VendorStacks
← All posts
Engineering7 min read

Tech Stack Detection API: How VendorStacks Finds Vendors from Public Evidence

A technical deep-dive into how tech stack detection works, what evidence sources are reliable, and how to use the VendorStacks API to extract vendor intelligence deterministically.

Stax
VendorStacks research desk

How Tech Stack Detection Actually Works

Most tech stack detection tools scrape job postings, parse JavaScript tags, or rely on self-reported data. VendorStacks takes a different approach: deterministic extraction from public web presence with quoted source evidence for every vendor detected.

This matters because when you're building sales tools, data enrichment pipelines, or competitive intelligence systems, you need to know why the API returned a particular vendor—not just trust a black-box score.

This post explains how tech stack detection works under the hood, what evidence is reliable, and how to use the VendorStacks API to build vendor intelligence into your applications.

What Evidence Sources Are Reliable?

Not all vendor signals are created equal. Here's what VendorStacks looks for:

1. Privacy Policy and Legal Pages

The most reliable signal. When a company lists a vendor in their privacy policy or data processing agreement, it's a legal disclosure—not marketing copy. These pages typically include:

  • Subprocessor lists ("We use Stripe for payments, AWS for hosting")
  • Cookie disclosures ("Google Analytics tracking")
  • Third-party service providers
  • Data transfer mechanisms

Every vendor in the vendor_stack response includes an *_evidence field with the exact quoted text and source URL where it was found.

2. Integration Documentation

Public API docs, webhook endpoints, and integration guides often reference the vendors a company connects to. For example:

  • "Send events to Segment"
  • "Configure your Salesforce connection"
  • "Snowflake warehouse credentials"

These are strong signals because they describe how the company uses the vendor, not just that they use it.

3. About/Careers Pages

Less reliable than legal disclosures, but still useful. Companies sometimes list their stack on:

  • "Our Tech Stack" pages
  • Engineering blog posts
  • Job descriptions ("Experience with our tools: PostgreSQL, AWS, Datadog")

VendorStacks weights these lower than privacy policy mentions because they can be outdated or aspirational.

4. What We Don't Use

To be clear about limitations:

  • No JavaScript tag parsing: We don't analyze <script> tags or network requests. This means client-side-only tools (like some analytics pixels) may not appear.
  • No inferred relationships: If a company doesn't publicly mention a vendor, we don't guess based on "similar companies" or industry patterns.
  • No private data: We only use publicly accessible web pages. No login-required content, no payment flows, no internal tools.

If the API returns "found": false, it means we didn't locate public evidence—not that the company uses zero vendors.

Using the Tech Stack Detection API

The core endpoint is GET /v1/check?url={domain}. If the domain is already indexed (you can check with GET /v1/company/{domain}), results return in under 1 second. If not indexed, the API triggers a live scan that takes 15-90 seconds.

Basic Lookup

curl -X GET "https://api.vendorstacks.com/v1/check?url=stripe.com" \
  -H "Authorization: Bearer vr_live_YOUR_KEY_HERE"

Response structure:

{
  "domain": "stripe.com",
  "vendor_stack": {
    "cloud_infra": [
      {
        "vendor": "AWS",
        "evidence": "We use Amazon Web Services to host our infrastructure.",
        "source_url": "https://stripe.com/privacy",
        "confidence": "high"
      },
      {
        "vendor": "Google Cloud",
        "evidence": "Google Cloud Platform for data processing.",
        "source_url": "https://stripe.com/privacy",
        "confidence": "high"
      }
    ],
    "observability": [
      {
        "vendor": "Datadog",
        "evidence": "Datadog for monitoring and logging.",
        "source_url": "https://stripe.com/privacy",
        "confidence": "medium"
      }
    ]
  },
  "subprocessor_urls": [
    "https://stripe.com/privacy",
    "https://stripe.com/privacy/subprocessors"
  ],
  "scanned_at": "2025-01-15T10:23:45Z",
  "credits_used": 1,
  "credit_balance": 1099,
  "found": true
}

Understanding Categories

Vendors are grouped into 24 categories:

  • cloud_infra: AWS (269 companies in our index), Google Cloud (124), Azure (94)
  • analytics_data: Google Analytics (338 companies), Segment, Amplitude
  • payments: Stripe (166 companies), PayPal, Adyen
  • ai_ml: OpenAI (104 companies), Anthropic, Replicate
  • crm_sales: Salesforce (107 companies), HubSpot (118)
  • database_infra: Snowflake (118 companies), PostgreSQL, MongoDB
  • observability: Datadog, New Relic, Sentry
  • security_fraud: Cloudflare, Auth0, Plaid
  • sms_messaging: Twilio (83 companies), MessageBird
  • integration_etl: Fivetran, Airbyte, dbt

The full category list is returned in every response under vendor_stack keys.

Checking If a Domain Is Already Indexed

To avoid triggering unnecessary scans:

curl -X GET "https://api.vendorstacks.com/v1/company/stripe.com" \
  -H "Authorization: Bearer vr_live_YOUR_KEY_HERE"

This endpoint never scans. If the domain exists, you get the cached result. If not, you get {"found": false} and can decide whether to call /v1/check to trigger a live scan.

Building a Vendor Intelligence Pipeline

Here's a common pattern: enriching a CRM with tech stack data.

Step 1: Bulk Lookup with Caching

import requests
import time

API_KEY = "vr_live_YOUR_KEY_HERE"
BASE_URL = "https://api.vendorstacks.com/v1"

def get_vendor_stack(domain):
    # Check if indexed first
    resp = requests.get(
        f"{BASE_URL}/company/{domain}",
        headers={"Authorization": f"Bearer {API_KEY}"}
    )
    
    if resp.json().get("found"):
        return resp.json()
    
    # Not indexed, trigger scan
    resp = requests.get(
        f"{BASE_URL}/check",
        params={"url": domain},
        headers={"Authorization": f"Bearer {API_KEY}"}
    )
    
    return resp.json()

domains = ["stripe.com", "plaid.com", "segment.com"]

for domain in domains:
    data = get_vendor_stack(domain)
    if data.get("found"):
        print(f"{domain} uses {len(data['vendor_stack'])} vendor categories")
        print(f"Credits used: {data['credits_used']}, balance: {data['credit_balance']}")
    else:
        print(f"{domain}: no public evidence found (0 credits used)")
    time.sleep(1)

Step 2: Extract Specific Vendors

def uses_vendor(vendor_stack, vendor_name):
    """Check if a specific vendor appears in any category."""
    for category, vendors in vendor_stack.items():
        for v in vendors:
            if v["vendor"].lower() == vendor_name.lower():
                return {
                    "found": True,
                    "category": category,
                    "evidence": v["evidence"],
                    "source": v["source_url"]
                }
    return {"found": False}

data = get_vendor_stack("openai.com")
stripe_check = uses_vendor(data["vendor_stack"], "Stripe")

if stripe_check["found"]:
    print(f"OpenAI uses Stripe for {stripe_check['category']}")
    print(f"Evidence: {stripe_check['evidence']}")

Step 3: Reverse Lookup for Prospecting

Find all companies using a specific vendor:

curl -X GET "https://api.vendorstacks.com/v1/prospect?vendor=Snowflake&page=1" \
  -H "Authorization: Bearer vr_live_YOUR_KEY_HERE"

Response:

{
  "vendor": "Snowflake",
  "companies": [
    {
      "domain": "company1.com",
      "evidence": "We use Snowflake for data warehousing.",
      "source_url": "https://company1.com/privacy",
      "category": "database_infra"
    },
    {
      "domain": "company2.com",
      "evidence": "Snowflake processes customer analytics.",
      "source_url": "https://company2.com/privacy",
      "category": "database_infra"
    }
  ],
  "page": 1,
  "results_per_page": 10,
  "credits_used": 2,
  "credit_balance": 1097
}

Pricing note: Reverse lookup costs 1 credit per result returned. An empty result set costs 0 credits.

From our index of 1,000 companies across 317 distinct vendors, the most common stacks include:

  • Google Analytics: 338 companies
  • AWS: 269 companies
  • Stripe: 166 companies
  • Meta: 140 companies
  • Google Cloud: 124 companies
  • Snowflake: 118 companies
  • HubSpot: 118 companies
  • Salesforce: 107 companies
  • OpenAI: 104 companies
  • Slack: 102 companies

Pricing and Credits

VendorStacks charges per successful result:

  • 1 credit per lookup: /v1/check?url=domain costs 1 credit if vendors are found, 0 if not.
  • 1 credit per reverse lookup result: /v1/prospect?vendor=X costs 1 credit for each company returned (max 10 per page).
  • 0 credits for failures: No public evidence, failed scans, and empty reverse lookups are free.

Credit packs:

  • $10 for 1,100 credits (~$0.009 per lookup)
  • $50 for 6,000 credits (~$0.008 per lookup)
  • $250 for 35,000 credits (~$0.007 per lookup)

Get started with 25 free credits:

curl -X POST "https://api.vendorstacks.com/v1/keys" \
  -H "Content-Type: application/json" \
  -d '{"email": "your@email.com"}'

You'll receive a vr_live_ key instantly.

When Tech Stack Detection Fails

Some domains will return "found": false:

  1. No public privacy policy: Stealth startups, landing pages, or non-commercial sites.
  2. Generic legal copy: Boilerplate privacy policies that don't list specific vendors.
  3. Client-side only tools: Analytics tags that aren't mentioned in legal docs.
  4. Recently changed stack: Our index updates continuously, but there's a lag between vendor adoption and public disclosure.

In these cases, the API returns:

{
  "domain": "example.com",
  "vendor_stack": {},
  "scanned_at": "2025-01-15T10:30:00Z",
  "credits_used": 0,
  "credit_balance": 1100,
  "found": false
}

You're not charged for these lookups.

Practical Use Cases

Sales Intelligence

Identify prospects using complementary or competing vendors. If you sell a Snowflake alternative, query /v1/prospect?vendor=Snowflake to get a list of 118 companies with evidence URLs you can reference in outreach.

Competitive Analysis

Track which vendors your competitors rely on. Monitor changes over time by scheduling periodic scans.

Market Research

Understand category adoption. From the current index: 338 companies use Google Analytics, 166 use Stripe, 118 use Snowflake. These aren't market-wide stats—just our indexed sample—but they show relative adoption.

Data Enrichment

Add tech stack fields to your CRM or data warehouse. Many companies store "industry" and "employee count" but not "uses Stripe" or "uses AWS."

Checking Your Balance

curl -X GET "https://api.vendorstacks.com/v1/balance" \
  -H "Authorization: Bearer vr_live_YOUR_KEY_HERE"

Returns:

{
  "credit_balance": 1097,
  "plan": "pay_as_you_go"
}

Every API response also includes credit_balance and credits_used for that request.

Building Reliable Vendor Intelligence

The key difference with VendorStacks is verifiability. Every vendor returned includes:

  • Exact quoted evidence text
  • Source URL where it was found
  • Confidence level (high/medium/low)
  • Category classification

This means you can:

  • Show prospects exactly where you found their stack info
  • Filter by confidence level for high-precision use cases
  • Audit results to understand why a vendor was detected

No black-box scores. No inferred relationships. Just deterministic extraction from public web pages with source attribution.

Start building at api.vendorstacks.com with 25 free credits.

About the author

Stax is the pangolin who fronts the VendorStacks research desk — a fitting mascot for a company that reads layered stacks for a living. Posts under this byline are written by the VendorStacks team.

VendorStacks is the subprocessor disclosure data API — structured vendor stacks with quoted evidence, 25 free credits to start.

Get an API key