SaaS spend accumulates outside procurement, one card payment at a time, until nobody can say how many tools the organisation pays for. This inventory is built to surface those as much as the sanctioned ones.
Find it in the card statements. Export twelve months of corporate card and expense data and filter for recurring charges. This finds more undeclared SaaS than any survey, because people do not think of a £19/month tool as software procurement.
Record what data each tool holds. Cost is the obvious column; data is the consequential one. A £15/month tool holding customer personal data carries far more risk than a £500/month one holding nothing sensitive.
Look for overlap deliberately. Most organisations pay for two or three tools doing substantially the same job, acquired by different teams. Grouping by function rather than by vendor makes it obvious.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
| Application | Function | Business owner | Users | Annual cost | Billing route | Data held | SSO | DPA signed | Renewal | Status |
|---|---|---|---|---|---|---|---|---|---|---|
| CRM | Sales | Head of Sales | 42 | £48,000 | Invoice / PO | Customer personal data | Yes | Yes | 2027-03-31 | Sanctioned |
| Project tool A | Project management | Head of Delivery | 28 | £6,700 | Invoice | Internal only | Yes | N/A | 2027-01-20 | Sanctioned |
More free templates IT teams use alongside this one.
The expensive date is not the renewal. It is the notice deadline, typically 30 to 90 days earlier, after which you are committed for another year whatever you decide. This tracker is built around that date.
Shadow AI differs from ordinary shadow IT in what leaves the building: unstructured text that may contain anything, pasted by someone who did not consider it a data transfer. This worksheet is a repeatable discovery sweep.
Licence management has two failure modes that pull in opposite directions: under-licensed and exposed at audit, or over-licensed and paying for seats nobody uses. This tracker shows both gaps in the same view.
Corporate card and expense data over twelve months is the single most productive source, because small recurring charges rarely pass through procurement. Supplement with OAuth grants, identity provider application lists, and web gateway logs.
Who owns it, how many users, what data it holds, whether SSO is enabled, whether a data processing agreement exists, the renewal date, and whether it is sanctioned. The data column usually matters more than the cost column.
Very. Most organisations pay for two or three tools doing substantially the same job, acquired independently by different teams. Grouping the inventory by function rather than by vendor makes the overlaps immediately visible.
