This report inventories every third-party account connected to your site — who has access, at what permission level, whether it’s a shared password or genuinely delegated access — since these accumulate over time across a business’s history, and knowing exactly who can get into what is a basic, often-overlooked security and operational question.
SaaS account audit & access inventory report
Every connected third-party account inventoried — shared passwords flagged against real delegated access.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- A list of the third-party services you’re aware of using, as a starting reference
- Access sufficient to review current connections and permissions where feasible
- Your preferred report format, if you have one
This or something else?
| You want a full inventory of connected third-party accounts and who has access to each | This fix covers it |
| You already know a specific account needs its access reviewed or revoked | A more direct, targeted task, worth describing specifically rather than a full audit |
| You want your site’s own user accounts audited, not third-party SaaS accounts | Dormant admin account audit & removal, in the Security Hardening & Audit category, the equivalent for your own WordPress users |
| You want a technical vulnerability scan, not an access inventory | Vulnerability scan & patch report, a different, security-focused report |
What we do
- Identify every third-party service your site is connected to or integrated with
- Determine who currently has access to each, and at what permission level
- Flag any account still using shared account passwords rather than genuinely delegated, role-based access
- Flag any access that appears outdated or belonging to someone no longer involved
- Compile findings into a clear, organised report
- Recommend which accounts would benefit from moving to delegated access instead of shared credentials
What is included
- A complete inventory of connected third-party accounts and access levels
- Flags for shared-password access versus genuinely delegated access
- Flags for outdated or no-longer-relevant access
- A written report with recommendations
Not included
- Actually revoking or changing access — a separate, quick follow-up once you’ve reviewed the findings
- Migrating shared-password access to delegated access for every flagged account — a separate, related fix if you want that done
- Auditing your own site’s WordPress user accounts, a separate, related report
- Ongoing monitoring of access as a standing service
Questions about this fix
Why does it matter if access is shared-password versus delegated?
Delegated, role-based access can be revoked individually and precisely when someone leaves or a relationship ends, while a shared password often means changing it disrupts everyone using it, or worse, nobody changes it at all when they should — this report specifically flags where that risk exists.
How would I even know every service my site is connected to?
That's a big part of the value here — connections accumulate over a site's history, often set up by different people or agencies at different times, and a systematic review usually turns up more than most site owners expect.
Will you fix the access issues this report finds?
Not automatically as part of the report — we identify what's actually there so you can prioritise, with follow-up fixes (revoking access, migrating to delegated permissions) quoted separately based on findings.
Should this be repeated periodically, or is a single pass generally enough?
Access and connections keep accumulating as your team and vendor relationships change, so treating this as a periodic check-in rather than a one-time exercise is the more realistic way to keep the inventory actually accurate.
What if I find an account I don't even recognize?
We'd flag that specifically as worth investigating directly, since an unrecognized connection is exactly the kind of finding this report is designed to surface before it becomes a genuine problem.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.