Secure EMail providers in the US are dropping like flies. As they get requests from US government agencies they are choosing to shut down rather than provide access to their customer’s email. As one closed down the founder in a post recommended using Kolab. Their claim to security is its servers reside in Switzerland. A country with strong historic privacy protections.
My concern is that their servers don’t store data encrypted but you could combine this with your own PGP encryption if desired. Their servers may have more formal protection against government requests but I have my reservations about their ability to keep out a focused government hacking attack. Maybe your data is more secure from legal access but it doesn’t seem it is more secure from hackers, which is your small businesses biggest threat.