To inventory your SaaS tools, build one list from billing records, single sign on and email domain sign ups, then record for each tool an owner, the data it holds, who has admin rights, and a review date. Reconcile it every quarter, because people add tools faster than lists change.
Why it matters
Each outside service is a place where your data or your credentials live, and a place that can be breached without your code changing. You cannot review, offboard or assess what you do not know about. Small teams often find the first inventory surprising, with tools adopted for one project and forgotten.
The CIS Controls IG1 includes inventory of enterprise assets and software among its basic safeguards for small and medium organizations, so this is standard hygiene, not extra credit.
Where to find the tools
| Source | What it reveals |
|---|---|
| Card statements and invoices | Paid tools, including individual subscriptions |
| Single sign on or identity provider | Tools your team signs in to |
| Email notifications | Tools that email you about sign ups and billing |
| Code host app list | Integrations with access to your repositories |
| Cloud marketplace and OAuth grants | Apps granted access to accounts |
| A short team survey | Free tools and personal accounts used for work |
Do not punish people for what you find. The goal is visibility. If people fear blame, they will hide tools.
Fields to record
Name, purpose, owner, who has admin, what data it holds (customer data, source code, credentials, none), how people sign in (single sign on, password), whether multifactor is on, the contract renewal date, and the last review date. Add an exit note for important tools: how you would export your data.
Triage by data
Sort by what the tool holds. Anything with customer data, source code or production credentials gets a closer look. Tools holding nothing sensitive can be listed and left. Spend your effort on the top of the list and use the lightweight vendor review for new additions.
Quarterly routine
- Re-read billing and sign in sources (15 minutes).
- Add new tools and remove retired ones.
- Ask each owner: still used, still needed?
- Check admin lists with your access review.
- Cancel and export what is not needed.
Common mistakes
Building the list once and never updating it. Listing only paid tools. Having no owner per tool. Ignoring integrations that hold tokens to your code.
Offboarding and the inventory
The inventory also makes leavers safer. When someone departs, check the list for every tool where they held admin or an individual account, and transfer ownership before removing them. Orphaned admin accounts are a common reason a team loses control of a tool.
Where Safeguard fits
Safeguard offers asset discovery, which helps with the code and infrastructure side of an inventory. It also provides SBOM and dependency scanning, reachability analysis to show which findings are actually exposed, and policies and gates for pull requests. A free scan is at gold.safeguard.sh/scan.
Quick check
Should we ban unapproved tools?
Better to make approval fast and easy than to ban. A short intake form beats hidden use.
How often should we review?
Quarterly for the inventory, and whenever a new tool touches customer data or source code.
Sources
Last reviewed: 19 October 2026.
