Vendor and SaaS Inventory: A One-Page List That Works

Published October 23, 2026 · Last reviewed October 23, 2026

Why a list beats a policy

You cannot assess a risk you do not know you have. Most small businesses use more online services than anyone remembers: a payroll platform, an accounting package, a shared-file tool, an e-signature service, a marketing platform, a time-tracking app that one department adopted on a free trial. Each holds some of your data, and each has its own sign-in. When one is breached, or simply disappears, the first question is “which of ours was it?”. A one-page list answers it in a minute.

The columns

• Vendor and service, with the plan or contract end date.
• Data held: customer records, staff records, financial data, health data, nothing sensitive.
• Administrator: the named person who can add and remove users, and a second person who can recover the account.
• Sign-in method: single sign-on through your main identity system, or its own username and password, and whether multi-factor authentication is on.
• Moves money: yes if it can pay, invoice, change bank details or payroll.
• Outage tolerance: how many hours or days you can run without it.
• Exit path: how you export your data and how long that takes.
• Vendor contact: the security or support address and the notification clause, if any.

Finding the services nobody listed

Action

List the applications already connected to your identity system. In Microsoft 365 open Microsoft Entra admin center › Enterprise applications; in Google Workspace open Admin console › Security › Access and data control › API controls and review third-party app access.

Why it helps

Staff often sign in to new tools with their work account, so the identity system holds a record of services you did not buy centrally.

Verification

Every application in the console either appears on your page or has been removed or disabled, with a note of who decided.

Fallback if delayed

If the console view is unavailable to you, ask the provider for an export and compare it with your page.

Action

Read the last six months of card and bank statements for recurring software charges, and ask each department head for the tools their team uses.

Why it helps

Tools bought outside the identity system leave a trail only in payments.

Verification

Every recurring charge is matched to a row, or cancelled.

Fallback if delayed

If statements are not available quickly, start with the three biggest charges and add the rest over the next month.

Action

Sort the rows with three questions: does it hold sensitive data, can it move money, and would an outage stop you trading? Mark any row with two yes answers as a priority supplier and read its security page and notification terms first.

Why it helps

You have limited time. This sort finds the few suppliers whose failure would hurt most.

Verification

The priority rows each carry a named administrator, a second recovery contact and an exit note.

Fallback if delayed

If you only have an hour, complete the priority rows and leave the rest for later.

Action

Test the exit path for one priority supplier by exporting a sample of your data and opening it.

Why it helps

An export you have never tried may be incomplete, and you will want it on the worst day.

Verification

The exported file opens, contains what you expected and is stored somewhere the supplier cannot reach.

Fallback if delayed

If the supplier offers no export, record that as a risk and ask the supplier what it provides on request.

Profile B/C delta: Profile B uses the Admin console paths shown above. In a hybrid directory, also list on-premises applications that sign in through the directory, because they are suppliers too.

How it works

The page works because it is short enough to be kept up to date. Review it every quarter, and update it whenever someone starts using a new service or a contract renews. A good rule is that nobody signs up for a business tool with company data until the administrator has added it to the list.

When a supplier announces a breach, the list tells you in a minute what that supplier holds, who administers it and whether you can still reach the data. Your obligations after a supplier breach can still be yours: privacy law in several places makes the organisation that collected the data responsible, even when a supplier lost it. The Office of the Privacy Commissioner of Canada explains breach duties for Canadian organisations, and your state attorney general’s site covers US rules. Ask counsel what applies to you.

Worked example

A hypothetical 25-person design studio lists eleven services and expected eight. The enterprise-applications view in its identity system shows three more: a screen-recording tool a designer connected last year, a survey tool and a file-transfer service. The screen-recording tool has access to the shared drive. The studio removes it, keeps the other two with a named owner, and records the file-transfer service as holding client artwork.

When the sort is applied, the accounting package scores yes on sensitive data and money movement, so it becomes the first priority supplier. The administrator discovers the only recovery contact is an employee who left. The studio fixes that in ten minutes. Service names and counts here are invented for illustration.