Audit vendors actually being used

The short answer

Astra audits vendor usage by joining three data sets: every invoice paid in the last 90 days (Brex + QuickBooks), every login event in your identity provider (Okta or Google Workspace), and every API call or deploy event tied to that vendor's keys (Datadog, GitHub Actions, Vercel). For each vendor she scores active/inactive based on logged usage, names the actual humans using it, and surfaces the gap between paid seats and active seats. Bonus pass: vendors with no SSO, no API trace, and no human owner — usually the first kill list. Output is a Lark table sorted by waste size, with each row showing paid cost, active users, last-real-use timestamp, and a one-line recommendation. You learn which $2k/mo tool has 3 logins this quarter and which $89/mo tool is load-bearing for 40 people.

How Astra actually does it

1. 1

   Pull invoice + cost truth

   90 days of Brex + QuickBooks vendor charges, normalize to monthly, group by category.

   BrexQuickBooks
2. 2

   Pull usage truth from identity

   Okta or Google Workspace SSO event logs — last login per user per app, active-seat count.

   OktaGoogle Workspace
3. 3

   Pull machine-usage truth

   API call counts (Datadog), deploy events (GitHub Actions, Vercel), webhook activity for tools without SSO.

   DatadogGitHubVercel
4. 4

   Score active vs zombie

   Vendor is Active if ≥1 login OR ≥1 API call in last 30 days. Otherwise Zombie. Edge case: "infrastructure" tools (Cloudflare, AWS) auto-mark Active.

   Notion
5. 5

   Lark table + owner pings

   Sorted-by-waste table to Lark. For tools with no SSO and unknown owner, ping #ops in Slack: "Whose tool is X?"

   LarkSlack

What it looks like in chat