The Apps Nobody Bought: Exposing and Tidying Shadow SaaS in a Small UK Office

There's a particular kind of email that turns up in small firms around renewal season: a card payment for a tool nobody remembers approving. It usually comes with a free trial that quietly converted, an annual plan that auto-renewed, and a login that belongs to someone who may or may not still work here.

That's shadow SaaS. Not a heist, not a hack — just people trying to get their job done without waiting for a ticket. In most small UK offices it's less dramatic than the phrase suggests, and far more common than anyone expects. The goal isn't a telling-off. It's a map.

Start with the trails you already have

You don't need a security platform to do this. Two or three screens will get you most of the way.

If you're on Microsoft 365, open the Entra admin centre and look at Enterprise applications. The list is usually longer than the licence count suggests, because anything a user has consented to — a PDF tool, a meeting recorder, a design app — shows up there. Check the sign-in logs for the last 30 days and sort by application. You'll see which ones are actually being used, and which are ghosts from a 2024 trial.

On Google Workspace it's under Security, then API controls, then app access control. That's where you'll find third-party apps with access to mail, calendar or Drive. It's worth a look on a Friday afternoon with a brew — it's rarely a long list, but it's often surprising.

And don't skip the boring ones: the shared password vault, the browser's saved logins, and whatever's pinned to the bookmarks bar on the office laptop everyone uses for printing.

Then follow the money

Sign-in logs tell you what's connected. The company card tells you what's being paid for, and the two lists rarely match perfectly.

Go through three months of statements and search for the usual suspects: recurring monthly amounts, anything described as a subscription, and names you don't recognise. Remember that the billing descriptor is often not the brand name — a tool might bill through a payments processor or under a holding company. If a line item is a mystery, ask the person whose card it is before you assume the worst.

And when you've got the list, do the thing that feels slightly awkward: ask the team. A short message along the lines of "what tools do you use that we haven't officially set up?" usually gets honest answers, because the honest answer is "this one, it saves me two hours a week". That's useful information, not a confession.

Not every discovery is a problem

Here's the reassuring bit. Most of what you'll find is doing real work. Someone found a scheduling tool that stops the back-and-forth. Someone else uses a form builder because the built-in one is clunky. Those are small wins, and the right response is usually to keep them, bring them into the fold, and make sure they're owned properly.

The ones that deserve attention are the ones touching customer data without anyone watching. A useful three-question test:

• What data does it hold? Names, addresses, enquiry details, payment information, health information — anything that would matter if it appeared somewhere it shouldn't.
• Who can get into it? One person's personal account, or a proper company account with more than one admin?
• What happens when that person leaves? If the answer is "we lose access", that's the real risk — not the app itself.

The GDPR bit, kept short

Under UK GDPR, if a tool is processing personal data on your behalf, you need a written agreement with the provider — normally their data processing agreement, which is usually a link in the sign-up flow that nobody clicks. You also want to know where the data sits and whether the provider uses sub-processors.

You don't need to write a policy for every app. You need to know which ones hold customer data, and be able to say what you did about it. If a tool is holding client records with no agreement, no admin control and a login tied to a leaver's personal email, that's your priority. Everything else can wait its turn.

Reclaiming the seats you're paying for

Once you've got the list, cross-check paid seats against active users in each tool's admin panel. In small firms, the gap is often two or three seats per app — a departed colleague, a duplicated account, a plan that was upgraded for one busy month and never downgraded.

Before you cancel anything, check the notice period. Annual plans often auto-renew with 30 days' notice, and there's nothing more irritating than paying for a year of something you stopped using in March. Put the renewal date in a shared calendar while you're thinking about it — future you will be grateful.

The leaver's leftovers

Offboarding usually covers the mailbox and the laptop. It rarely covers the app someone signed up for with their work email in 2024. When you find an account tied to a former employee, don't just delete it — check whether it owns anything first. Files, forms, shared boards and integrations often sit under whoever created them, and removing the account can take the data with it. Transfer ownership, then remove.

A one-page rule that actually sticks

You don't need a 12-step procurement process. You need something short enough that people read it. Something like:

1. Sign up with your company account, never a personal email.
2. Tell one named person — a register in a shared document is fine.
3. If it will hold customer information, check it has a data processing agreement before you put anything real in it.
4. Free trials go in the calendar with a reminder two days before they convert.
5. When someone leaves, their apps go on the offboarding checklist alongside the laptop.

Print it, pin it, and revisit it once a year. Shadow SaaS isn't a failure of discipline — it's what happens when people are busy and tools are free. The fix isn't a clampdown. It's a short list, a shared register, and the occasional cup of tea spent looking at what's actually running.