Why this happens to almost every small contractor
A foreman starts a WhatsApp group for a site. It works, so the next site gets one too. Within a year the business is running quotes, safety photos, supplier invoices and change orders through a dozen chat threads on personal phones. Nobody decided this. It just accumulated, one convenient message at a time.
The problem shows up the day it cannot be ignored: a phone is lost with the only copy of a signed contract, an employee leaves and takes the group chat history with them, or a client asks for photo evidence from six months ago and nobody can find the thread. None of this is a technology failure in the usual sense. It is a business running its records on a consumer messaging app that was never built to be a filing system.
The scale of this gap is measurable. Only 52.7% of EU enterprises bought any cloud computing service in 2025, and in Spain the figure was 41.7% and in Greece 24.3%, both still below the EU average [1]. Construction is a heavily on-site, cash-flow-sensitive trade, so it tends to sit even further behind that average than the headline number suggests. A 90 day plan does not require a full digital transformation. It requires four specific pieces of infrastructure, added in the order that keeps the business running instead of stopping it.
What actually breaks first
Three failure modes account for most of the pain we see in the first onboarding call with a contractor:
- 1A phone is lost, stolen or the owner leaves. Contracts, timesheets, photos and client numbers walk out the door because nothing was ever backed up anywhere else.
- 2A dispute needs a paper trail. A client claims a change was never agreed. The evidence exists, but it is buried in a chat thread nobody can search by date or export cleanly.
- 3Personal and business get tangled. An owner's personal phone number is the business's main line. When that phone breaks or the owner is unreachable for a day, the business is unreachable too.
None of these need enterprise IT to fix. They need a business email address, one shared place for files, a few device basics and a backup that runs on its own.
The 90 day plan
The order matters more than the speed. Each phase is chosen so that work on site never stops for it - most of the setup happens in evenings or during a slow week, not as a project that pulls people off jobs.
Phase 1: Days 1 to 30 - business email and one shared drive
Start with a proper business email domain (yourcompany.com, not a personal Gmail address used for invoicing) and one shared cloud drive for contracts, permits, insurance certificates and site photos. This alone removes the single biggest risk: a document that only exists on one phone. Keep WhatsApp for day-to-day site chat if the crew is used to it - the goal in phase 1 is not to ban a tool people already know, it is to make sure nothing important lives only inside it.
Phase 2: Days 31 to 60 - shared calendars, folders per job, and basic device rules
Once email and files are live, organise the shared drive by job site rather than by document type, because that is how a foreman actually looks for something on site. Add a shared calendar so two crews are not booked against the same equipment or the same client visit. Set two device basics on every phone that touches business data: a screen lock, and the ability to remotely wipe a lost or stolen device. This is not about controlling personal phones - it is about making sure a lost phone is an inconvenience, not a data loss event.
Phase 3: Days 61 to 90 - automatic backup and an access checklist for leavers
Turn on automatic backup for the shared drive and business email so a deleted file or a ransomware incident is a restore, not a crisis. Write a one-page checklist for what happens when someone leaves the business - which accounts get their access removed and when - because under GDPR, personal data an employer holds must be kept accurate and only as long as it is needed for the purpose it was collected for, and an ex-employee with live access to client files or shared folders is exactly the kind of exposure that principle is meant to prevent [2].
Backups are not optional, they are the whole point
Cybercrime reported to the FBI's Internet Crime Complaint Center caused $16.6 billion in losses across 859,532 complaints in 2024, and personal data breach alone accounted for 64,882 of those complaints [3]. A small contractor is not the target Wall Street worries about, but the same forces apply at a smaller scale: a lost device, a phishing message that steals a password, or a ransomware note are all events where the only thing standing between "inconvenience" and "the business stops" is whether a backup exists somewhere other than the device itself.
Passwords: fewer rules, not more
Most small firms either enforce no password policy at all or an overly strict one that gets ignored. NIST's authentication guidance recommends against forcing frequent password changes and against complex composition rules, and instead favours longer passwords that are simply left alone unless there is evidence of compromise [4]. For a five to twenty person contractor, this translates into one practical rule: a long passphrase on the business email account, protected with two-factor authentication, and nothing more complicated than that.
Cost and where the €300 to €500 a month figure actually goes
From our own onboarding work with construction and trade businesses, a basic cloud stack (business email, shared files, backup and a handful of managed phones) for a 10 to 15 person crew typically runs in the €300 to €500 a month range, most of it licensing rather than labour. That is not a one-off migration bill - it is the ongoing cost of not losing a contract to a lost phone.
What to skip in the first 90 days
Do not attempt full mobile device management, a formal IT policy document or a helpdesk ticketing system in the first quarter. Those solve problems a five to twenty person contractor does not have yet. The 90 day plan is deliberately narrow: business email, one shared drive organised by job, two device basics, and a backup that runs without anyone remembering to trigger it. Everything else can wait until the business has outgrown this stack, which is a good problem to have.
