The fastest money in a small firm’s software budget is the same job billed twice. Every stack past a few years old has some of it. Tools get bought one problem at a time, each one reasonable on the day, and the bill is the only place they ever meet. Here’s how to find the overlap, tell a real duplicate from a false one, and cancel with everything still in your hands.
- Build the list from the bank statement, and go thirteen months back so the annual renewals show up.
- Overlap comes in four shapes. One is two products doing the same job. The other three are quieter, and they’re usually larger.
- The duplicate is the one nothing else depends on. That’s a different question from which one costs more, and it’s the only one worth answering.
- Export before you cancel. Every vendor puts a clock on your data once you leave. The clocks run from 30 days to a year.
- Canceling and stopping the renewal are two different actions at two different prices. On an annual term, stopping the renewal is usually the one you want.
Start with the statement, not your memory
Almost every firm starts this without a list, and that’s the normal place to start. The firm that thinks it has one has the list of things somebody remembered, which runs about two thirds of the real one.
Six places hold the rest.
The card and bank statements, thirteen months back. This is the ground truth. Everything else is a cross-check. Go thirteen months rather than three, because an annual renewal appears once a year, and the one you’re looking for renewed in March. Pull it into a spreadsheet and sort by merchant name rather than by date. A year of monthly charges collapses into one line each.
The accounting system’s vendor list. Same data, already categorized. It catches the things paid by ACH or check that the card statement misses.
Expense reimbursements. Every firm has at least one subscription on somebody’s personal card. It goes in monthly as an expense, so it reads as an expense to everyone who sees it. These survive an audit of the company card entirely intact.
The app store receipts. Anything bought inside a phone renews through Apple or Google. The charge lands in a receipt email rather than on the firm’s card.
The connected apps in your admin console. Both platforms keep a record of the third-party products that have been granted access to your data. Google’s admin help puts one of the categories plainly. “Accessed apps are third-party apps used by users that have accessed Google data” (app access control, checked September 7, 2026). This list finds the free tier products. They cost nothing, and they’re the reason the list matters. A free tool holding client information is still a vendor.
Your own mailbox. Search for “receipt”, “renewal” and “your subscription” over two years. Every product on earth emails you when it charges you. That makes your inbox an index of your own spending, built while you were doing something else.
Against each line, record five things and no more.
- What it costs.
- When it renews.
- Whether the term is monthly or annual.
- Who in the firm owns it.
- Which job it covers.
That last field is the whole exercise, and the nine jobs a small firm has to cover is the list to sort against. Sorted by product, overlap hides. Sorted by job, it shows.
If your firm handles clients’ financial information, this inventory is also a legal duty. 16 CFR 314.4(c)(2) of the FTC Safeguards Rule requires you to “identify and manage the data, personnel, devices, systems, and facilities that enable you to achieve business purposes in accordance with their relative importance to business objectives and your risk strategy.” That’s the same spreadsheet with a different purpose written at the top of it. Whether the Rule reaches your firm at all is settled in the stack overview. This section assumes it does.
Four ways a stack pays twice
Sort the list by job and the duplicates surface in four distinct shapes. Firms look for the first one. Most of the money is in the other three.
Two products covering one job. The obvious case, and the rarest. It usually arrives with a person. Somebody joined, brought the tool they were used to, and carried on using it. Two client records, two places to store files, two ways to run a meeting. The tell is simple. Ask where something lives and different people give you different answers.
A job your platform tier already includes. Larger and quieter. It’s the reason to re-read your own plan’s feature list every year, rather than only on the day you bought it. A tool bought in 2023 filled a real gap. The platform closed that gap later, on Microsoft’s schedule or Google’s, and nobody sends a notice when that happens, so the subscription renews straight through it. The stack overview works through what a business tier typically already covers, with signing as the worked example. The habit worth taking from it is the annual re-read.
Seats for people who left. The biggest number on most firms’ lists. It looks like a normal charge, which is how it stays hidden. Somebody leaves. Their mailbox gets handled, because the mailbox is the visible part, and the eleven other products they had a seat on go on billing. Some vendors are good about this. Slack’s Fair Billing Policy states that “on paid plans, you’re billed for all the members of your workspace that are actively using Slack” (Slack Fair Billing Policy, checked September 7, 2026). Deactivating a member produces credits “for the unused portion of the billing period” the next day. Most vendors bill the seat until you take it away.
The same shape applies to the platform, where the money is largest and the decision runs past money. What a departing person’s mailbox costs, and what happens to it if you stop paying, is worked through in where email fits in the stack.
A tier bought for a limit you stopped hitting. The upgrade bought one thing: the integration, the seat count, the storage or the reporting. One of those reasons has since gone away. Check this one when a line looks too big for what the firm does with it. It’s also the safest category to act on, because moving down a tier is reversible in a way that canceling isn’t.
A fifth thing turns up in the same exercise, and it’s a different problem from overlap. The product nobody opens. One copy of the job, one subscription, and a plan that never happened. It gets cut by a different test, and that test is what to keep.
Telling a real duplicate from a false one
Two products in one category is where firms stop looking and start canceling. That’s the expensive move. Four questions decide which of the pair is the duplicate, and they want answering before anything gets canceled. The duplicate isn’t the more expensive one. It’s the one nothing else depends on.
Which one holds the record? If a client asked what was agreed in March, which product would you open? That one stays. It stays even if it costs more, and even if it’s the one people complain about. The other one holds a copy, and a copy is what you can afford to lose.
Which one is wired into other things? Count the connections in both directions. A product that receives your invoices and pushes them to the books is load-bearing, whatever its subscription price says. A product that stands alone is a leaf, and leaves are cheap to remove.
Which one has clients pointed at it? A booking page, a payment link, a portal login, a signing request still waiting in somebody’s inbox. Anything with a URL you handed to somebody outside the firm has a tail on it. That tail runs for months after you stop paying.
Which one would you rebuild from? If both disappeared tonight, which one would you buy again first? That’s usually the answer, and it arrives faster than a feature comparison does.
Then check the arithmetic on switching. Moving the record out of the product you’re cutting, and into the one you’re keeping, is real work at somebody’s real hourly rate. That cost lands once, and the saving recurs. A $30 a month duplicate that takes fourteen hours to consolidate pays that back in about two years. So put it on your own schedule rather than this month, and keep it on the list.
Sometimes both stay, and that’s a real answer. A signing product with identity verification your platform’s built-in signing can’t do is a different job wearing a similar name. A shared address that three people watch is one purchase. A support desk with queues, assignment and response time reporting is another, and a firm whose inbound genuinely behaves like a queue should keep the thing built for that. The test is whether you can name what the second one does that the first can’t, in your own words rather than the vendor’s. If you can, it stays.
What breaks when a subscription stops
Firms skip this audit for a reason, and it’s a good one. The last time somebody canceled something, invoices stopped going out for a week. Four checks prevent that. Together they take about half an hour per product.
What sends mail as you. Invoicing software, a scheduling page, a newsletter tool and a signing product all send messages wearing your domain’s name. Each one is an authentication record somebody added to DNS. The record outlives the subscription, and what’s left behind is a loose end pointed at your domain. The DNS side of this is set out in where email fits in the stack. For the audit, check whether this product sends mail as you before you cut it.
What signs in through it. If a product is acting as the login for something else, canceling it takes the other thing with it. This is rare below ten people and catastrophic when it happens.
What runs on a schedule. The reminder that goes out three days before a deadline. The monthly report somebody in the firm relies on. The sync that moves a paid invoice into the books. Automations get built once and then run quietly, which is exactly what makes them the thing that breaks.
Who else is using it. Your outside bookkeeper, your accountant, a contractor, a client with a portal login. The person who set the product up is often a different person from the one who depends on it.
Here’s the quickest version of all four. Search your own mailbox for the vendor’s domain over the last ninety days and read what comes back. The notifications tell you what the product is doing for the firm today, which is a different list from what it was bought to do.
For firms the Safeguards Rule covers, there’s a second reason to do this pass, and it’s the more durable one. 16 CFR 314.4(c)(1) requires “implementing and periodically reviewing access controls” that “limit authorized users’ access only to customer information that they need to perform their duties and functions.” A subscription audit and an access review are the same walk through the same list. Doing them together is the difference between an afternoon and two afternoons. Departed staff with live seats show up in both.
Every product has a clock on your data
Cancellation starts a timer, and the vendor sets it. Every vendor sets it differently. Export first, then cancel, in that order, every time.
Microsoft. A Microsoft 365 for business subscription moves through “Active > Expired > Disabled > Deleted.” For all subscription terms, the Expired status lasts 30 days and Disabled lasts 90 (what happens when a subscription ends, checked September 7, 2026). Through the Disabled period “data is accessible to admins only.” Users are already locked out by then, and an administrator can still get things out. Two details matter more than the numbers. The first is the outside limit, and Microsoft states that “any customer data that you leave behind might be deleted after 30 days, and is deleted no later than 180 days after cancellation.” The second is the one that catches people. Microsoft writes that “if you explicitly delete a subscription, it skips the Expired and Disabled states and the SharePoint Online data and content, including OneDrive content, is deleted immediately” (cancel your subscription, checked September 7, 2026). One button ends the grace period. It sits next to the one that starts it.
Google. Google puts the instruction ahead of the mechanism. Its help page leads with the action, and the action is “before you cancel your Google Workspace subscription, download any user data you want to save.” The reason is that “after you cancel your Google Workspace subscription, your users’ Google Workspace data will be deleted and can’t be restored” (cancel Google Workspace, checked September 7, 2026).
Your books. More generous, and worth knowing, because it takes away a reason to keep paying. Intuit states that “when you cancel your QuickBooks Online subscription you have read-only access to your QuickBooks Online data for one year.” You can also export to Excel or to a desktop version for up to a year after canceling. A trial runs on a different clock. The same page gives it 90 days to export rather than a year (what happens to QuickBooks Online data after cancellation, checked September 7, 2026).
For everything smaller, assume thirty days and check the page before you act. Thirty days is the common floor, and the reminder is yours to set. Take the export in a format you can open on your own machine: CSV, PDF, a folder of files. An export you can only read by resubscribing leaves you where you started.
The vendor’s copy of your clients’ information outlives the cancellation. Ending the contract ends your access. Their retention runs on a separate clause. Ask what their post-termination deletion period is and keep the answer with the rest of your vendor file, alongside the questions worth putting to any vendor holding client data. The disposal duty that runs the other way, over the records you keep, is worked through in where email fits in the stack.
Cancel in the order that keeps what you paid for
Canceling is one action. Stopping the renewal is another. On an annual term they cost very different amounts, and most people reach for the expensive one first.
Microsoft’s policy is precise about the window. For a Microsoft Customer Agreement billing account, “you can only cancel and receive a prorated credit or refund if you cancel within seven days after the start or renewal of your subscription.” After that, the documentation points to the alternative. Turning off recurring billing “prevents your subscription from renewing at the end of its term. You keep access to your products and services for the remainder of your subscription” (cancel your subscription, checked September 7, 2026). So in month four of a twelve month term, letting it lapse gets you everything canceling would, and canceling costs you eight months of a service you already paid for.
Google’s version of the same rule lives in the plan you chose rather than on the cancellation page. On the Flexible Plan, “you pay only for the accounts that you have during a month,” so removing a seat stops the charge. On the Annual/Fixed-Term Plan you commit to a minimum number of licenses for the length of the contract. Google states that “if you cancel your subscription before the renewal date, you’re charged for the remaining balance of your contract and no refunds are issued” (compare Flexible and Annual/Fixed-Term plans, checked September 7, 2026). So knowing which plan you’re on belongs before the audit rather than during it. On an annual plan, the seat reduction has a date attached to it, and that date is the renewal.
So the order that keeps what you paid for:
- Export. Do this first, while access is normal.
- Downgrade rather than cancel where it’s offered. A cheaper tier keeps the data reachable, and it’s the better first move on anything you might reverse. It’s also how you buy a month to find out what breaks.
- Remove the seats you can remove now. On month to month and per active user plans, this saves money immediately and it’s fully reversible.
- Turn off the renewal on everything annual. Set the effective date to the end of the term and put that date in the calendar.
- Untangle the dependencies while the term is still running. The DNS records, the automations, the links clients hold.
- Then cancel.
Two small traps sit inside that. If you added your own domain to a Microsoft 365 subscription, “you must remove the domain before you cancel your subscription.” That’s an order of operations rather than an option. And a subscription with more than 25 licenses has to have its count reduced to “25 or fewer” before the admin center will cancel it at all.
The news made this sound easier than it is, so here’s where the law actually stands. The FTC’s amended Negative Option Rule, the click-to-cancel rule, isn’t in force. The Eighth Circuit vacated it on July 8, 2025, holding the rulemaking procedurally insufficient and concluding, “accordingly, we grant the petitions for review and vacate the Rule” (Custom Communications, Inc. v. FTC, No. 24-3137). What survives is aimed elsewhere. The Restore Online Shoppers’ Confidence Act at 15 U.S.C. 8403 requires a seller to provide “simple mechanisms for a consumer to stop recurring charges,” and it’s written around charging “any consumer” in a transaction on the Internet. Your firm’s subscriptions are business purchases, governed by the vendor’s own terms. Read the renewal clause, note the notice period, and put both in the calendar. That’s the mechanism you have.
Keeping it from growing back
An audit run once is a saving. Run once every three years, it’s a habit of overspending with an occasional correction.
Three things hold the line, and all three are habits.
One person owns the list. The list, rather than the buying. Somebody who can answer what the firm pays for, and who notices the charge that turns up in February for a thing nobody mentioned.
Renewal dates live in the shared calendar. Each annual renewal gets an entry thirty days before the date, naming the product, the price and the notice period. That’s the difference between deciding and discovering. Discovering costs a full term, every time.
Seats get reconciled when somebody leaves, from the list. Offboarding is a document with the vendor names on it, produced from the inventory you just built. It’s the difference between removing one mailbox and removing eleven seats.
Then a rule for new purchases, which is what actually stops the growth. Before anything is bought, name which of the nine jobs it covers, name what it replaces, and check your own platform tier for the feature first. If it replaces nothing, it’s a new job and the bill goes up, which is fine as long as it was a decision. A stack gets expensive through four reasonable yeses over three years. Each one was correct on the day, and each has gone unrevisited since. The shape of that bill, and why per-seat lines are the ones that compound, is in the stack overview.
One last piece of arithmetic sits outside the invoice. Owning a product costs administration whether or not anyone uses it, and that overhead attaches to the product rather than to the seat count, which is why the stack overview counts vendors as well as dollars. On a small duplicate, the attention you get back is usually worth more than the money.
Where Point sits in this, and what it replaces
Point is an AI email client. In an article about cutting, the honest thing is to say what it adds to the bill and what it takes off.
What it adds is a per-seat line. Pricing is private beta and charged by the seat, so it sits in the column that multiplies when you hire rather than the one that holds steady. Point runs on top of the platform you already license. You connect the mailbox the firm already pays for, whichever of the two you’re on, and everything underneath stays put: same domain, same seats, same tier, same retention rules, same archive. So the platform bill stays where it is, and where email fits in the stack explains why retention and holds are bought at that layer rather than this one.
What it takes off is worth pricing honestly rather than assuming. Scheduling is the real overlap. Point runs the back-and-forth itself, finds a time several people can make, and lets clients book against availability reconciled with the calendar you actually keep. If you’re paying per seat for a booking product, hold that line up against this one, and what a booking link should do is where a link is still the better instrument. The second overlap is smaller and usually free. Whatever personal task app people keep for things that arrived by email tends to empty out on its own. A commitment made inside a paragraph gets pulled out as a task, with a date on it and the thread still hanging off it.
There’s a third effect, and it shows up in your morning rather than on the invoice. Every product you own is also a subscription to its notifications, which is its own subject. Those messages still arrive. Point changes where they land. By the time you open the list, the weighing has already happened, so the client still waiting on an answer sits above the renewal reminder, and each conversation carries a summary short enough to read in place of the thread. How that ranking works is set out separately. The bill stays the same. What the bill costs you in mornings goes down.
The controls belong in the same column as your vendor questions. Autonomy is set separately for each kind of action, and it has three positions: suggest-only, review and fully handled. Every action type starts on review out of the box. At the top of the dial Point acts without asking, so the dial is worth reading before you move any of them. Anything Point handled is written to a timestamped log, and most entries can be undone from there. One exception holds for every vendor in this category. A message already sitting on the recipient’s server is past recall. Work mail and personal mail run in lanes of their own. A second business you run stays walled off from the first. A seat can be added or taken back as people join and leave.
Where it stops. A firm whose inbound behaves like a support desk, with queues, assignment and first response time reporting, should buy that instead of this. Compliance is a separate purchase. And Point isn’t one of the nine jobs. Everything Point does is the full list to check against your own week, and the version written for your trade starts closer to it.
Common questions
How do I find every SaaS subscription my company is paying for?
Six sources, and the order matters. Start with thirteen months of card and bank statements. Then the vendor list in your accounting system, expense reimbursements on personal cards, app store receipts, the connected apps list in your admin console, and a search of your own mailbox for “receipt” and “renewal.” The statement is ground truth, and the rest catch what it misses. Go thirteen months rather than three, so the annual renewals appear.
Should I cancel the subscription or just downgrade it?
Downgrade first, almost always. A lower tier keeps the data reachable and the decision reversible. That matters, because what you find out in week two is usually that one person was using it for something nobody mentioned. Cancel once the downgrade has survived a month. A product with no data worth keeping and no connections into anything else can go straight away.
What happens to my data when I cancel a subscription?
It gets a deadline, and the deadlines vary more than people expect. Microsoft holds a canceled business subscription in a Disabled state where only admins can reach the data. It deletes what’s left no later than 180 days after cancellation. Deleting the subscription outright skips that grace period and removes SharePoint and OneDrive content immediately. Google says to download what you want first, because the data is deleted after cancellation and can’t be restored. Intuit gives you read-only access to QuickBooks Online data for a year. Export before you cancel and the range stops mattering.
Can I get a refund if I cancel in the middle of an annual term?
Usually not, and there’s a better move available. Microsoft gives a prorated credit or refund only within seven days of the start or renewal of a subscription on a Microsoft Customer Agreement. After that, turn off recurring billing and keep the service to the end of the term you paid for. Google’s Annual/Fixed-Term Plan charges the remaining balance of the contract with no refund if you cancel before the renewal date. In both cases the money is already spent. The action worth taking is stopping the next term.
Does the FTC click-to-cancel rule make this easier?
No. The Eighth Circuit vacated the FTC’s amended Negative Option Rule on July 8, 2025, days before it was to take effect, so it never came into force. What remains, including the Restore Online Shoppers’ Confidence Act, is written around charging a consumer rather than a business. Your firm’s subscriptions run on the vendor’s contract. The renewal clause and its notice period are the terms that actually govern you. Read them once and calendar the dates.
We are paying for two tools that do the same thing. How do I choose?
Ask four questions, and leave price out of them. Which one holds the record you’d open if a client asked what was agreed. Which one other products are wired into. Which one clients have a link to. And which one you’d buy again first if both vanished tonight. Those four usually agree. Then weigh the hours to move the record against the monthly saving, because that cost lands once and the saving recurs.
What about the free tools nobody is paying for?
They cost nothing, and they belong on the list anyway. A free product holding client information is a vendor with access to client information. For a firm covered by the FTC Safeguards Rule, that’s a service provider somebody was supposed to select, contract with and reassess. The connected apps record in your admin console is where these turn up, because a statement never shows them.
How often should we do this?
Once a year, timed to land thirty days before your largest annual renewal, so the biggest decision is live while you’re already looking. Everything else is maintenance: renewal dates in the shared calendar, seats reconciled from the list whenever somebody leaves, and a named person who notices a new charge.
The short version
- The list comes from the bank and goes back thirteen months, so the annual renewals show up. Cross-check it against the vendor list in your books, expense claims, app store receipts, the connected apps in your admin console, and your own mailbox.
- Sort by job rather than by product. Overlap hides one way and shows the other.
- Four shapes. Two products on one job. A job your platform tier already covers. Seats for people who left. A tier bought for a limit you stopped hitting. The last three are where the money is.
- Pick the survivor by which one holds the record, which one other tools depend on, which one clients have a link to, and which one you’d rebuild from. Price decides last.
- Export before you cancel. Microsoft deletes leftover data no later than 180 days after cancellation, and immediately if you delete the subscription outright. Google deletes it with no restore. Intuit gives you a year of read-only access to QuickBooks Online.
- Stopping the renewal usually beats canceling. Microsoft refunds only within seven days of a start or renewal on an MCA account, and Google’s Annual/Fixed-Term Plan bills the remaining balance with no refund.
- Nothing in current federal law makes this a single click for a business. The FTC’s click-to-cancel rule was vacated on July 8, 2025, and what remains is written for consumers.
- Keep it from growing back with three things: one owner of the list, renewal dates in the shared calendar with a thirty day warning, and seats reconciled from the list on somebody’s last day.
For the categories this all sorts into, start with the nine jobs a small firm has to cover. For the largest line on the list, where email fits in the stack. For the tools that survive the cut, what to keep.