Thesis 013 · Guides

The complete guide to auditing your SaaS stack

Treat a SaaS audit as renewal preparation: every tool ends with an owner, a usage threshold and a notice date, or it does not renew.

By The Revenue Thesis Team Updated 19 min read 9 chapters

Stacks of paper documents marked with colored sticky tabs

This guide is for the person at a 20 to 500 employee B2B company who has been told to “look at software spend”: a RevOps lead, a finance manager, an IT generalist or a COO. It assumes no dedicated procurement team and no SaaS management platform yet. It is not written for large enterprises with a software asset management function, though most of the method still applies.

By the end you should be able to build a complete list of what you pay for, tell which licenses are actually used, spot tools that do the same job, find the renewal clauses that will cost you money, and decide for each tool whether to keep, consolidate or cut it. Contract terms below are described, not interpreted. This is not legal advice; read your own order forms with counsel when the stakes are high.

Our argument is that an audit is only worth the effort if it changes what happens at renewal. A spreadsheet of apps is a by-product. The output that saves money is a dated calendar of notice deadlines, each with an owner and a usage number to defend.

Summary

  • Vendor research consistently finds roughly half of paid SaaS licenses idle in any given month. Your number will differ, so measure it.
  • Build the inventory from money first (AP, cards, expenses), then identity (SSO and OAuth logs). Neither source alone is complete.
  • Measure usage per seat against a written threshold before any conversation with a vendor or a team.
  • Overlap clusters in a few categories: communication, documents, project management, data enrichment, scheduling and, newest, AI assistants.
  • Auto-renewal, notice periods, mid-term downgrade bans and list-price resets do more damage than any single unused tool.
  • Every cut is also a security task: revoke OAuth grants and disable orphaned accounts, or the risk outlives the contract.
  • Run a full audit once, then a light quarterly review tied to the renewal calendar.

1. Why SaaS stacks bloat

Stacks grow because buying software is easy and stopping it is nobody’s job. A team lead puts a tool on a card. It renews. The person leaves. It keeps renewing.

The best available numbers come from vendors that sell SaaS management software, so read them as vendor research drawn from their own customers. Zylo’s 2026 SaaS Management Index reports an average portfolio of 305 applications (median 240) and average annual SaaS spend of $55.7 million, up 8% year over year.11 Source: Zylo, “2026 SaaS Management Index”, accessed Oct 2026. Vendor research based on Zylo’s own customer data (40M+ licenses). Those customers skew large. Okta’s Businesses at Work 2025 report, which counts apps connected through Okta’s identity platform, put the average at 101 apps per customer, the first time it passed 100.22 Source: Okta, “Businesses at Work 2025: 10 years of data show how critical security has become”, accessed Oct 2026. Counts apps connected through the Okta Integration Network, so it understates total app use. It only counts apps IT has connected to single sign-on; the managed list is always shorter than the real one.

Where the money leaks

Three mechanisms explain most waste.

Idle licenses. Zylo reports that the average organization uses 54% of its SaaS licenses, and estimates annual waste on unused licenses at $3.8 million for organizations with 1 to 500 employees.33 Source: Zylo, “How Much Is Wasted on SaaS Spend?”, accessed Oct 2026. Figures attributed to Zylo’s 2026 SaaS Management Index; methodology not described on the page. Treat the dollar figure with care; it is an average across Zylo’s customer base and a 60-person company will not lose millions. The ratio is the useful part.

Decentralized buying. Zylo’s January 2026 release found expense-based SaaS spend up 267% year over year, with ChatGPT the most expensed application.44 Source: Zylo, “Zylo’s 2026 SaaS Management Index Finds AI-Native App Adoption Is Surging”, accessed Oct 2026. Press release dated January 29, 2026. Every expensed tool is a tool without a contract owner, a security review or a renewal date in anyone’s calendar.

Price drift. Even a stack that does not grow gets more expensive. Vertice, a procurement software vendor, measured SaaS inflation at 8.7% in 2023, with sales software rising fastest at 10.6%.55 Source: CFO Dive, “Escalating SaaS prices outpace CPI inflation”, accessed Oct 2026. Reports Vertice’s 2023 SaaS Inflation Index; we did not find a newer edition. Salesforce announced an average 6% list price increase for its Enterprise and Unlimited editions from August 1, 2025.66 Source: Salesforce, “Updated Product Packaging and Pricing Offer New AI Capabilities”, accessed Oct 2026. Published June 17, 2025; covers Sales Cloud, Service Cloud, Field Service and select Industries Clouds.

Gartner’s widely quoted prediction points the same way: organizations that fail to get centralized visibility and coordinate SaaS life cycles will overspend by at least 25% through 2028, due to unused entitlements and overlapping tools.77 Source: USU, “Insights from the 2026 Gartner Magic Quadrant for SaaS Management Platforms”, accessed Oct 2026. Gartner prediction as quoted by USU, itself an SMP vendor.

For how the revenue tools in this inventory should fit together in the first place, see the complete guide to building a B2B revenue stack. The other side of the ledger, how to price what you sell, is covered in the complete guide to B2B SaaS pricing.

2. Build the inventory

The inventory is one table with one row per product. Start from money, which catches everything you pay for. Then cross-check identity data, which catches what you use but do not pay for centrally.

A hand ticking items on a checklist in a notebook
Fig. 1 The inventory comes first: finance data, single sign-on logs and expense reports, combined.

The four sources

SourceWhat it findsWhat it missesWho to ask
Accounts payable and the general ledgerContracted tools paid by invoice, annual prepaymentsCard and expense purchases, free tools with data accessFinance
Corporate cards and expense reportsTeam-level and individual subscriptions, AI tools, monthly plansTools paid by invoice, free tiersFinance, card admin
SSO / identity provider logsApps behind single sign-on, active users, last loginApps with their own passwords, personal sign-upsIT or whoever runs Okta, Entra or Google Workspace
OAuth grants and browser discoveryApps users connected to company Google or Microsoft accounts, extensionsTools with no identity linkIT, security

SSO (single sign-on) means employees log into apps through one identity provider (IdP) such as Okta, Microsoft Entra ID or Google Workspace. OAuth is the protocol behind “Sign in with Google” and “Allow this app to read your calendar”; each approval is a grant that lets a third-party app access company data.

Pulling each source

Finance data. Export 12 to 18 months of vendor payments from the ledger and card platforms. Filter to software vendors by merchant category and name. Normalize names, because the same product appears as a parent company, a reseller and a payment processor. Annual payments matter most: they reveal renewal months.

Identity data. Export the app list and last sign-in per user from your IdP. This gives you named users per app, which finance data never does.

OAuth grants. In Google Workspace, admins can view the list of accessed apps under Security, Access and data control, API controls, with the number of users per app and the Google data scopes each one uses, and download it as a CSV.88 Source: Google Workspace Admin Help, “Control which apps access Google Workspace data”, accessed Oct 2026. In Microsoft Entra ID, admins can review admin and user consent granted to each enterprise application and revoke admin-consented permissions from the admin center; user-consented permissions need Microsoft Graph or PowerShell to revoke.99 Source: Microsoft Learn, “Review permissions granted to enterprise applications”, accessed Oct 2026.

Browser discovery. Management platforms often use a browser extension to catch logins that bypass SSO. Without one, a short staff survey catches a surprising amount.

Fields to record per tool

Product, vendor, category, business owner, admin, annual cost, pricing model, seats purchased, term, renewal date, notice period, auto-renewal, payment method, SSO, data sensitivity and integrations. Notice period is the column most often left blank and the one that matters most.

3. Measure usage

Usage tells you whether a seat earns its cost. It needs a definition before anyone looks at the numbers, or every team will argue its own.

Pick a definition per category

  • Daily tools (chat, email, CRM for reps): active if the user logged in on most working days in the last 30.
  • Weekly tools (project management, BI dashboards): active if used in at least three of the last four weeks.
  • Occasional tools (applicant tracking for interviewers, e-signature, design review): active if used in the last 90 days, and consider whether these users need a paid seat at all.

The definitions above are working guidance, not industry standards. Productiv’s older research makes the point about occasional users: across its customers it found average app engagement over 60 days of 45%, and higher engagement (54%) for apps bought outside IT.1010 Source: Help Net Security, “SaaS applications investment growing despite underutilization of app licenses by employees”, accessed Oct 2026. Reports Productiv’s 2021 vendor research; older data, used here for the occasional-use point only. Low engagement on a tool designed for occasional use is not the same as waste.

Last login is a floor, not a verdict

Last login shows who never shows up, not who logs in and does nothing. For the top ten tools by spend, use feature-level activity from the vendor’s admin console. Elsewhere, last login is enough.

Seat pricing versus usage pricing

Per-seat pricing wastes money quietly; usage pricing wastes it loudly, in a bill spike. Zylo’s 2026 index reports that 78% of IT leaders faced unexpected charges tied to AI features or consumption-based pricing, and 61% cut projects as a result.1 For usage-priced tools, compare the bill to forecast monthly and check whether contracted limits trigger overages. HubSpot’s customer terms, for example, say that exceeding contracted limits incurs overages invoiced at the then-current rates.1111 Source: HubSpot, “Customer Terms of Service”, accessed Oct 2026. Sections 2.5 (Downgrades), 3.1 and 3.2 (fees, overages, renewal adjustments) and 4.1 to 4.2 (renewal). One vendor’s terms, shown as an example of common clauses.

A practical utilization target: flag any seat-priced tool where fewer than about 80% of purchased seats meet your active definition. Zylo says its best-performing customers reach at least 90%.3

4. Find overlap by category

Overlap is two or more tools doing the same job for the same people. It is the largest source of consolidation savings and the hardest politically, because every duplicate has a fan. Group the inventory by category and work through the checklist below.

A hand pinning notes to a planning board on a wall
Fig. 2 Grouping tools by category is the quickest way to see where two do the same job.
CategoryCommon overlap patternQuestions before consolidating
Messaging and videoTwo chat tools, three video tools after acquisitions or client demandsWhich do clients require? Is one bundled in a suite you already pay for?
Documents and wikisSuite docs plus a separate wiki plus a note toolWhere does the source of truth live? Can permissions be migrated?
Project and work managementDifferent tools per departmentDo cross-team projects actually span tools? What breaks if you move?
Data enrichment and prospectingTwo or three contact data providers bought by different repsCompare match rates on your own ICP sample, not vendor claims
Sales engagement and dialersSequencer plus CRM-native sequences plus a separate dialerWhich one writes activity to the CRM correctly?
E-signature and contractsOne tool in sales, another in HR or legalCan one contract cover both teams’ volumes?
AI assistantsChat assistants, writing tools and meeting note takers bought per personWhat data are users pasting in? Is one approved for company data?

ICP (ideal customer profile) is the description of the accounts you sell to best; data tools perform differently by segment.

Suite versus specialist

Before cutting a specialist for a suite feature, compare them on the one or two tasks that matter. Suites win on cost and admin; specialists win when the job is central to revenue.

For how to test contact data providers against each other before you consolidate, see the best email enrichment tools in 2026.

5. Contract and renewal traps

Renewal terms are written by the vendor. This chapter describes common clauses and does not interpret your contract. Your signed order form usually takes precedence over general terms, so read it first.

Auto-renewal

Many B2B SaaS contracts renew automatically unless you act. HubSpot’s customer terms, for instance, say a subscription automatically renews for the shorter of the prior term or one year, unless you turn off auto-renewal in account settings before the term ends.11

Notice periods

Many contracts require written notice of non-renewal a set number of days before the term ends. Miss it and the renewal stands. Some US states regulate this for certain contracts. New York’s General Obligations Law section 5-903, for example, makes an automatic renewal clause in a contract for service, maintenance or repair unenforceable against the customer unless the provider gave written notice of the clause, served personally or by certified mail, 15 to 30 days before the customer’s own notice deadline.1212 Source: New York State Senate, “General Obligations Law § 5-903”, accessed Oct 2026. Does not apply where the renewal period is one month or less. Not legal advice. Whether it applies to a given SaaS contract is a question for counsel; plan around the date instead.

Price uplifts and list-price resets

HubSpot’s terms allow fees to rise at renewal up to the then-current list price, with at least 30 days’ notice, and let the customer terminate at the end of the term if it does not accept the increase.11 Combine that with list price increases such as Salesforce’s 2025 change and an unchanged stack costs more each year.6

Mid-term downgrade bans and true-ups

Seats are usually easy to add and hard to remove. HubSpot’s terms state that customers cannot downgrade during the current term; a downgrade happens at renewal via a new order form.11 A true-up is the opposite motion: a periodic reconciliation where you pay for usage or seats above the contracted amount, sometimes back-dated. Check whether your contract has true-up dates, how overages are priced, and whether added seats co-terminate with the main contract.

Bundles and AI credits

A newer trap is bundled AI pricing. A Gartner analyst told The Register in January 2026 that if Salesforce’s capped AI agreements convert to defined-quantity contracts at renewal, buyers need limits on price increases, and noted that vendors can change credit consumption rates during the term.1313 Source: The Register, “Gartner questions whether Salesforce AI buffet will stay all-you-can-eat forever”, accessed Oct 2026. Quotes Gartner director analyst Hannah Decker; Salesforce disputed Gartner’s view. If a tool sells AI credits, record the credit rate and whether the contract fixes it.

6. Security and offboarding risks

Every tool is also an access path to company data. Cutting the bill but leaving accounts and tokens alive keeps the risk.

Hands holding a payment card over a laptop keyboard
Fig. 3 Tools bought on a company card often bypass single sign-on and outlive the person who bought them.

Shadow IT

Shadow IT is software used without IT’s knowledge or approval. The expense data from chapter 2 is where you find it. For each tool, ask what data it holds and who can still reach it.

Orphaned accounts

An orphaned account belongs to someone who has left or changed roles; they pile up in tools outside SSO. NIST’s security control catalog (SP 800-53, control AC-2(3)) tells organizations to disable accounts within a defined period when they have expired, are no longer associated with a user, violate policy, or have been inactive for a defined period.1414 Source: CSF Tools, “AC-2(3): Disable Accounts” (NIST SP 800-53 Rev. 5), accessed Oct 2026. The time periods are left for each organization to define. Pick a period and enforce it.

OAuth grants

OAuth grants deserve their own pass because they survive password resets and often survive the employee. In August 2025, Google’s Threat Intelligence Group reported that an actor it tracks as UNC6395 used compromised OAuth tokens tied to the Salesloft Drift integration to export large volumes of data from Salesforce customer instances between August 8 and at least August 18, 2025.1515 Source: Google Cloud Blog (Google Threat Intelligence Group), “Widespread Data Theft Targets Salesforce Instances via Salesloft Drift”, accessed Oct 2026. Published August 26, 2025, with later updates. Google stated it was not a vulnerability in the core Salesforce platform. Its recommendations included revoking and rotating tokens for affected integrations and restricting connected-app scopes, avoiding overly broad access.

The offboarding checklist per cut tool

  1. Export any data you must keep, and confirm the vendor’s deletion terms.
  2. Revoke OAuth grants and API keys in your IdP and in the tools it connected to. In Entra ID, note that revoking a permission does not stop users re-consenting unless you change consent settings.9
  3. Remove the app from SSO and disable local accounts.
  4. Remove saved payment methods and cancel cards issued for the tool.
  5. Record the cancellation confirmation and the date service ends.

7. Keep, consolidate or cut, and negotiating the renewal

With inventory, usage and contract data in one table, score each tool so the decision holds up when a team pushes back.

A scoring table

Score each tool from 1 (poor) to 3 (strong) on five criteria. The weights below are our suggestion; adjust them, but write them down before scoring.

CriterionWeight123
Utilization against your threshold30%Under 50% of seats active50 to 80% activeOver 80% active
Business criticality25%Nice to haveUsed in a core processRevenue or compliance stops without it
Overlap20%Duplicates another tool fullyPartial overlapUnique capability
Cost trend and terms15%Uplift above inflation, no capModerate upliftPrice capped or falling
Security posture10%No SSO, broad OAuth scopes, unknown dataPartial controlsSSO, scoped access, reviewed vendor

Rough decision rules. Weighted score of 2.4 or more: keep and right-size seats. 1.7 to 2.4: consolidate into an overlapping tool or renegotiate. Below 1.7: cut at the next notice window. Overrides apply: a low-scoring tool required by a customer contract stays until that contract changes.

Negotiation levers at renewal

Leverage depends on time. Start 90 to 120 days before the notice deadline.

  • Usage data. Bring your utilization number. The vendor will have its own.
  • Seat reduction. Right-size to active users plus a small buffer.
  • Price caps. Ask for a written cap on renewal increases for the next term.13
  • Term length. Multi-year terms can buy a lower rate, but they also lock seat counts. Trade term only for a cap and the right to reduce seats at anniversaries.
  • Notice period and auto-renewal. Ask to shorten the notice period or replace auto-renewal with an explicit renewal order.
  • Co-termination. Align add-on contracts to one renewal date so you negotiate once.
  • A credible alternative. If chapter 4 found an overlapping tool, a real migration plan is your strongest lever.

8. Running the audit: tools, a 90-day plan and a quarterly rhythm

Do you need a SaaS management platform?

For a small stack, a spreadsheet, IdP exports and a calendar work. Once card spend sprawls across teams, a platform starts to save time on discovery and renewal tracking. The market splits into four overlapping kinds of tool.

Hands cutting a sheet of paper with scissors
Fig. 4 Cutting a tool is a renewal decision: plan it before the notice date, not after.
16 Source: Zylo, “Pricing”, accessed Oct 2026. 17 Source: Torii, “Pricing”, accessed Oct 2026. No list prices shown when we checked. 18 Source: Cledara, “Pricing”, accessed Oct 2026. Prices in GBP; the page states yearly billing saves 16%. 19 Source: Vertice, “Pricing”, accessed Oct 2026. The guarantee claim is the company’s own. 20 Source: Spendflo, “Pricing”, accessed Oct 2026. Spendflo is positioned as an intake-to-pay procurement platform.
CategoryWhat it doesExamplesPricing as published (October 2026)
SaaS management platforms (SMP)Discovery from finance, SSO and browser data; license usage; renewal alertsZylo, ToriiZylo: three tiers (Core, Premium, Enterprise), quote only.16 Torii: pricing page routes to demo requests for its SMP, identity governance and AI management products.17
Spend management with SaaS focusVirtual cards per app, renewal alerts, add-on usage insightsCledaraBasic free if 10 apps are paid via its cards in month one, otherwise £100 per month; add-on modules £150 per month each; higher plans quote only (list prices).18
Procurement and negotiationIntake, approvals, contract storage, price benchmarks, negotiation supportVertice (which acquired Vendr in 2026), SpendfloVertice: no published prices; the company says savings are contractually guaranteed.19 Spendflo: platform fee plus a per-request charge, quote only.20
Identity provider and admin consolesSSO, last login, OAuth grant reviewOkta, Microsoft Entra ID, Google WorkspaceUsually already paid for; check which reports your edition includes

Vertice announced its acquisition of Vendr in June 2026, so expect the two products to converge.2121 Source: Goodwin, “Goodwin Advises Vendr in Acquisition by Vertice”, accessed Oct 2026.

A 30-60-90 day audit plan

Days 1 to 30: inventory.

  • Export 12 to 18 months of AP, card and expense data. Normalize vendor names.
  • Export IdP app lists, last logins and OAuth grants.
  • Build the one-row-per-product table. Assign a business owner to every row, even if the owner is “finance by default”.
  • Fill renewal dates and notice periods for the top 20 tools by spend. Read the order forms, not the website terms.

Days 31 to 60: measure and decide.

  • Agree usage definitions per category with each owner.
  • Pull utilization for seat-priced tools and actual-versus-forecast for usage-priced tools.
  • Run the overlap checklist by category.
  • Score every tool and publish draft decisions to owners with a short review window.

Days 61 to 90: act.

  • Send non-renewal notices for cut tools where deadlines fall in the next six months. Use the method the contract specifies.
  • Right-size seats for kept tools at their next renewal; open negotiations on the top five by spend.
  • Run the offboarding checklist from chapter 6 for every tool cut or consolidated.
  • Put every notice deadline in a shared calendar with a 120-day and 60-day reminder.

Running it quarterly

After the first full pass, a quarterly review takes a few hours.

  1. Pull new vendors from card and expense data since last quarter.
  2. Pull new OAuth grants and new SSO apps.
  3. Review every renewal with a notice deadline in the next two quarters.
  4. Re-check utilization on the ten most expensive seat-priced tools.
  5. Disable accounts for leavers that offboarding missed.

Add a light approval step for new purchases: a named owner, a category check against the inventory, and a security check for anything touching customer data.

Mistakes we see

  • Starting with the cutting. Teams defend tools harder when the first message is a cut list. Start with the inventory and the definitions.
  • Tracking renewal dates instead of notice dates. The renewal date is when you pay. The notice date is when you could have stopped paying.
  • Cancelling without offboarding. Integrations and tokens remain after the invoice stops.
  • Counting savings that never land. A cut tool replaced by an expensed one is not a saving. Re-check card data after each cut.
  • Auditing once. Without the quarterly step, the stack regrows within a year.

For where AI tools fit once you decide which ones to keep, see the complete guide to AI agents in enterprise operations. Overlapping automation tools are a common finding; the complete guide to workflow automation tools compares the main options and how each bills.

9. The verdict

A SaaS audit is a finance exercise, a security exercise and a negotiation, run on one table. Build the inventory from money and identity data together, measure usage before talking to anyone, and work to notice dates. Platforms help at scale; they do not replace an owner per tool.

Frequently asked questions

How often should we audit our SaaS stack?

Run one full audit, then a quarterly review of new vendors, OAuth grants, notice deadlines and utilization of the costliest tools. A yearly full re-audit is enough if the quarterly reviews happen.

Who should own the SaaS audit?

One named person in finance, RevOps or IT with authority to send non-renewal notices, plus a business owner per tool who defends its use.

What utilization rate counts as good?

There is no standard. Zylo reports an average of 54% across its customers and says its best performers reach at least 90%.3 Set your own threshold per category, and treat occasional-use tools differently from daily tools.

Can we cancel a SaaS contract in the middle of the term?

Usually not without a termination right in the contract. Many vendor terms allow adding seats mid-term but restrict reductions until renewal, as HubSpot’s terms do.11 Read your order form and, for material contracts, ask counsel.

Do we need a SaaS management platform?

Not to start. IdP exports, finance data and a spreadsheet handle a first audit at most smaller companies. Platforms earn their cost when discovery and renewal tracking outgrow one person.

What about free tools with no invoice?

Include them. A free tool connected to company email or files through OAuth can still hold customer data. Find them in your OAuth grant lists and decide whether to approve, restrict or block them.8

Sources and notes

  1. Source: Zylo, “2026 SaaS Management Index”, accessed Oct 2026. Vendor research based on Zylo’s own customer data (40M+ licenses). ↩ ↩2

  2. Source: Okta, “Businesses at Work 2025: 10 years of data show how critical security has become”, accessed Oct 2026. Counts apps connected through the Okta Integration Network, so it understates total app use. ↩

  3. Source: Zylo, “How Much Is Wasted on SaaS Spend?”, accessed Oct 2026. Figures attributed to Zylo’s 2026 SaaS Management Index; methodology not described on the page. ↩ ↩2 ↩3 ↩4

  4. Source: Zylo, “Zylo’s 2026 SaaS Management Index Finds AI-Native App Adoption Is Surging”, accessed Oct 2026. Press release dated January 29, 2026. ↩

  5. Source: CFO Dive, “Escalating SaaS prices outpace CPI inflation”, accessed Oct 2026. Reports Vertice’s 2023 SaaS Inflation Index; we did not find a newer edition. ↩

  6. Source: Salesforce, “Updated Product Packaging and Pricing Offer New AI Capabilities”, accessed Oct 2026. Published June 17, 2025; covers Sales Cloud, Service Cloud, Field Service and select Industries Clouds. ↩ ↩2

  7. Source: USU, “Insights from the 2026 Gartner Magic Quadrant for SaaS Management Platforms”, accessed Oct 2026. Gartner prediction as quoted by USU, itself an SMP vendor. ↩

  8. Source: Google Workspace Admin Help, “Control which apps access Google Workspace data”, accessed Oct 2026. ↩ ↩2

  9. Source: Microsoft Learn, “Review permissions granted to enterprise applications”, accessed Oct 2026. ↩ ↩2

  10. Source: Help Net Security, “SaaS applications investment growing despite underutilization of app licenses by employees”, accessed Oct 2026. Reports Productiv’s 2021 vendor research; older data, used here for the occasional-use point only. ↩

  11. Source: HubSpot, “Customer Terms of Service”, accessed Oct 2026. Sections 2.5 (Downgrades), 3.1 and 3.2 (fees, overages, renewal adjustments) and 4.1 to 4.2 (renewal). One vendor’s terms, shown as an example of common clauses. ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  12. Source: New York State Senate, “General Obligations Law § 5-903”, accessed Oct 2026. Does not apply where the renewal period is one month or less. Not legal advice. ↩

  13. Source: The Register, “Gartner questions whether Salesforce AI buffet will stay all-you-can-eat forever”, accessed Oct 2026. Quotes Gartner director analyst Hannah Decker; Salesforce disputed Gartner’s view. ↩ ↩2

  14. Source: CSF Tools, “AC-2(3): Disable Accounts” (NIST SP 800-53 Rev. 5), accessed Oct 2026. The time periods are left for each organization to define. ↩

  15. Source: Google Cloud Blog (Google Threat Intelligence Group), “Widespread Data Theft Targets Salesforce Instances via Salesloft Drift”, accessed Oct 2026. Published August 26, 2025, with later updates. ↩ ↩2

  16. Source: Zylo, “Pricing”, accessed Oct 2026. ↩

  17. Source: Torii, “Pricing”, accessed Oct 2026. No list prices shown when we checked. ↩

  18. Source: Cledara, “Pricing”, accessed Oct 2026. Prices in GBP; the page states yearly billing saves 16%. ↩

  19. Source: Vertice, “Pricing”, accessed Oct 2026. The guarantee claim is the company’s own. ↩

  20. Source: Spendflo, “Pricing”, accessed Oct 2026. Spendflo is positioned as an intake-to-pay procurement platform. ↩

  21. Source: Goodwin, “Goodwin Advises Vendr in Acquisition by Vertice”, accessed Oct 2026. ↩