What Tech Stack Does a Company Use? A Developer's Guide to Programmatic Detection

The Problem: Tech Stack Detection at Scale

If you've ever needed to answer "what tech stack does a company use" for more than a handful of companies, you've hit the manual research wall. Checking job posts, scraping LinkedIn, reading blog posts, and inspecting page source works for 5 companies. It doesn't work for 500.

This guide shows how to detect company tech stacks programmatically using public evidence extraction. We'll cover the technical approach, API implementation, what you can and can't detect, and how to build this into your application.

How Tech Stack Detection Actually Works

There are three common approaches to detecting what technologies a company uses:

Client-side JavaScript detection identifies frontend libraries by checking for global objects (jQuery, React, etc.) or analyzing loaded scripts. This finds UI frameworks and analytics tools but misses backend infrastructure entirely.

DNS and network analysis examines DNS records, SSL certificates, and public network configuration. You can infer some infrastructure choices (Cloudflare, AWS), but payment processors, CRMs, and most SaaS tools are invisible to this method.

Public evidence extraction scans the company's web presence for vendor relationships disclosed in privacy policies, terms of service, security pages, and data processing agreements. When a company writes "we use Stripe to process payments" or lists "Salesforce" in their subprocessor documentation, that's deterministic evidence.

The VendorStacks API uses the third approach. It returns vendors with quoted source evidence from the company's public pages, not inferred from JavaScript or network patterns.

What You Can Actually Detect

Our index of 1,000 companies reveals what's realistically detectable from public evidence:

• Payment processors: Stripe appears in 248 companies (the most reliably documented vendor)
• Cloud infrastructure: AWS (329 companies), Google Cloud (175), Microsoft Azure (139)
• AI/ML providers: OpenAI (160 companies), Anthropic (133)
• CRM and sales: HubSpot (148), Salesforce (121)
• Analytics: Google Analytics (331 companies)
• Collaboration: Slack (143), GitHub (119)

These high counts reflect both market dominance and disclosure practices. Companies document payment processors and AI providers because of regulatory requirements and user trust. Internal tools with no data flow obligations often go undocumented.

The API covers 24 vendor categories including payments, crm_sales, cloud_infra, ai_ml, security_fraud, analytics_data, support_cx, observability, email, auth_identity, database_infra, and others. The full category list is in the response schema.

API Implementation

Getting Started

First, get an API key:

curl -X POST https://api.vendorstacks.com/v1/keys

This returns an instant key with 25 free credits. Each successful lookup costs 1 credit. Lookups that find no evidence cost 0 credits.

Basic Tech Stack Lookup

To check what tech stack a company uses:

const response = await fetch(
  'https://api.vendorstacks.com/v1/check?url=figma.com',
  {
    headers: {
      'Authorization': 'Bearer vr_live_...'
    }
  }
);

const data = await response.json();

if (data.found) {
  console.log('Tech stack:', data.vendor_stack);
  console.log('Scanned at:', data.scanned_at);
  console.log('Credits used:', data.credits_used);
} else {
  console.log('No public vendor evidence found');
}

The vendor_stack object contains vendors grouped by category:

{
  "payments": ["Stripe"],
  "cloud_infra": ["AWS", "Google Cloud"],
  "ai_ml": ["OpenAI"],
  "crm_sales": ["Salesforce"]
}

Understanding the Evidence Fields

Every vendor detection includes evidence fields showing where the information was found:

const { payments_evidence, ai_ml_evidence } = data;

// Example evidence structure:
// {
//   "Stripe": "Source: https://example.com/privacy - 'We use Stripe to process payments'",
//   "OpenAI": "Source: https://example.com/terms - 'OpenAI powers our AI features'"
// }

This lets you verify detections and understand confidence levels. If a vendor appears without a direct quote, treat it as lower confidence.

Checking Previously Scanned Companies

The /v1/company/{domain} endpoint returns cached data without triggering a new scan:

import requests

response = requests.get(
    'https://api.vendorstacks.com/v1/company/linear.app',
    headers={'Authorization': 'Bearer vr_live_...'}
)

data = response.json()
if data['found']:
    print(f"Last scanned: {data['scanned_at']}")
    print(f"Vendors: {data['vendor_stack']}")
else:
    print("Not in index - use /v1/check to trigger a scan")

This costs 0 credits if the company isn't indexed. Use it to check before triggering a full scan.

Scan Timing

The /v1/check endpoint behavior depends on index status:

• Indexed companies (in our 1,000-company index): response in <1 second
• Unindexed companies: triggers a live scan, takes 15-90 seconds depending on site size

For bulk operations, check /v1/company/{domain} first to identify which companies need scanning.

Building a Tech Stack Database

Here's a Node.js script that builds a local database of tech stacks for a list of companies:

const companies = ['stripe.com', 'figma.com', 'linear.app', 'notion.so'];
const results = [];

for (const domain of companies) {
  // Check if already indexed
  let response = await fetch(
    `https://api.vendorstacks.com/v1/company/${domain}`,
    { headers: { 'Authorization': `Bearer ${API_KEY}` } }
  );
  
  let data = await response.json();
  
  // If not found, trigger a scan
  if (!data.found) {
    console.log(`Scanning ${domain}...`);
    response = await fetch(
      `https://api.vendorstacks.com/v1/check?url=${domain}`,
      { headers: { 'Authorization': `Bearer ${API_KEY}` } }
    );
    data = await response.json();
    
    // Wait for unindexed scans
    if (data.credits_used === 0) {
      await new Promise(resolve => setTimeout(resolve, 2000));
    }
  }
  
  if (data.found) {
    results.push({
      domain,
      stack: data.vendor_stack,
      scanned: data.scanned_at
    });
  }
}

console.log(JSON.stringify(results, null, 2));

Reverse Lookup: Finding Companies Using Specific Vendors

The /v1/prospect endpoint answers the inverse question: which companies use a specific vendor?

curl "https://api.vendorstacks.com/v1/prospect?vendor=Stripe&page=1" \
  -H "Authorization: Bearer vr_live_..."

Response:

{
  "results": [
    {
      "domain": "example.com",
      "vendor_stack": {"payments": ["Stripe"]},
      "scanned_at": "2024-01-15T10:30:00Z"
    }
  ],
  "total_results": 248,
  "page": 1,
  "per_page": 10,
  "credits_used": 10
}

Each result costs 1 credit. Empty pages (beyond the last result) cost 0 credits.

Pricing and Credit Usage

Credits are consumed only for successful results:

• Tech stack lookup: 1 credit if vendors are found, 0 if not
• Reverse lookup: 1 credit per company returned (10 per page)
• Failed scans or errors: 0 credits

Credit packs:

• $10 → 1,100 credits (~$0.009 per lookup)
• $50 → 6,000 credits (~$0.008 per lookup)
• $250 → 35,000 credits (~$0.007 per lookup)

Check your balance:

curl https://api.vendorstacks.com/v1/balance \
  -H "Authorization: Bearer vr_live_..."

Limitations and What This Doesn't Do

Be clear about what public evidence extraction cannot detect:

No access to private data: We don't see internal tools, employee accounts, or vendor relationships not publicly disclosed. If a company uses Zendesk but doesn't mention it anywhere public, it won't appear.

No real-time monitoring: The scanned_at timestamp shows when evidence was collected. We don't track when vendors are added or removed in real-time.

No checkout or payment flow analysis: We can't determine which payment processor handles a specific transaction or map phone numbers to vendors. We detect what companies publicly disclose, not what network requests they make.

Documentation dependency: Companies that don't publish privacy policies or vendor lists will have sparse results. B2B SaaS companies typically have better documentation than consumer apps.

Practical Use Cases

Engineering teams use tech stack detection for:

Competitive analysis dashboards: Track which vendors competitors adopt over time without manual research.

Integration prioritization: If you're building a B2B product, identify which tools your target customers actually use to prioritize integrations.

Lead qualification: Enrich CRM records with tech stack data to route leads to reps who know their tools.

Market research: Analyze vendor adoption patterns across company size, industry, or funding stage (when combined with firmographic data).

Security audits: For enterprises evaluating vendors, check what subvendors they rely on.

Working with the Data

The vendor_confidence field (when present) indicates evidence strength. Always check the evidence fields to understand what was actually found versus inferred.

The subprocessor_urls array contains the specific pages where vendor information was found. These are the source documents for the entire stack.

When found: false, it means no public evidence was located—not that the company uses no vendors. The absence of evidence is not evidence of absence.

Getting Started

Generate an API key:

curl -X POST https://api.vendorstacks.com/v1/keys

Try a lookup:

curl "https://api.vendorstacks.com/v1/check?url=stripe.com" \
  -H "Authorization: Bearer vr_live_..."

The API returns JSON with vendor_stack, evidence fields, and credit information. You're billed only for successful detections.

For questions about the API or specific detection scenarios, reach out at the contact information in the API documentation.