What Tech Stack Does a Company Use? 4 Public Evidence Methods That Actually Work

The Question Every Sales and Product Team Asks

When qualifying a prospect or researching a competitor, the question "what tech stack does a company use?" comes up constantly. Sales teams want to know if a prospect uses Stripe before pitching a payments integration. Product teams want to understand which analytics vendors dominate their market segment. Partnership teams need lists of companies already using complementary tools.

The challenge: most companies don't publish an official list of their vendors. You need to detect usage from what's publicly available. This post breaks down the four methods that actually work—based on how VendorStacks extracts vendor data deterministically from public evidence.

Method 1: JavaScript Tag Detection

The most common public signal is third-party JavaScript loaded on a company's website. When you visit a site, your browser requests dozens of scripts from external domains. Each request is evidence of vendor usage.

What you can detect:

• Analytics: Google Analytics, Segment, Mixpanel, Amplitude
• Marketing: Meta Pixel, Google Ads, LinkedIn Insight Tag
• Support: Intercom, Zendesk, Help Scout chat widgets
• Product analytics: Heap, PostHog, Pendo

How it works technically:

A script tag like <script src="https://www.googletagmanager.com/gtag/js?id=G-ABC123"></script> is direct evidence of Google Analytics usage. The domain and path structure are deterministic—there's no ambiguity about what vendor owns googletagmanager.com.

The challenge is scale. To answer "what tech stack does a company use?" you need to:

1. Load the target page in a real browser context (headless Chrome)
2. Capture all network requests, not just the initial HTML
3. Wait for async scripts that load after page render
4. Match domains against a vendor database

Here's how to check a company's stack using the VendorStacks API:

curl -X GET "https://api.vendorstacks.com/v1/check?url=example.com" \
  -H "Authorization: Bearer vr_live_your_key_here"

Response excerpt:

{
  "vendor_stack": {
    "analytics_data": [
      {
        "vendor": "Google Analytics",
        "script_evidence": ["https://www.googletagmanager.com/gtag/js?id=G-XYZ"]
      }
    ],
    "marketing_ads": [
      {
        "vendor": "Meta",
        "script_evidence": ["https://connect.facebook.net/en_US/fbevents.js"]
      }
    ]
  },
  "scanned_at": "2025-01-15T10:23:45Z",
  "credits_used": 1
}

The script_evidence field shows the exact URL that proves usage. This is deterministic—there's a quoted source for every vendor in the response.

Method 2: DNS and Subdomain Enumeration

Many SaaS vendors require customers to create DNS records. An MX record pointing to Google Workspace, a CNAME for a help center subdomain, or an A record for a dedicated instance—all are public evidence.

What you can detect:

• Email: Google Workspace, Microsoft 365 (via MX records)
• Marketing: HubSpot landing pages, Marketo subdomains
• Support: Zendesk (help.company.com CNAME)
• Infrastructure: AWS (via nameserver patterns), Cloudflare

Example:

A DNS lookup for help.company.com returns:

help.company.com. CNAME help.company.com.zendesk.com.

This proves the company uses Zendesk for their help center. The evidence is in a public DNS record—anyone can verify it with dig.

VendorStacks performs DNS lookups for common subdomain patterns (help, support, status, blog, etc.) and matches CNAME targets against known vendor patterns. The API returns this as subdomain_evidence.

Method 3: Subresource and Asset URL Analysis

Beyond scripts, companies load images, fonts, stylesheets, and API calls from vendor domains. These subresource requests are evidence of vendor usage.

What you can detect:

• CDN: Cloudflare, Fastly, Akamai (via asset URLs)
• Fonts: Google Fonts, Adobe Fonts
• Images: Cloudinary, Imgix
• Chat/support: Intercom avatar URLs, Drift widget assets

Technical detail:

When analyzing what tech stack a company uses, you need to distinguish between:

• First-party subresources: Images hosted on company.com/assets/logo.png
• Third-party subresources: Images loaded from cdn.vendor.com/xyz.png

Only the latter is evidence of vendor usage. VendorStacks tracks the full set of subresource domains requested during page load, then filters for known vendor domains. These appear in the API response as subprocessor_urls—the raw list of all third-party domains detected.

{
  "subprocessor_urls": [
    "https://www.googletagmanager.com",
    "https://connect.facebook.net",
    "https://js.stripe.com",
    "https://cdn.segment.com"
  ]
}

This field gives you the raw evidence set. You can diff it over time to detect vendor changes.

Method 4: Legal Disclosures and Privacy Pages

GDPR, CCPA, and other privacy regulations require companies to disclose which third parties process user data. These disclosures are public, structured, and highly accurate.

What you can detect:

• Payments: Stripe, Adyen, Braintree
• Analytics: Google Analytics, Segment
• Support: Zendesk, Intercom
• Infrastructure: AWS, Google Cloud (when explicitly disclosed)

Where to look:

• /privacy or /privacy-policy pages
• /subprocessors pages (common for B2B SaaS)
• /legal or /terms pages

Many companies maintain a dedicated subprocessor list. For example, a SaaS company might list "Stripe (payment processing), AWS (infrastructure), Intercom (customer support)" on their privacy page.

VendorStacks extracts vendor names from these pages using NLP and pattern matching. When we find a vendor mentioned in a legal context, we return it with privacy_policy_evidence:

{
  "vendor_stack": {
    "payments": [
      {
        "vendor": "Stripe",
        "privacy_policy_evidence": ["https://company.com/privacy#subprocessors"]
      }
    ]
  }
}

Combining Methods for Comprehensive Detection

No single method answers "what tech stack does a company use?" completely. The most accurate approach combines all four:

1. Script tags catch client-side tools (analytics, marketing, chat)
2. DNS records catch infrastructure and email providers
3. Subresource URLs catch CDNs, fonts, and API calls
4. Legal disclosures catch backend vendors with no public scripts

VendorStacks runs all four methods in a single API call. The vendor_stack response groups vendors by category—24 categories covering everything from payments to ai_ml to observability.

Real-World Vendor Distribution

Across VendorStacks' index of 1,000 companies and 283 distinct vendors, here's what we actually see:

• Google Analytics: 344 companies (34.4% adoption)
• AWS: 230 companies (23.0%)
• Stripe: 155 companies (15.5%)
• Meta: 123 companies (12.3%)
• HubSpot: 106 companies (10.6%)
• Google Ads: 93 companies (9.3%)
• OpenAI: 91 companies (9.1%)
• Slack: 88 companies (8.8%)

This distribution makes sense: analytics and infrastructure are near-universal, while specialized tools (payments, AI) have lower but still significant adoption.

Building Tech Stack Detection Into Your Application

If you're answering "what tech stack does a company use?" programmatically—for lead scoring, competitive intelligence, or market research—here's a working implementation:

import requests

def get_tech_stack(domain):
    response = requests.get(
        f"https://api.vendorstacks.com/v1/check?url={domain}",
        headers={"Authorization": "Bearer vr_live_your_key_here"}
    )
    data = response.json()
    
    if not data.get("found"):
        return None  # No public evidence found
    
    # Extract all vendors across all categories
    vendors = []
    for category, vendor_list in data["vendor_stack"].items():
        for vendor_obj in vendor_list:
            vendors.append({
                "vendor": vendor_obj["vendor"],
                "category": category,
                "confidence": vendor_obj.get("vendor_confidence", "high")
            })
    
    return vendors

# Example: Check if a prospect uses Stripe
stack = get_tech_stack("example.com")
uses_stripe = any(v["vendor"] == "Stripe" for v in stack)

Key points:

• found: false means no evidence was located—NOT that the company uses nothing. They may use vendors with no public footprint.
• credits_used is always 1 for a successful lookup, 0 if nothing is found or the scan fails.
• vendor_confidence (high/medium/low) indicates evidence strength—multiple signals vs. a single mention.

Reverse Lookup: Finding Companies by Vendor

The inverse question—"which companies use Stripe?"—is equally valuable. VendorStacks' reverse lookup endpoint returns companies that use a specific vendor:

curl -X GET "https://api.vendorstacks.com/v1/prospect?vendor=Stripe&page=1" \
  -H "Authorization: Bearer vr_live_your_key_here"

Response:

{
  "results": [
    {
      "domain": "company1.com",
      "vendor": "Stripe",
      "detected_at": "2025-01-10T14:22:31Z",
      "evidence_url": "https://company1.com/checkout"
    }
  ],
  "total_results": 155,
  "page": 1,
  "credits_used": 10
}

Pricing: 1 credit per result (10 results per page = 10 credits). An empty result set costs 0 credits.

When Public Evidence Isn't Enough

These methods have limits:

• Backend-only vendors with no public scripts or legal disclosures are invisible (e.g., an internal database that's never mentioned publicly).
• Private instances don't create public DNS records.
• Script blockers or CSP policies can prevent detection if the page doesn't load normally.

VendorStacks only returns what's publicly verifiable. If there's no evidence, found is false—we never guess.

Getting Started

To start detecting tech stacks programmatically:

1. Get an API key (instant, 25 free credits):

``bash curl -X POST https://api.vendorstacks.com/v1/keys ``

1. Check a domain:

``bash curl -X GET "https://api.vendorstacks.com/v1/check?url=yourcompany.com" \ -H "Authorization: Bearer vr_live_..." ``

1. Review the evidence: Every vendor in the response includes the exact URL or record that proves usage.

Pricing: $10 for 1,100 credits, $50 for 6,000, $250 for 35,000. You only pay for successful results—failed scans and empty responses cost nothing.

The question "what tech stack does a company use?" has a deterministic answer when you combine script detection, DNS analysis, subresource tracking, and legal disclosures. VendorStacks runs all four methods and returns structured, evidence-backed results in under a second for indexed domains.