Most startups can't list the vendors their own website loads

The list your website already gave away

Ask a ten-person SaaS founder to list every third-party service running on their own marketing site, and most can't do it from memory. That's normally harmless curiosity. It stops being harmless the moment an enterprise buyer's security team sends over a vendor questionnaire and asks for exactly that list — every sub-processor, every service that touches customer data or even just a page load, disclosed and monitored.

Nobody built that list on purpose. It accumulated: an analytics tag added in month one, a live-chat widget bolted on before a launch, a tag manager quietly pulling in two more services nobody in the room signed off on. The list exists. It's just sitting in the browser's network tab instead of anywhere the company can hand over on request.

What we found scanning 705 companies

We ran a passive, public-data-only scan across a population of 705 US B2B SaaS companies — YC-backed, seed stage, 5–50 employees — aggregated on 2026-08-21. Nothing was logged into, probed, or accessed; every data point came from what an ordinary browser and DNS resolver can already see, and results were k-anonymised on the way into the aggregate, so no single company is identified anywhere in this dataset.

The average reachable site in that population loads 5.5 third-party services just to render its homepage — analytics, fonts, chat, ad pixels, CDNs, payment widgets. And 34.0% of the population — 240 of the 705 companies — load three or more of those services with none of them disclosed anywhere public. That 34% isn't a company running an unusually sloppy stack; it's the ordinary outcome of nobody owning the tag manager.

What that looks like in practice

Take a 20-person seed-stage SaaS company closing its first enterprise account. The security review lands with a standard clause: provide a list of all sub-processors and third parties with access to systems that process customer data. Marketing owns the website. Engineering owns the app. Nobody owns the union of the two — the tag manager marketing installed two years ago has since been used to add a chat widget, a heatmap tool, and an ad pixel, none of which went through review because none of them touched "the app." The founder now has three days to reconstruct a list an outside scanner could pull off a single page load in under a minute.

What to actually do about it

• Load your own homepage with browser dev tools open on the Network tab and write down every third-party domain it calls — that's your starting sub-processor list.
• Give one named person, not "marketing" as a department, ownership of what goes into the tag manager, and require a one-line entry to the list before anything new ships.
• Cut anything left over from an old campaign or a trial nobody remembers signing up for — every extra service is one more line a reviewer can ask about.
• Publish a short, plain-language trust or security page that names your actual sub-processors — it turns a scramble into a link you send in one email.
• Re-check the list quarterly. Tag managers change without a code deploy, so the list drifts even when the codebase doesn't.

If you want to know what your own site is already showing an outside reviewer — or an attacker — before you're handing over that list under deadline, our External Security Posture Assessment runs the same passive check we ran here, on your company, and hands you the specific list.