I have 12 years experience in ERP solutions like SAP and various others and get this type of question a lot from SME's.
I your case you want to provide implementation services and ultimately sign a retainer support contract for 36 months.
There are a few good ones out there, start with https://www.odoo.com/ , they have a good system that can grow with a business.

Hi, I am new to Clarity and like to answer this question although it is 8 months old. I had a similar challenge in my online marketing agency which I solved with technology.

I used Asana to manage each task on a customer account, even my meetings, phone calls was added as tasks. My team members had to account for all their time using assigned Asana tasks.
For timekeeping I used Harvest Time which integrates perfectly with Asana. Team members was able to manage all their time from within Asana with the Harvest timer button.

In Harvest Time I could track all time spend on each customer and if it reached it pre-set limit I would contact the customer to negotiate more budget or to move all new tasks over to next month.

This changed my business profitability big time, especially with Harvest Time project view.

A referral from someone that you know is always better than online reviews but unfortunately this is not always possible. Before I start engaging with any unknown business I start with a few basic online research actions.
1) Who owns their web domain. Goto https://www.whois.com/whois/ and enter their domain name. Here you can get a good idea to who their domain belongs to and if it is a Nigerian or some other suspect person or company run....
2) Online reviews can also help but look out for companies that they claim use them and do some research on these companies, maybe contact them to confirm that they actually use this services.
3) LinkedIn - check out their employees, address, and any details to match what they supplied to you. Maybe link to someone in the company and ask them a question that might catch them off guard.
4) Company directory - how long have they been in business and does the address match the one they provided to you.
5) Google maps - check their address on street view, do you see their name on the building or does it look like a legitimate place of business?

None of these are fool proof but doing this will give you a good gut feeling.