shares by link, Google Workspace feels lighter. Most tools in this guide connect to either.

Both suites are priced per user, so do not buy a seat for every address:

• In Microsoft 365, info@ or orders@ can be a shared mailbox, which needs no licence up to 50 GB. The people who answer it use their own licensed mailboxes.
• In Google Workspace, an admin can give each user up to 30 email aliases at no extra cost, which suits one person covering sales, billing and support. An alias belongs to one user; for an address several people answer, Google recommends delegation.

Secure the suite before you move data into it. Microsoft's security defaults require MFA and block legacy sign-in protocols at no extra cost; Microsoft reports that the combination stops more than 99.9% of common identity attacks, and new tenants get security defaults when they are created. Check they are still on. In Google Workspace, turn on 2-Step Verification for every account.

Then publish SPF, DKIM and DMARC records for your domain before sending anything in volume. Gmail requires SPF or DKIM from every sender, and all three from anyone sending more than 5,000 messages a day to Gmail accounts; mail that fails authentication can be marked as spam or rejected. Every tool that sends email as you (the store, the help desk, the email marketing platform) needs to be included in those records.

When to upgrade: once laptops and phones hold customer data and there are several of them, you need device management as well as accounts. Microsoft's Business Premium plan adds advanced security features and the tools to set up and secure managed devices, still for up to 300 users.

Accounting and invoicing

Accounting software keeps the books, sends invoices, and matches payments against your bank account. QuickBooks Online and Xero are common examples. Choose it with your accountant, who will work in it too.

What to look for: a bank feed from your bank, the sales tax, GST/HST or VAT rules of the places you sell to, multi-currency if you invoice abroad, a store or payment connector that records the sale, the provider's fee and the payout as separate lines, and a full export of the ledger.

The two examples show the two ways the bill grows. As of September 2026, QuickBooks Online's US plans are priced by users: Simple Start covers 1 user, Essentials 3, Plus 5 and Advanced 25, each with free access for two accountants (three on Advanced), and the list price goes from $38 to $85 a month when you move from Simple Start to Essentials to add a second person. Xero's US plans have no per-user licence fees, but the entry Early plan ($25 a month after an introductory offer) is capped at 20 invoices and 5 bills, and multiple currencies come only with the top Established plan ($90 a month). Neither model is better. They fail in different ways, so price the plan you will need in a year, not the one that fits today.

Avoid recording payment provider payouts as single lump sums: the fees, refunds and chargebacks inside them disappear from the books. Avoid store connectors that create a new customer for every order, too; one customer should stay one record.

When to upgrade: when inventory, several legal entities or project costing outgrow your plan. The next step is a higher plan or an ERP, such as NetSuite or Microsoft Dynamics 365 Business Central, and your accountant should be part of that decision.

Customers: CRM, email marketing, bookings and support

Customer relationship management (CRM)

A CRM keeps contacts, companies, deals and conversations in one place, so a lead from the website does not live only in someone's inbox. HubSpot, Pipedrive and Zoho CRM are common starting points. A solo business selling to consumers can wait: the store's customer list and the email platform cover it. Add a CRM when more than one person follows up with leads, or when a sale takes weeks.

What to look for: forms or integrations that create contacts automatically, email logging from Microsoft 365 or Google Workspace, pipelines and fields that match how you sell, and an export that keeps relationships. HubSpot, for example, exports records with their properties and their associated contacts, companies and deals.

Free tiers are generous with features and tight with people. As of September 2026, HubSpot's free tools allow up to 2 users and 1,000 contacts, with no time limit, and paid plans are priced per seat. Count the people who need to edit records, not everyone who might want a look. Upgrade when you need automated follow-up, pipeline reporting, or roles and permissions.

Email marketing

An email marketing platform (Mailchimp, Brevo and Klaviyo are common examples) sends newsletters and automated sequences, such as a welcome series or a reminder about an abandoned cart. Two things matter more than templates.

The first is authentication. Connect the platform to your domain so its mail passes SPF and DKIM and your DMARC policy, because Gmail's sender rules apply to your newsletter too, including one-click unsubscribe once you send more than 5,000 messages a day.

The second is consent, under the law where your recipients live. Canada's anti-spam legislation (CASL) expects businesses to obtain consent before sending commercial electronic messages. The US CAN-SPAM Act requires a valid postal address in every message and an opt-out honoured within 10 business days. Build the sign-up form to record consent, not only an address.

Most platforms price by contacts, and the definition matters. Mailchimp counts unsubscribed and non-subscribed contacts toward the monthly contact limit, and non-subscribed contacts include people added from a connected store or an integration; archived contacts do not count. Connect the store knowing that every buyer may become a billable contact, and archive regularly.

Scheduling and bookings

If you sell time (consultations, classes, repairs), a booking page replaces the back-and-forth. Check what your suite already includes before paying for another tool. Microsoft Bookings is included in Microsoft 365 Business Basic, Business Standard and Business Premium. Google Calendar's appointment schedules give you a booking page with options such as buffer time, up to 5 reminders and payment through a connected Stripe account; some of those features need an eligible Workspace or Google One subscription. Standalone schedulers such as Calendly are the next step when you need booking rules the suite cannot express.

What to look for: time zones, buffers between appointments, reminders, a cancellation policy with deposits where no-shows hurt, and bookings that land in the CRM. Upgrade to an industry booking system when you schedule several staff, rooms or equipment, or sell packages and memberships.

Customer support and chat

Start with a shared support@ mailbox in your suite. Move to a help desk such as Zendesk, Freshdesk or Help Scout when conversations get lost: two people answer the same email, or nobody does. A help desk turns each email, chat or form into a ticket with an owner, a status and a history, and adds a knowledge base for the questions you answer every week. Live chat on the site is worth adding only when someone is there to answer, or when the knowledge base can.

Help desks price per agent, and extras are metered. Freshdesk, as of September 2026, charges per agent per month on every plan, sells day passes for people who help occasionally, and includes the first 500 sessions of its AI agent before charging for more. Buy seats for the people who answer every day and day passes for the rest.

Measure what works: GA4 and Search Console

Two free Google tools cover most of what a new business needs to measure:

• Google Search Console shows how the site appears in Google Search: the queries and pages that earn impressions and clicks, with click-through rate and average position. Add and verify your domain on launch day and submit the sitemap; our guide to what SEO is explains how to act on what it shows.
• Google Analytics 4 (GA4) shows what visitors do once they arrive: where they came from, what they read and which key events (a purchase, a form sent, a booking) they complete.

Set up GA4 properly on day one. Mark the key events, connect the store's purchase tracking, and set the data retention to 14 months, the longest a standard property allows (the other option is 2 months). Retention does not affect the standard reports, but it limits explorations and funnel reports, which are the ones you will want a year from now.

Together with email marketing and the CRM, these two make up the online marketing software a small business needs at the start. Social scheduling and advertising tools come after, once you know which channels bring customers. Avoid adding tracking scripts without a question to answer: each one slows the site and adds consent work. Upgrade when you need to join ad spend, orders and CRM data in one report, which usually means exporting the data into a warehouse.

Protect the stack: password manager, MFA and backup

Password manager and MFA

By now the business has at least a dozen accounts, several of which can move money or expose customer data. The UK National Cyber Security Centre's guide for small organizations recommends a password manager, because a different strong password for every account is otherwise hard to remember; passkeys where a service offers them, because a passkey cannot be intercepted, reused or stolen the way a password can; and 2-step verification wherever passwords remain.

Use a business password manager (1Password, Bitwarden and Keeper are examples) with shared vaults, so the registrar or Stripe login is shared through the vault rather than by message, and access ends when someone leaves. Secure the email accounts first, because email resets every other password, then the registrar, payments and banking, then the rest. The NCSC also advises removing accounts people no longer need and reviewing access every few months, which matters from the first hire onward. Our cybersecurity checklist for small businesses puts these steps in order.

File backup

Cloud storage is not a backup by itself. OneDrive and Google Drive sync: when a file is deleted, overwritten or encrypted by ransomware on a laptop, the change reaches the cloud copy too, and you rely on the recycle bin and version history to undo it. Those have limits. Microsoft lets work accounts restore deleted OneDrive files for 93 days, unless an admin changed that, and roll a whole OneDrive back to any point in the last 30 days. Google Drive deletes files in the trash forever after 30 days.

The NCSC's advice is to back up everything the business needs to operate, including the website, email, invoicing, documents and contacts; to consider two backups, one online and one on a storage device that stays disconnected when not in use; to protect online backups with 2-step verification; and to check that a restore actually works. For the suite, a service such as Microsoft 365 Backup keeps point-in-time copies of mailboxes, OneDrive and SharePoint that can be restored after ransomware or a mass deletion. For the SaaS tools (store, accounting, CRM), schedule their exports. Our data backup strategy guide goes further.

Connect the tools so data is entered once

The stack only pays off if each record is typed in once. An order should create or update the customer in the CRM, post the sale and fee to accounting, and add the buyer to the right email list, without anyone copying it across.

Four rules make that dependable:

1. Give every kind of record one system of record. Products and orders live in the store, invoices and payments in accounting, contacts in the CRM. Other tools receive copies and do not edit the original, so when two tools disagree, the owner wins.
2. Use built-in integrations first. The store's own connectors to the payment provider, the accounting software and the email platform are maintained by the vendors and usually cover the main flow.
3. Fill the gaps with an iPaaS. Tools such as Zapier and Make connect apps without code: a trigger (a new order, a new form entry) starts a series of actions in other apps.
4. Design for retries and duplicates. Stripe, for example, retries webhook deliveries for up to three days, does not guarantee their order, and may deliver the same event more than once; it recommends logging the event IDs you have processed. Its API accepts idempotency keys, so a retried request does not create a second object. An automation that ignores this creates duplicate customers and double invoices.

The automation tools bill in different units, and the difference grows with volume. Zapier counts a task for each successful action step; triggers, filters and failed steps are not counted, so a Zap with three actions uses three tasks per order. Its free plan includes 100 tasks a month and two-step Zaps, as of September 2026. Make counts an operation for every module run, including each time a trigger checks for new data, and for ordinary apps one operation costs one credit. Its free plan includes up to 1,000 credits a month, with at least 15 minutes between scheduled runs. A scenario scheduled every 15 minutes makes about 2,880 checks in a 30-day month, nearly three times that allowance before a single order is processed.

Where the line falls: an iPaaS recipe suits simple, low-volume flows that a business owner wants to change without code; custom integration suits high volume, complex mapping or strict reliability. When the flows outgrow a Zap, our integrations service connects CRM, accounting, e-commerce and internal systems so data is entered once and stays in step, with idempotency keys and daily reconciliation keeping both sides of every flow in agreement.

A starter stack for three stages

The same jobs exist at every size; what changes is how much each tool has to carry.

At the growing stage the stack also needs the tools that keep people and devices working: device management, remote support and monitoring. Our guide to remote IT support tools covers that layer. Once a year, run the four questions from the start of this guide against every tool: export its data, check the unit you pay for, confirm it still connects cleanly, and confirm the business still owns the account.