Whether it's a big or small company, for anything vital, you will always need assurances for the continuity of the work. Large companies can also go bankrupt or decide this type of work isn't viable for them. What you need, in those cases, is access to everything: the source code, the deployment passwords, everything. Let them be kept in escrow until the vendor becomes unable or unwilling to fulfil their duties.
When faced with such discussions about small companies being higher risk, I'd trot out Sun Microsystems, GM, Chrysler, etc.
There is risk. There is always risk. Risk has little to do with size. It has a great deal to do with management, capital, ability to acquire and keep customers, etc.
As a "startup", we were in business for a decade with revenues of several million per year and growing around 30% YoY, successful/stable products proven in the field in which we were selling them. Dominating in most of the technical and support aspects compared to competitors.
What I found was that the people claiming "too small" were simply conflating larger/well known brand name with reduction of risk. This bias exists throughout this industry, and has for a while. The old "nobody ever gets fired for buying IBM" is a historical example of this.
Yet, when the market feces hit the fan, IBM was infamous for leaving the very markets that they had troubles in.
Google is infamous for its killing off things, effectively at random.
I could go on, but the point is that large well known brand is not synonymous with low risk. Rather the opposite.
But, I'm out of that market and that chapter of my life has been completed. Now that I'm in a small but growing company, it helps that I can see things from this side, in that I still see reluctance to consider worthy technology. Risk aversion takes many forms, and often the decisions made do little to mitigate the risk. Rather, I've seen it concentrate/increase said risk.
Then yours is not a company I would be concerned with. < 5 years and the leadership may still be looking for their lucrative exit. At 10 years I'm convinced that an easy exit isn't the short term goal and the business is somewhere near self-sustaining. I could be wrong, but there's always risk. Recently (well, 3 years ago) my workplace went best bread for a specific need and the vendor was about 6 years old. But in that time they'd grown so much by having an truly fantastic product that I was convinced that even if they were acquired, it would be for the acquiring company to adopt a truly superior product rather than convert customers to their own mediocre offering. Which turned out to be correct: they were acquired, but by a private capital group looking to pump $$$ into them to facilitate more growth & either flip/ipo them. Though to be fair, feature growth had slowed too, but it's also a mature product now so to much growth there would be bloat. Either way, it's an example of a relatively young & small vendor that had the characteristics needed to make me comfortable in their selection.
