We found a subscription nobody owned. Then we found three more.

We found a subscription nobody owned. Then we found three more.

Every small team has a tool graveyard. Ours got audited the day the finance card's statement landed in a shared inbox with a line nobody could explain: a survey tool, $49 a month, billing since March. Nobody had logged in since May. The person who set it up had left in June. The 4,000 customer emails inside it were still there — and still being held on someone else's servers under someone else's password policy.

That single line item turned into a one-hour audit that found three more zombies, one duplicate pair, and about $180/month of spend attached to logins nobody owned. Here's the exact process, because it's now a quarterly ritual for us.

The one-hour audit

1. Pull the card statement for the last 90 days. Export the CSV and mark every line that isn't payroll, rent, or a supplier. Recurring software hides in descriptions like "SQ *SOMEAPP". Google anything unfamiliar before you assume it's known — that's half the exercise.

2. Ask the team for their logins, not their opinions. One shared doc: tool name, what it's for, who uses it, last used. If you run a password manager with shared collections, that's your ground truth. A tool that isn't in the vault can't be revoked by anyone — which makes it both a spend and a security finding.

3. Name exactly one owner per tool. "Marketing" is not an owner. A tool with no name next to it goes in the kill pile by default. This is the audit's sharpest rule and the one that hurts.

4. Check usage against cost. Zero logins in 60 days plus a nonzero invoice is your first win. Expect at least one.

5. Check the seat count. Ex-staff still holding seats, contractors who finished months ago, the generic "sales@" login billed as a human. Seat cleanup is often 10–20% of the bill — and it's the same cleanup as removing departed people's access, so do them together.

Kill, keep, consolidate

• Kill: zero logins in 60 days, or the owner left and nobody picked it up. Cancel the same week. "We'll look at it next quarter" is how sprawl survives audits. Export the data first, note where it went.
• Keep: daily use, clear owner, invoice going to a person. Don't over-prune — the tool that saves two hours a week is worth $30 a month.
• Consolidate: two tools doing the same job. The decision rule that worked for us: the one with the documented process wins. The other is tribal knowledge wearing a subscription.
• The uncomfortable pile: tools you keep because leaving means migration work. Price it honestly — usually a day, not a month. Paying $200/month to avoid one day of work breaks even fast.

Stopping the creep from coming back

The audit is worthless if the graveyard refills by December. Three rules closed the loop for us:

1. One card for software, period. A dedicated virtual card for every subscription. Next audit, the statement is the inventory — and cancelling the card kills orphaned trials automatically.
2. A renewal calendar with names on it. Every annual renewal gets an entry 30 days out: "renew Y — owner Z — used weekly? yes/no." The renewal prompt is the only moment cost and value are both visible.
3. New-tool rule: owner named before signup. If nobody will put their name next to a trial, the trial doesn't start.

The security angle is the part most teams miss. Every tool that survives the audit owes you the same question you'd ask any vendor: what data does it hold, who can access it, and what happens if it gets breached? Sprawl you decided to keep is a portfolio. Sprawl you forgot is an exposure.

---

The full write-up with the decision matrix and the renewal-calendar template is here: SaaS Sprawl Audit for Small Teams — part of a free library of ops checklists for teams with no ops department.

If you're doing this cleanup anyway, the next step is automating the handoffs between the tools that survived. We put the pick-first sequence into the Automation Starter Pack ($19 — which is less than one zombie subscription), and incident response lives in the Ops Starter Kit. The First 30 Minutes checklist is free. Launch month: 30% off any paid kit with code HIVE-LAUNCH30.