SaaS Seat & License Reconciler

The SaaS Seat & License Reconciler is a small tool with one job. It compares what each of your applications bills you for against who is actually using those applications, and it tells you where the money is going to waste. Most small teams pay for software per seat, and over time the seat count drifts away from the headcount. People leave, projects end, someone gets added twice, and the invoice keeps climbing while nobody goes back to check. The reconciler is the thing that finally goes back and checks.

The way it works is deliberately plain. For each app, you export two files. The first is the billing record, the list of seats the vendor is charging you for. The second is the active-user record, the export of who has actually signed in and used the app. You import both CSVs into the SaaS Seat & License Reconciler, one pair per application. CSV here means the comma-separated file that almost every SaaS admin console can produce with a single download. You do not need an API connection or an agent installed on anyone’s machine to get started.

Then you run the reconciler. It lines up billed seats against active users for each app, matches them where it can, and marks the rows that do not match. When it finishes, you get a waste and savings report. That report shows the seats you are paying for that nobody is using, the seats that appear twice, and the seats still tied to people who have left. At the bottom it totals the reclaimable spend, the real dollars you could stop paying this month if you cancelled the dead seats.

This matters because you cannot fix what you have never listed. The first job in any sensible security or spending program is simply knowing what you own. The NIST Cybersecurity Framework puts an entire function, Identify, ahead of everything else, on the reasoning that an organization has to understand its apps and accounts before it can govern or protect them. A billed-versus-active seat comparison is a small, concrete piece of that Identify work. You end up with a plain inventory of every account you are funding and whether a real person sits behind it.

The buyer this is built for is the owner who is also the IT department. In a lot of small companies the person paying the SaaS bills is the founder, the office manager, or an operations lead who never asked to run software procurement. They do not have a full-time admin combing through seat counts every month. The SaaS Seat & License Reconciler gives that person a repeatable way to run the check in an afternoon, without hiring anyone or signing up for a platform that costs more than the waste it finds.

There is nothing clever hidden in the process. You import the billing and active-user CSVs, you run the tool, and you read the report. You can see the full workflow on the product page, or how it fits a broader operations practice on the IT, ops and compliance page. The tool does the boring matching so the human can make the cancel-or-keep call with real numbers in front of them, which is the part no spreadsheet ever quite got around to doing.

Most people think of an unused SaaS seat as a billing problem. A seat still tied to someone who left the company is also a security problem, and often a worse one. That person still has a working login to an app that holds your data. If their credentials were used again elsewhere and later leaked, or if they simply keep signing in to an account they were never cut off from, you have an open door that no firewall will catch. The SaaS Seat & License Reconciler surfaces exactly these accounts, which is why the report it produces is as much a security artifact as a spending one.

Access control is a named requirement in real security frameworks, not a nice-to-have. NIST SP 800-171, in its requirements for protecting sensitive information in nonfederal systems, treats access control as a core family, and a central idea there is that access should be limited to authorized users and revoked when it is no longer warranted. A former employee is by definition no longer an authorized user. A seat that keeps their login alive is an access-control gap, and it will sit there quietly until someone compares the billed accounts to the people who should still have them.

That comparison is precisely what the reconciler does. When you import an app’s billing export and its active-user export and run the tool, the ex-employee seats show up as their own flagged category, separate from seats that are merely empty or duplicated. You are not just told you are wasting money on the account. You are told an account exists that maps to a person who should have been removed. That turns a quiet line on an invoice into a specific action, which is to revoke the access and close the door before anyone walks through it.

The same finding helps you meet a written obligation. The FTC Safeguards Rule asks covered businesses to build and keep an information security program with administrative and technical safeguards, and controlling who can reach customer data is squarely part of that program. Being able to run the SaaS Seat & License Reconciler and produce a dated list of accounts you found and shut off is evidence that you are actually managing access, not just intending to.

There is a practical reason small teams miss these accounts. Offboarding a person usually means disabling their email and their main login, and the ten other apps they were quietly given access to get forgotten. Nobody keeps a master list. The SaaS Seat & License Reconciler rebuilds that list from the billing and active-user exports you already have, so the forgotten accounts become visible without anyone having remembered them in advance. The tool does the remembering that a busy small team cannot.

The point worth sitting with is that the cost win and the security win are the same finding. Every ex-employee seat you cancel to save money is also an access path you close. You do not have to choose between saving spend and tightening access, because the seat reconciler hands you both in one report. You can read how the security angle fits a wider practice on the IT, ops and compliance page, or the mechanics of the check on the product page. One list, two problems solved at once.

The billing and active-user exports you feed this tool are sensitive. They list who works at your company, which accounts they hold, and what you spend. That is exactly the kind of file you do not want sitting on a stranger’s server. The SaaS Seat & License Reconciler is local-first, which means the CSVs you import stay on the machine you run it on. There is no cloud copy created as part of the reconciliation, and no requirement to upload your seat data to a vendor before you can see the result.

This is a design decision, not a setting you have to remember to switch on. When you import an app’s billing and active-user CSVs, the files are read on your own computer, the matching runs there, and the waste and savings report is produced there. The data does not take a trip to someone else’s data center and back. For a small team without a security officer, that shrinks the whole question of data safety down to something you can actually reason about, because there is only one place the files live and it is a place you already control.

Keeping the data local also changes the shape of the worst case. The FTC’s Data Breach Response guide tells a business to move fast to secure its systems and close the vulnerability that let a breach happen, and every extra place your data is copied is another place that can be breached and another party you might have to notify. Because the SaaS Seat & License Reconciler does its work on files that never leave your machine, it does not add a new copy on a vendor’s server for an attacker to reach. The cheapest breach to survive is the one that has nowhere to happen.

That local posture also lines up with a written security program. The FTC Safeguards Rule expects a business to keep administrative and technical safeguards over the data it holds, and being able to say plainly where a sensitive file lives is one of the most direct technical answers you can give. You can point to the SaaS Seat & License Reconciler and state that the seat data stays on the office machine and that the tool adds no new path off it.

There is also a record of what the tool did. Each run leaves an audit record of the files it read and the seats it flagged, so if someone asks how you arrived at a cancellation, or wants to confirm a reconciliation was actually done, you can point to what happened rather than rebuild it from memory. For a compliance-minded owner, being able to show the work is the difference between claiming you reviewed your seats and proving it.

What the tool will not do is make claims it cannot back. It does not advertise antivirus blessings or signatures it does not hold. It keeps your billing and user exports where you put them, does the reconciliation there, and leaves a trail of what it touched. Local-first is not a marketing word here. It is the plain reason a sensitive file has one address instead of several. You can read how this fits a wider operations setup on the IT, ops and compliance page, or the specifics on the product page.

The honest answer is that Zluri, Torii, and Productiv are capable platforms built for a different kind of buyer. They are full SaaS-management systems, usually priced per user and aimed at companies large enough to have a dedicated IT or procurement team running them all year. The SaaS Seat & License Reconciler is the small-business version of one slice of what they do. It focuses on the single question those platforms answer expensively, which is where your seat spend is being wasted, and it answers that question at a price a small team can absorb.

Price and pricing model are the first real difference. The reconciler is 49 dollars per company each month, a flat rate that covers up to around fifty seats, billed as a plain subscription. It is not priced per user, so the cost does not climb every time you add a person. The larger platforms tend to charge per employee or per managed application, which is sensible at enterprise scale and painful for a ten-person shop. You are paying one flat number to find waste, not a growing bill to run a platform.

The second difference is scope, and it is a deliberate narrowing rather than a shortcoming. Zluri, Torii, and Productiv try to do many things, including workflow automation, renewal tracking, integrations with dozens of apps, and constant monitoring. The SaaS Seat & License Reconciler does one thing. It compares billed seats to active users, flags the dead and duplicate and ex-employee seats, and totals what you could reclaim. If you only need that answer, you should not have to buy and run an entire management suite to get it.

The third difference is how you get started. The big platforms usually want deep integrations, connecting into each app through an API and often taking weeks to onboard before they show a result. The reconciler asks for two CSV exports per app, the billing list and the active-user list, both of which you can download today. There is no integration project and no agent to deploy. You run it in an afternoon on the files you already have, and you see the waste on the first pass.

Even at this small scale, the work maps to a recognized discipline. The NIST Cybersecurity Framework puts Identify, knowing what apps and accounts you have, at the front of its model, and a billed-versus-active seat check is a concrete way to do that first step. You do not need an enterprise platform to start understanding your own SaaS footprint. A flat-priced tool that lists every account you fund covers the same ground for a much smaller buyer.

None of this means the larger platforms are bad software. It means they solve a bigger company’s problem at a bigger company’s price. A small team that only needs to find and cancel wasted seats is paying, in money and in setup time, for capacity it will never touch. The SaaS Seat & License Reconciler trims the offer to the one step that saves the money and prices it for the shop actually buying it. You can compare it against the wider category on the IT, ops and compliance page, or read the details on the product page.

The reclaimable-spend total is the number the whole tool is built to produce. As the SaaS Seat & License Reconciler works through each app, it prices out every seat you are paying for that no active user sits behind, and it adds those up into a single figure. That figure is the money you could stop spending this month if you cancelled the dead seats. It turns a vague sense that you are overpaying for software into a specific dollar amount you can take to whoever signs the checks.

Getting to that number honestly means the tool cannot treat every wasted seat the same way, because they are not the same. The reconciler sorts its findings into three separate kinds of seat. An empty seat is one you are billed for that has no active user behind it at all, a license bought and never assigned or long since abandoned. A duplicate seat is the same person holding two accounts on one app, often because they were added twice under slightly different names or emails. An ex-employee seat is one still tied to someone who has left the company.

Keeping those three apart matters because each one asks for a different response. An empty seat is a clean cancellation, money with no argument attached. A duplicate seat means merging or dropping one of the two accounts, which usually needs a quick human check first. An ex-employee seat is the one to treat as urgent, because it is not only waste. It is a live login belonging to someone who should have been removed. The SaaS Seat & License Reconciler flags it as its own category so it never hides inside a general pile of unused licenses.

That ex-employee category is where spending and security meet. A former worker with a working account is an access-control gap, and access control is a named requirement in NIST SP 800-171, whose rules for protecting sensitive information in nonfederal systems expect access to be limited to authorized users and pulled when it is no longer warranted. When the tool separates ex-employee seats from ordinary empty ones, it is handing you a list that closes access holes, not just a list that saves money.

The comparison behind all of this is simple to describe. For each app you import the billed-seat export and the active-user export, and the SaaS Seat & License Reconciler lines the two lists against each other. A seat billed with no matching active user is empty. Two active entries for one person is a duplicate. A billed seat matched to a name on your departed list is an ex-employee account. From that same matching it produces both the category flags and the reclaimable-spend total in one pass.

What you are left with is a report you can act on line by line. You see each flagged seat, you see which of the three kinds it is, and you see the total you stand to recover. Nothing is hidden behind a score you cannot check, because every flag traces back to a row in the two files you imported. You can read the full breakdown on the product page, or how it fits a broader operations and compliance practice on the IT, ops and compliance page.