Software License Register for Small Teams

Every small team pays for software nobody can fully explain. The card statement says $4,800 a month across tools half the team has never opened, a departed designer still owns the design team's account, and the security questionnaire asks for “all vendors that touch customer data” — a question the register answers in twenty minutes and everyone else answers in three weeks of guessing. A software license register is not procurement theater. It is one sheet with one row per product that turns renewal surprises into decisions, seat waste into refunds, and “what data does this thing hold?” into a lookup instead of an archaeology dig. The build takes one afternoon. Keeping it alive takes thirty minutes a quarter.

The build (one afternoon, from statements — not memory)

1. Pull the ground truth first. Memory is the enemy; statements are the truth. Three sources, in order: the company card and bank statements for the last 90 days (every recurring charge is a row), the SSO admin console's per-app last login export (this is your seat-usage data, free), and expense reimbursements (the personal-card tools are where the shadow lives). Do not start from “what do we use?” — that list is always 60% of the real one and always wrong about cost. This is the same first move as the shadow-it audit; the difference is that the audit hunts unknown apps and the register houses known ones.
2. One row per product, eleven columns. Product name · what it's for (one sentence, plain words) · owner (a person's name, never “marketing”) · admin account and where its credentials live (vault name, not the password) · paid seats vs active logins (last 30 days, from the SSO export) · cost and billing cadence · renewal date and auto-renew yes/no · data classification (customer data / PII / internal / nothing) · criticality (what stops working tomorrow if it dies) · offboarding path (who to email, what to export) · last-reviewed date. Eleven sounds heavy; it is one row of typing per product, and six of the columns are one word each.
3. Classify every row: keep, shrink, kill, watch. Keep — actively used, seats roughly match logins. Shrink — used, but paying for seats nobody logs into (the SSO export makes this undeniable). Kill — nobody logged in for 60+ days; cancel before the next renewal date, export what matters, and run the vendor data-deletion checklist if it held customer data. Watch — used by exactly one person, which means its real owner is one resignation letter away from being nobody.
4. Every renewal date into the calendar with a 30-day decision gate. Auto-renew is a decision, not a default: 30 days before each renewal someone consciously chooses renew, renegotiate, or kill. The vendor renewal calendar is where these dates live; the register is where they come from. If a renewal has ever surprised you, you had the date in a statement and not on a calendar — that is the whole failure mode.
5. Wire the register into offboarding, today. The admin and seats columns are exactly what the employee offboarding checklist walks: for each row, who transfers, what to export, which card to swap. Then fix the backlog the week you find it — every app where a departed employee is still the owner gets moved this week, not “when we get to it,” because the next departure is when you'll need the current one's access log.
6. Keep it alive with two rules. New purchase = new row the same week (the expense policy says reimbursements require a register row — two minutes of typing, and it kills the “how is this load-bearing?” mystery of 2027 before it starts). Quarterly = a 30-minute pass: reconcile statements against rows, refresh seat counts, update last-reviewed dates. A register without a review date is a snapshot of one afternoon, not an asset.

Five traps

• The register born perfect and never touched again. The spreadsheet someone polished for a week, then abandoned. The tell is a missing last-reviewed column — if nothing records freshness, staleness is invisible and trust dies quietly. The quarterly 30-minute pass is the heartbeat; put it in the same calendar slot as the renewal calendar review and they keep each other honest.
• The seat zoo. Paying for 40 seats, 22 people logging in. The gap between paid seats and active logins is the single fastest money line in the register, and the SSO console gives you the number for free. Check it before every renewal, not after; shrinking seats at renewal is the one conversation vendors expect and rarely fight.
• The mystery admin. The person who set it up left; the account runs on their personal email; you cannot change the card, the custom domain, or export the data. This is how a $29/month tool becomes an outage. Admin-ownership transfer is a mandatory step of offboarding, not a favor you do the team — and if the account predates the register, the fix is a credential handover, in the vault, this week.
• Tracking cost but not data. A register that knows what everything costs but not what everything holds misses the reason most of this matters. “List all systems that touch customer data” is on every security questionnaire, every customer's vendor review, every insurance renewal — and the register's data-classification column is that list, kept current for free. The security audit preparation starts from it, not from a three-week scramble.
• Buying outside the register. Someone expenses a $29/month tool, no row gets written, and eight months later three workflows depend on it. The rule is not “no tools” — it is “no unregistered tools.” The row takes two minutes; the alternative is discovering the dependency during the tool's owner's two-week notice, which is exactly when you cannot fix it.

Worked example

A ten-person marketing agency, software bought organically for six years. The old way: the bookkeeper's line said “software subscriptions $4,830/month” and nobody could itemize it; a security questionnaire asked for all vendors touching client data and the answer took three weeks of asking around; a senior designer left and her personal-email Canva team took the weekly client flyer production down for two days before anyone found the recovery path. Cost: weeks of scattered archaeology and one very awkward client call.

The rerun: one afternoon building the register from card statements and the SSO console's last-login export. Sixty-three products on the sheet. Classification: 41 keep, 14 shrink (31 dead seats across nine tools — $610/month back at the next renewals), 8 kill ($385/month, cancelled before renewal, data exported per checklist), and the Canva team moved to a company-owned account with two admins. Renewal dates went on the calendar with 30-day gates; the next security questionnaire was answered from the data-classification column in twenty minutes. Total recurring saving: just under $1,000/month — found inside a line item nobody could explain.

Metrics (for the register itself)

• % of monthly software spend with a named owner and a renewal date on the calendar. Under 100% means surprise renewals are still in your future.
• Seat utilization: active logins ÷ paid seats, per product. Sustained 70% is money waiting at the next renewal conversation.
• Offboarding orphans: apps where a departed employee is still admin or owner. Target zero; every finding above zero is a hole in the offboarding checklist, and the fix goes there, not just into the register.
• Median days since last-reviewed across rows. Under ~100 days means the register is alive; over a quarter means it is a museum.

From the HIVE80lab kit

• The First 30 Minutes — free incident quick-start checklist
• Ops Starter Kit — incident response for small teams — $14
• Ops Starter Kit Vol. 2 — advanced incident response & communications — $27
• Ops Mega Bundle — all 5 kits in one download — $49

Related: the vendor renewal calendar is where the register's renewal dates go to get decisions instead of surprises; the shadow-it audit is how unregistered apps get found and becomes new register rows; the employee offboarding checklist is where admin transfers and seat reclaims actually execute; and the asset inventory covers the hardware side of the same discipline — one sheet, one row per thing, an owner on every line.