How many cloud services do you pay for? An inventory that pays

Cloud services have one property that software on a disc never had: everyone buys them, not just IT. Sales takes a quoting tool, marketing takes something for graphics, finance takes something for scanning invoices. Payment goes on a card, the invoice lands in accounting among others, and renewal happens by itself.

After three years nobody has the full list. Not out of negligence — there was simply never a moment when anybody made one.

Why do this

Three reasons, in order of how measurable they are:

Money. Every such inventory turns up something the company pays for and nobody has used for months. Most often: a tool bought for one project, licences belonging to people who left, and two services doing the same thing because two departments bought separately.

Access. Accounts in services bought outside IT are the most common gap when somebody leaves — nobody knows about them, so nobody closes them.

Data. It is worth knowing where company and customer data ends up. That question usually arrives at the worst moment: during an audit, when a customer asks about sub-processors, or after an incident at a provider.

How to gather the list

There is no tool for this. There are five sources which together give a close to complete picture.

1. The company card statement and payment history

The most effective source, and usually enough on its own. Go through twelve months — annual subscriptions show up only once.

2. Invoices in accounting

Search descriptions for keywords: subscription, licence, plan. This catches what went by transfer rather than by card.

3. The mailbox

Search company mail for phrases like “subscription confirmed”, “your invoice”, “renewal”. This catches services paid for on personal cards and expensed later — which happens more often than companies assume.

4. Asking the departments directly

A short question: which online tools do you use for work. Without judgement and without implying anything is wrong — otherwise the answers will be incomplete. You want a list, not an audit.

5. Sign-ins through the company account

If the company uses Microsoft 365 or Google Workspace, the admin panel shows applications to which users granted access to their company account. That also reveals free services which leave no trace in the statement — and which have access to data.

What to record for each entry

A table with six columns is enough and fits in a spreadsheet:

column	what for
service name	self-evident
who ordered it	so you know whom to ask
who administers it	the most important column, see below
cost and cycle	for the decision to switch off
what data goes there	for compliance questions
whether sign-in has MFA	for setting priorities

The “who administers it” column matters most, because it is most often empty or holds the name of somebody who has left. A service with no administrator is a service that can neither be changed nor closed — and recovering access means contacting the provider and can take weeks.

What usually comes out of it

The same thing every time:

• several entries to switch off immediately — unused or duplicated,
• licences assigned to people who no longer work there,
• at least one service registered to an employee’s personal address,
• several accounts without MFA, including some with access to customer data,
• one service the management did not know existed at all.

The saving can be noticeable, but it is not the main gain. The main gain is that after this work you can answer “where is our data” with something other than a guess.

How not to end up back where you started

An inventory done once goes stale within six months. Two things stop that:

One place where a new service is registered. It does not have to be a system — a spreadsheet will do. What has to exist is the rule that a new subscription goes in there before the first payment rather than a year later.

An annual review tied to something that happens anyway — closing the financial year, for instance. A deadline tied to nothing does not get kept.