Companies That Use HubSpot or Salesforce: How to Find Any Software's Install Base (2026)

How can you tell which CRM a company uses?

You can usually tell which CRM or marketing platform a company uses from public signals: tracking scripts and forms on its website, how its email is configured, the subdomains it runs, the job postings it publishes, and its presence in a vendor's partner or review ecosystem. Each signal on its own is a clue. Several together are evidence.

Signal	What it shows	How reliable	Main weakness
Website scripts and tags	A marketing or analytics tool is loaded on the site	Good for marketing platforms	Tags can linger after a company stops using the tool
Forms	Which system receives website leads	Good	Some forms post through a third tool
Hosted pages and subdomains	Landing pages, help centers or portals run on a platform	Good for that product	Says little about the core CRM
Email and DNS records	Which services are allowed to send or verify on the domain	Moderate	Records outlive subscriptions and can be ambiguous
Job postings	The company hires for skills on a platform	Good for core systems	A skill listed may be "nice to have," not in use
Partner and review ecosystems	The company reviewed, hired a partner for, or appears as a customer of a platform	Good when recent	Often dated, and coverage is patchy
Technographic databases	Many signals already collected and combined	Varies by provider	Quality depends on refresh and verification

How to find companies that use HubSpot

HubSpot is one of the easier platforms to detect, because its marketing tools usually run on the company's public website. The common signals are:

• The tracking code. HubSpot's analytics script loads on pages where its marketing tools are active. It appears in the page source and in browser developer tools.
• Embedded forms. HubSpot forms and chat widgets have recognizable markup and load from HubSpot's servers.
• Hosted content. Landing pages, blogs or knowledge bases built on HubSpot's content tools often run on platform-hosted addresses or carry platform markers.
• Email authentication. Companies that send marketing email through HubSpot often authorize it in their domain's email records.
• Hiring. Job postings for marketing operations or RevOps roles that ask for hands-on HubSpot experience.

Because HubSpot covers marketing, sales and service, one signal does not tell you which parts a company uses. A tracking script suggests the marketing tools. It does not prove HubSpot is the company's CRM of record, because plenty of teams pair a marketing platform with a different CRM.

How to find companies that use Salesforce

Salesforce is harder to detect from outside, because its CRM mostly lives behind a login, not on the public website. You have to rely more on indirect signals:

• Job postings. Roles for Salesforce administrators, developers, architects or consultants are among the strongest public evidence that a company runs it.
• Web-to-lead forms. Some websites post form submissions straight into Salesforce, which can be seen in the form's markup.
• Marketing tools in the same family. Salesforce's marketing products leave website tags and email records similar to other marketing platforms.
• Customer communities and portals. Help centers and partner portals built on Salesforce often run on recognizable addresses.
• App marketplace and partner activity. Reviews of add-on apps or published projects with implementation partners.

Expect lower coverage from manual Salesforce detection than from HubSpot detection. Many companies running Salesforce show no public trace of it, especially smaller ones without a dedicated administrator. This is where researched install base data earns its cost.

Can you find companies that use any software the same way?

Yes, the same approach works for most business software, but how visible a product is depends on whether it touches the public internet. Website, marketing, analytics, ecommerce and chat tools are easy to detect. Back-office systems such as ERP, accounting, HR and IT service management rarely show on a website, so they lean on job postings, partner ecosystems and researched data. That is why lists of companies using ERP software or IT service management users are usually built by research rather than website scanning.

How visible is each type of business software?

The table below shows how detectable common software categories are from public signals, and where the best evidence usually comes from. Use it to set expectations before you build a list, and to decide when research or a data provider is the only realistic route.

Software category	Visibility from outside	Best evidence
Marketing automation and email marketing	High	Website tags, forms, email records
Website, ecommerce and chat	High	Page source, hosted pages, checkout markup
CRM	Medium	Forms, job postings, partner ecosystems
Sales intelligence and engagement tools	Low to medium	Job postings, email records, research
ERP and accounting	Low	Job postings, partner case studies, research
HR, payroll and workforce	Low	Careers pages, job postings, research
IT service management, RMM and PSA	Very low	Research and direct confirmation
Security tools	Very low	Research, partner and certification listings

For low-visibility categories, detected data covers only a slice of the real market, and the slice is skewed toward larger companies that hire publicly. Our sales and marketing technology data, cybersecurity users data and IT and cloud users data fill those gaps with research rather than relying on website scans alone.

Can you find companies that use HubSpot or Salesforce for free?

Yes, for small lists. Free methods take time and give uneven coverage, but they are a sound way to test a market before you buy data, or to check a handful of key accounts by hand.

• Read the page source. Open a company's homepage, view the source, and search for the platform's name or script addresses. It takes a minute per site and is the most direct check of a website tag.
• Use a browser technology profiler. Free browser extensions list the scripts and services a page loads. They are handy for spot checks and useless for scale.
• Look up DNS records. Free DNS lookup tools show a domain's email and verification records. Look for services the company authorizes to send mail on its behalf.
• Search job boards. Search for job titles or skills such as "Salesforce administrator" or "HubSpot marketing operations," optionally restricted to a region or industry. Hiring is strong evidence of active use.
• Browse partner and app ecosystems. Implementation partners and add-on apps often publish client stories and reviews that name companies and their use cases.
• Ask your own customers. A short question at onboarding about which CRM they use builds a first-party install base map for free, and it is always accurate on the day you ask.

Free methods break down at scale. Checking a few hundred sites by hand is a week of work, and the result is already aging by the time you finish. That is the point where a provider's data, refreshed on a cycle, becomes cheaper than staff time.

Manual research or technographic data: which should you use?

Use manual research when you need a few dozen accounts and have time to check each one. Use technographic data when you need hundreds or thousands of accounts, consistent fields and a refresh cycle. Most teams end up using both: data to build the list, and manual checks on the accounts that matter most.

	Manual research	Technographic or install base data
Scale	Dozens of accounts	Thousands of accounts
Cost	Staff time	Data spend
Back-office tools	Hard, slow	Depends on the provider's research
Consistency	Varies by researcher	Same fields on every record
Freshness	Current when checked	As fresh as the provider's last refresh
Contacts included	Only if you find them	Often, with the right provider

If you are comparing providers, our guide to choosing technographic data providers lists the questions that separate a fresh, verified dataset from a stale one.

How accurate is install base data?

Install base data is only as accurate as its last check. A detection tells you a product was seen. It does not tell you the product is still in use, how widely, or by whom. Most errors fall into a handful of patterns.

• Stale tags. Website scripts often stay in place long after a subscription ends. A company that moved off a platform last year can still look like a customer.
• Migrations in progress. Companies moving between platforms often show signals from both for months. Treat dual signals as their own segment.
• Partial use. A company may use a platform's marketing tools and a different CRM, or one team may use a tool the rest of the company does not.
• Website vs company. An agency may have built the website on a platform the company itself never uses for sales.
• Parent and subsidiary. A signal on one brand's site may not apply to the parent company, or the reverse.
• Invisible small companies. Smaller businesses leave fewer public signals, so they are under-represented in purely detected data.

The fix for most of these is the same: record when a tool was first and last seen, prefer multiple signals over one, and verify the accounts you intend to spend real effort on.

How do you verify that a company still uses a tool?

Verify current use by checking for a recent, independent second signal, and for your most important accounts, by confirming with a person. A tag on the website plus a job posting from this quarter is far stronger than a tag alone.

1. Check recency. When was the tool last seen? A detection from last week beats one from last year.
2. Look for a second signal. Combine a website signal with hiring, email records or partner activity.
3. Read current job postings. Roles that require daily use of the platform are strong evidence it is the system of record.
4. Check for a competing signal. Signals from a rival platform may point to a migration.
5. Confirm with research. For priority accounts, a researcher can confirm the platform and the people who own it. This is how we build our human-verified technology users data.

What should an install base record include?

A useful install base record includes the company, the product and edition where known, how it was detected, when it was first and last seen, a confidence level, firmographic details, and contacts in the roles that own the tool. Anything less forces your team to research before they can act.

Field	Why it matters
Company name and domain	The match key for your CRM and other data
Product, and edition or module where known	Marketing tools and CRM are different buying conversations
Detection source	Lets you judge the evidence, such as website tag, job posting or research
First seen and last seen dates	Separates current users from past ones
Confidence level	Lets you prioritize strong detections and verify weak ones
Other relevant tools	Shows integrations, overlaps and likely migrations
Industry, headcount band, region	Fit filters for segmentation and routing
Contacts by role	The people who run, use or buy around the platform

How do HubSpot users and Salesforce users differ as audiences?

Treat each platform's users as several audiences, not one. The same product can be run by a five-person marketing team or by a department with its own administrators and developers, and those two accounts buy very differently. The differences that matter most for segmentation are these:

• Who runs the platform. Some accounts have a dedicated administrator or operations team. Others have a marketer or sales manager who looks after it part time. The first wants depth and governance. The second wants things to be simpler.
• How customized it is. Heavily customized deployments, with custom objects, integrations and developer work, need partners and tools that respect that complexity. Lightly configured ones value speed to value.
• Which parts are in use. A company may run a platform's marketing tools without its CRM, or its CRM without its service tools. Your offer has to match the part they use.
• What surrounds it. The CRM's neighbors, such as the finance system, support desk and data warehouse, decide which integrations matter.

Do not assume any of this from the platform name alone. Hiring signals, the presence of administrator roles, and the other tools in the stack are better guides to which audience an account belongs to.

Who should you contact at a company that uses HubSpot or Salesforce?

Contact the people who own the platform day to day and the people who sign off on changes to it. Which roles those are depends on company size and on what you sell.

• Platform owners. CRM administrators, marketing operations managers and RevOps leads. They know how the platform is used and feel its problems first.
• Budget holders. Heads of sales, marketing or revenue operations, and at smaller companies, the founder or general manager.
• Technical stakeholders. IT or systems leads, especially where the CRM connects to finance, support or product data.
• Users with pain. Sales and marketing managers who live with reporting gaps, duplicates or slow processes.

At a 30-person company, these may all be one or two people. At a large one, they are separate teams. Our CRM users email lists and marketing automation users lists include role and seniority so you can reach the right level for the size of the account.

How do you turn an install base list into a campaign?

Turn an install base list into a campaign by segmenting it on how the platform is used, then writing to a problem that segment actually has. A single message to "everyone who uses Salesforce" ignores the reasons each account might care.

Segment the list

• Single-platform users. Companies clearly running one CRM. Good for add-ons, services and integrations.
• Dual-signal accounts. Companies showing signals from two rival platforms. Possibly migrating, possibly running both by team. Ask before you assume.
• Marketing-only signals. A marketing platform with no clear CRM. Often smaller teams, sometimes ready for a CRM decision.
• Heavy users. Companies hiring administrators or developers. Larger, more complex deployments with bigger budgets.
• By firmographic fit. Industry, size and region, so the message can reference the account's world.

Write to the platform, respectfully

Mention the platform as context, not as a gotcha. "Teams running HubSpot for both marketing and sales often hit this reporting gap" is helpful. "We see you use HubSpot" reads as surveillance. If you sell a competing product, acknowledge the investment the account has made and lead with a specific reason to look, such as a capability gap or a cost model, rather than criticism of the incumbent.

Time it well

Platform decisions cluster around renewals, budget planning and leadership changes. Pairing install base data with intent data or a recent hire in revenue operations helps you reach accounts when a change is actually on the table.

A worked example: building a HubSpot user list for an integration launch

Here is an illustrative example of how a team might build and use an install base list from start to finish. Imagine a vendor launching a new integration between its billing tool and HubSpot, aimed at small and mid-sized service businesses in the United States and Canada.

1. Define the target. Companies that use HubSpot as their CRM, not just its marketing tools, with 20 to 500 employees, in professional services, IT services and agencies.
2. Build the raw list. Start from a technology users dataset filtered to HubSpot CRM users in those industries and regions, then add a few dozen known accounts from the vendor's own customer base.
3. Remove weak detections. Drop records last seen long ago, and move accounts with signals from a rival CRM into a separate "possible migration" list.
4. Check the stack. Keep accounts whose billing or accounting system the vendor supports, and note the ones running a competing billing tool for a later displacement campaign.
5. Add the people. For each account, find and verify the RevOps or marketing operations lead, the finance lead and, for smaller companies, the founder.
6. Write by segment. One message for teams that already sync billing data by hand, explaining the time the integration saves. Another for accounts on a competing billing tool, explaining the switch.
7. Launch and learn. Send to a first batch, measure replies and meetings by segment, then adjust the message and widen the list.

Notice that the install base list did only part of the work. Fit filters, a stack check, verified contacts and segment-specific messages turned a list of HubSpot users into a campaign with a reason to reply.

How often should you refresh an install base list?

Refresh an install base list before every major campaign, and at least every quarter for any list you actively work. Platform changes cluster around renewals and budget cycles, and the companies most worth reaching, those reconsidering their stack, are exactly the ones whose signals change fastest.

Between full refreshes, watch for change signals on your priority accounts: new hiring for a rival platform, a new revenue operations leader, or a sudden drop in the platform's website tags. Any of these is a reason to re-check that account now. We refresh our own technology users data every 45 days so that the platform on a record reflects what the company runs today, not what it ran when the record was first built.

Is it legal to find out what software a company uses?

Observing public signals, such as a company's public website, published job postings and public DNS records, is generally fine. How you collect and use the data is where care is needed. This is general orientation, not legal advice.

• Respect site rules. Automated collection should honor a website's terms and its robots instructions, described in the Robots Exclusion Protocol (RFC 9309), and avoid hammering servers.
• Stay out of private spaces. Harvesting people from closed communities or private groups is a fast way to damage trust and break platform terms.
• Follow outreach rules. Contacting the people you find must follow the FTC's CAN-SPAM requirements in the United States, and GDPR or CASL where they apply. The ICO's legitimate interests guidance is a good starting point for business contacts in the UK and Europe.

Install base data in the IT channel

For vendors selling to MSPs, MSSPs and VARs, the install base that matters is usually the provider's own operating stack, not its CRM. The professional services automation platform, the remote monitoring and management tool, and the security and backup products a provider runs decide which vendors can integrate with it and which it might switch away from.

These tools are almost invisible from outside. A provider's website rarely shows its RMM, and job postings at a 20-person MSP are infrequent. Detected data alone tends to miss most of this market, which is why channel install base data is built mostly through research and direct confirmation. If you sell into providers, our MSP database and broader technology install base data are built that way, with the stack confirmed alongside the contacts.

What are common install base data mistakes?

The most common mistakes are trusting a single detection, ignoring dates, treating every user of a platform the same, and sending account lists with no contacts. Each one turns a promising list into wasted outreach.

• One signal, full confidence. A tag alone is a clue, not proof.
• No dates. Without first and last seen, you cannot separate users from former users.
• Ignoring migrations. Dual-signal accounts need their own message.
• One message for everyone. An enterprise with five administrators and a ten-person startup need different pitches.
• Accounts without people. A company name is not a lead. Add verified contacts in the right roles.
• Calling out the tracking. Use the platform as context, not as proof you have been watching.
• Never refreshing. Platforms change at renewal time. Re-check your list before every major campaign.

Install base checklist before you launch

1. Decide which product, and which part of it, matters to your offer.
2. Build the list from at least two kinds of signal or a provider that combines them.
3. Keep first-seen and last-seen dates and a confidence level on every record.
4. Separate single-platform, dual-signal and marketing-only accounts.
5. Add firmographic fit filters for industry, size and region.
6. Find and verify contacts in the roles that own and fund the platform.
7. Write to a segment's real problem, using the platform as context.
8. Re-check priority accounts before each campaign.

Related reading

• what is technographic data: how install base data is collected and checked.
• what is intent data: adding timing to an install base list.
• what is firmographic data: narrowing a list by company size and industry.

Reach the teams that run the platforms you sell into

Knowing which companies use HubSpot or Salesforce is only the first step. The value comes from knowing which of them still do, how they use it, and who owns the decision. A shorter list that is current and reachable will beat a long list of detections every time.

DiscoverMSPs builds technology users data with researched stacks and human-verified contacts, in 60+ countries, refreshed every 45 days and backed by a 95% accuracy policy. Tell us the platform you sell into, and we will send a free 100-record sample so you can check it against accounts you already know. Or start from our home page to browse every database.