If you're the IT lead or engineering manager at a 100-person Indian company, here's a question worth sitting with: how many SaaS tools does your org actually pay for right now? Not the ones in the approved vendor list. All of them, including the Notion workspace a product manager spun up last quarter, the Loom subscription charged to a team card in December, and the Figma seats that duplicated when a new designer joined without anyone checking.
The uncomfortable answer, across the companies we work with, is that most IT leads can accurately name fewer than half the tools their org is paying for. The rest live in inboxes, on team cards, and in bank statements that nobody looks at until a CFO flags an anomaly in the quarterly close.
AI IT manager capabilitiesO turns Gmail invoices into a structured, deduplicated SaaS spend map. Not a high-level overview — the actual pipeline stages, the OAuth scopes, the duplicate resolution logic, and what the output looks like when you sit down to triage it.
Why Indian IT Leads Are Flying Blind on SaaS Spend
SaaS finance integrations India and 60 SaaS tools across teams. Product uses Jira and Linear. Sales is on HubSpot and maybe a parallel Apollo trial. Finance runs Zoho Books or QuickBooks. Engineering has AWS, GitHub, Datadog, and five other tools that get expensed as "infrastructure." The IT lead, if there is one, knows the sanctioned stack. Nobody has a clean view of the rest.
SaaS auto-renewal price increasess">shadow IT SaaS auditry. Even tools that started as approved purchases drift out of visibility. An annual subscription auto-renews. A plan gets upgraded during a free trial and nobody documents it. A vendor changes their billing entity and the invoice looks different enough that finance doesn't connect it to the tool in the spreadsheet.TDS on international SaaS paymentsaaS spend management in India doesn't carry a valid GSTIN, your finance team can't claim the 18% GST input credit. For a company spending ₹15 lakh a year on SaaS, that's ₹2.7 lakh of tax credit quietly evaporating because nobody tracked which vendors are GST-registered and which aren't. Manual audits don't catch this. Quarterly reviews don't either, because the invoices are scattered across 12 different inboxes.
Watch out: If your SaaS invoices land in individual employee inboxes rather than a central billing address, you're almost certainly missing input tax credit claims. Consolidating billing emails to a single address is the first step before any audit.
Key takeaway: Flying blind on SaaS spend isn't just an organisational inconvenience — it has a direct, quantifiable cost in wasted licences and unclaimed GST input credits.
The Core Idea: Your Inbox Already Holds the Audit Trail
SaaS renewal calendar the time of charge. This is non-negotiable for them — it's how they handle chargebacks, satisfy their own audit requirements, and communicate renewal terms. Which means your Gmail inbox (or Outlook inbox) is, right now, the most complete record of what your company actually pays for.
Think about why this beats the alternatives. Asking department heads to self-report their SaaS usage gets you the tools they remember, not the ones billed to cards they share with two other people. Parsing bank statements gives you transaction amounts but not vendor names, plan tiers, or renewal dates. Parsing invoices from the inbox gives you all of it: vendor, amount, currency, plan, billing cycle, and sometimes the seat count.
The inbox isn't an email archive. For SaaS procurement, it's the most accurate financial ledger most companies have — and almost nobody is reading it systematically.
The AI CIO ingestion pipeline is built on this insight. Instead of asking your team to fill in a spreadsheet or connect every SaaS tool via API, we read what the vendors already sent you. The extraction happens automatically, the data gets structured and enriched, and within a few minutes of connecting your workspace you're looking at a categorised spend map that took no manual effort to produce.
Run a free SaaS spend audit — find every hidden subscription
OAuth, Permissions, and What We Actually Read
The first question any sensible IT lead asks before granting inbox access is: what exactly are you reading? Fair question. Here's the specific answer.
We request Gmail OAuth 2.0 access using the read-only gmail.readonly scope. This lets us query the Gmail API to retrieve messages and attachments. It does not grant write access, it does not expose calendar or contacts data, and it cannot send email on your behalf. The consent screen Google presents during the OAuth flow lists the scopes explicitly — you can verify them before approving.
Within that read access, we apply our own filters before we look at anything. We only retrieve emails that match at least one of the following signals: the sender domain matches a vendor in our catalog, the subject line contains invoice or receipt keywords, or the email carries a PDF or structured HTML attachment with financial content patterns. Everything else — personal threads, team conversations, project updates — is not retrieved from the API at all.
What gets stored and what doesn't
Raw email body content is not persisted beyond the parsing window. Once the extraction stage pulls the structured fields (vendor name, amount, date, billing cycle), the raw text is discarded. What we store is the extracted record: a row in a database that looks like "Zoom, ₹1,84,000, annual, next renewal 14 March 2025, account ID zoom-abc123." Not the email that contained that information.
This matters for Indian IT security policy. Most enterprise security teams are comfortable with structured data leaving an inbox; they're less comfortable with raw email content sitting in a third-party system. We're in the first category, and we're explicit about it.
Action: Before connecting any inbox-reading tool, ask the vendor for a written list of OAuth scopes requested and confirm that raw email body content is not persisted after parsing. If they can't answer that specifically, treat it as a red flag.
Inside the Parsing Pipeline: From Raw Email to Structured Data
There are 4 stages between a raw Gmail invoice and a line item in your spend dashboard.
Stage 1: Signal detection. Heuristic filters run against sender domain, subject-line keywords, and attachment MIME types. An email from [email protected] with subject "Your Zoom invoice" and a PDF attachment scores high on all 3 signals. An email from a recognized vendor domain without an attachment scores lower and gets queued for secondary review rather than immediate extraction.
Stage 2: Extraction. For emails that clear the signal filter, an LLM-assisted extraction layer pulls the fields we care about: vendor name as it appears in the email, total amount (in INR or foreign currency with the currency code), billing cycle, plan tier if stated, and the invoice or charge date. For structured HTML invoices from major SaaS vendors, this is highly reliable. For scanned PDF invoices from smaller or regional vendors, accuracy drops, which is why every extracted record carries a confidence score.
Stage 3: Normalisation. Extracted vendor strings are messy. "MSFT*Azure", "Microsoft Azure India", and "Microsoft Azure" are the same vendor. The normalisation layer maps every extracted string to a canonical vendor ID in our catalog. This step is what makes deduplication possible — you can't match duplicates across inboxes if you're comparing raw strings rather than canonical IDs.
Stage 4: Enrichment. Once a canonical vendor ID is assigned, the record inherits metadata from our vendor catalog: GST rate, SAC code, vendor category, GSTIN where available, and marketplace pricing data for renewal negotiation. A Zoom invoice doesn't just become "Zoom, ₹X" — it becomes "Zoom, ₹X, SAC 998315, IGST 18%, conferencing, renewal eligible for negotiation."
Key takeaway: The pipeline does more than read invoices — normalisation and enrichment are what turn raw Gmail noise into a spend record you can actually act on.
Duplicate and Shadow-IT Resolution: The Harder Problem
Getting extraction right is the tractable part. Deduplication is where most SaaS discovery tools fall short, and it's worth explaining how we approach it.
Duplicates appear in 3 distinct patterns. First: the same tool billed to multiple team cards. Slack billed to the marketing card and also billed to the engineering card because two admins set up workspaces before the org consolidated. Second: annual and monthly overlap, where a vendor charges monthly during a trial and then charges annually when the account upgrades, and both charges are visible in the same billing window. Third: reseller invoices layered on top of direct vendor charges, which is common with AWS (billed direct) and also through a cloud reseller simultaneously.
Our fingerprinting approach combines 3 fields: the canonical vendor ID, the billing cycle, and any account identifier extracted from the invoice (usually an account number or workspace ID that vendors include in their invoices). Two records that match on all 3 get flagged as a confirmed duplicate. Two records that match on vendor ID and billing cycle but don't have extractable account identifiers get flagged as a probable duplicate for IT lead review.
Shadow IT surfaces differently. If an employee signed up for a tool using their work email, the invoice lands in their work inbox. When an admin-level Gmail connection is made, those inboxes are included in the scan scope. Tools that match no canonical record in the approved vendor list but appear in billing signals get surfaced as "unknown or unapproved" in the dashboard, which is how a ₹4,200/month Loom subscription that nobody sanctioned becomes visible.
You can run this on your own workspace right now. Connect your Google Workspace or Microsoft 365 account in the AI CIO dashboard and the initial scan completes within minutes.
Book a 15-minute call with our team — we'll walk through your first discovery output together and show you exactly which of your subscriptions need immediate review.
Renewal Intelligence: Turning Parse Data into Proactive Alerts
Renewal dates are often not stated explicitly on monthly invoices. We infer them from billing cadence: if a vendor charges on the 12th of every month for 6 consecutive months, the next charge is the 12th of the following month. For annual subscriptions, the first invoice date plus 365 days gives us a working renewal estimate, which we refine when a renewal confirmation or upcoming-renewal email arrives.
Alert triggers fire at 45 days, 14 days, and 3 days before the inferred renewal date, routed to the admin assigned to that subscription in the dashboard. If the admin hasn't logged a decision (renew, cancel, or renegotiate) by 7 days out, the alert escalates to the IT lead or CFO as configured.
Here's a concrete example. One of our customers, a 120-person logistics-tech startup in Pune, had a Zoom annual subscription at ₹1,84,000. The 45-day alert fired, the IT lead reviewed utilisation, found that 60 hosts out of 80 licensed were active in the preceding quarter, and downgraded to a 60-host plan before auto-renew. The saving was ₹46,000 on that single renewal. Not a huge number in isolation — but they had 8 similar renewals in the same quarter.
Action: Map every annual SaaS subscription to a renewal calendar. For any tool renewing in the next 90 days, pull a 30-day active-user report before the 45-day mark. That's the only window where you can negotiate or downgrade before auto-renew locks in.
The renewal intelligence layer feeds into the broader AI CIO decision model. Beyond reminders, the AI CIO can flag tools where utilisation has dropped below a threshold you define, cross-reference that against the marketplace pricing for a comparable alternative, and surface a recommendation with projected savings. That's the difference between a calendar reminder and an actual decision-support system.
Key takeaway: Renewal intelligence only works if the underlying data is clean — which is why the parsing and normalisation stages upstream are worth the architectural investment.
Connecting Gmail Discovery to the Wider Easexpense Stack
Mail discovery doesn't operate in isolation. The records it produces flow into the same data model as the Google Workspace, Microsoft 365, and AWS integrations inside the Spend Analytics dashboard. A tool discovered via a Gmail invoice gets the same canonical vendor record as a tool discovered through a Workspace SSO audit. The two sources cross-validate each other: if Gmail shows 3 invoices for a tool but Workspace SSO shows 0 active users, that's a flag worth reviewing.
On the GST side, the enrichment step appends the vendor's GSTIN to every discovered record. When an invoice arrives from a vendor without a valid GSTIN (common with smaller SaaS vendors or overseas vendors without Indian GST registration), the record is flagged in a separate "input credit at risk" view so your finance team can address it before the next filing cycle. For a company spending ₹20 lakh annually on SaaS, this flag list is often worth ₹1.5 to 2.5 lakh in recoverable input credit.
What This Looks Like in Practice: A Walkthrough for IT Leads
Connecting your workspace takes about 4 minutes. You authorise the Gmail OAuth consent (admin-level for full workspace coverage, or delegated for a subset of inboxes), and the initial 12-month scan begins immediately. For a 100-person org with a typical billing volume, the first results appear in the dashboard within 5 to 10 minutes.
What you see when the scan completes: a table where each row is a discovered subscription. Columns include vendor name, monthly equivalent spend, last invoice date, inferred renewal date, assigned owner, and a duplicate or shadow-IT flag where applicable. Low-confidence extractions are marked visually so you know which rows need manual verification before they flow into reporting.
Triage follows a simple workflow. Confirmed tools (high confidence, single occurrence) go straight to your approved stack view. Needs-review items (low confidence or unfamiliar vendor) get routed to a review queue. Suspected duplicates are grouped with a side-by-side comparison of the matching records so you can confirm or dismiss the flag in a single click.
When you're ready to hand off to finance, the same view exports a GST-clean spend report: vendor name, GSTIN, SAC code, GST rate, net amount, GST amount, and invoice reference. That's the format your CA needs for input credit reconciliation, and it takes about 30 seconds to generate.
See your live SaaS spend in Easexpense — connect Google or Microsoft
Security, Privacy, and Compliance Considerations
Google requires any app requesting Gmail API access to go through an OAuth verification process, which includes a security assessment by an approved third party. Passing that process means Google has reviewed the scopes requested and confirmed they match the app's stated purpose. It's not a guarantee of perfect security posture, but it's a meaningful bar — plenty of apps never make it through.
Inside Easexpense, role-based access controls determine who on the customer side can see what. The IT lead or designated admin sees full discovery output including duplicate flags and shadow-IT results. Finance users see spend data and GST reports. Employees see only the subscriptions assigned to them. Nobody on the customer side sees raw parsing logs or the email metadata we processed to build the records.
On SOC 2: we're in active planning for Type II certification. Our current security posture includes encryption at rest and in transit, access logging, and a formal data retention policy that covers the "no raw email content after parsing" commitment described earlier. If you're evaluating us against a formal vendor security questionnaire, our team can walk through specifics — reach out via the contact page and we'll connect you with the right person.
A few questions worth asking any inbox-reading SaaS discovery vendor before you connect: What OAuth scopes do you request and why? Do you persist raw email content after extraction? Where does structured spend data reside geographically? Who on your team has access to customer data and under what conditions? These aren't difficult questions for a vendor with a clean data handling posture, and hesitation on any of them should give you pause.
Frequently asked questions
Does Easexpense AI CIO read all my emails or only billing emails?
The AI CIO reads only emails that match billing and invoice signals: sender domains associated with known SaaS vendors, subjects containing invoice or receipt keywords, and attachments in PDF or structured HTML format. We request read-only Gmail OAuth access using the gmail.readonly scope, which does not grant access to calendar, contacts, or the ability to send email. Personal threads, team conversations, and non-billing emails are never retrieved from the API. Raw email body content is discarded after the parsing window — only the structured extracted fields are persisted in our system.
How accurate is automated SaaS subscription discovery from Gmail?
For machine-readable HTML invoices from major SaaS vendors, extraction accuracy is above 95% in our production pipeline. Scanned PDF invoices from smaller or regional vendors score lower because OCR introduces more ambiguity, particularly for amounts and vendor names that don't match our catalog. Every extracted record carries a confidence score, and IT leads review low-confidence entries in a separate queue before those records flow into reporting. This means the data that reaches your dashboard has been either auto-confirmed at high confidence or human-reviewed — we don't silently let low-quality extractions pollute your spend view.
Can Easexpense detect SaaS tools that employees signed up for on personal cards?
Yes, within limits. If the employee used their work email as the billing address, the invoice lands in the work inbox and gets picked up during the Gmail scan. Tools billed entirely to a personal email with no work address attached are not visible via Gmail discovery. However, they may surface through the Google Workspace or Microsoft 365 SSO audit integration inside the Spend Analytics dashboard, which can flag applications that employees have authorised with their work identity even if the billing flows to a personal account. The combination of Gmail discovery and SSO audit gives you the most complete picture of shadow IT across both billing and identity layers.
What happens when the same SaaS tool appears multiple times across different team inboxes?
The AI CIO uses a fingerprinting approach that combines the canonical vendor ID, billing cycle, and any account identifier found in the invoice (such as an account number or workspace ID). When 2 records match on all 3 fields, the system flags a confirmed duplicate and merges them into a single spend record so the total cost isn't double-counted in reporting. When 2 records match on vendor ID and billing cycle but don't have extractable account identifiers, they're flagged as probable duplicates and surfaced for IT lead review in a side-by-side comparison view. The review step is deliberate — we'd rather surface something for human confirmation than silently merge records that turn out to represent genuinely separate subscriptions.
How far back does the Gmail scan go when I first connect my workspace?
The initial scan looks back 12 months by default, which is enough to capture both monthly and annual billing cycles for the vast majority of tools. A 12-month window also gives you 4 GST quarters of invoice history, which is typically sufficient for an input credit reconciliation exercise. For organisations that want a longer historical view for a deeper audit or for tools with multi-year billing cycles, the lookback window can be extended to 24 months on request. Extending the window increases the initial scan time but doesn't change the ongoing monitoring behaviour after setup.
Is Gmail the only inbox integration, or does Easexpense also work with Microsoft Outlook?
Both Gmail (Google Workspace) and Microsoft 365 Outlook are supported. The parsing pipeline is identical across both; only the underlying API layer differs — Microsoft Graph API for Outlook versus the Gmail API for Google Workspace. Organisations running a hybrid environment where some teams are on Google Workspace and others on Microsoft 365 can connect both simultaneously, and the AI CIO consolidates the discovered subscriptions into one unified spend view with no duplication between the two sources. The OAuth and permission model follows the same read-only, structured-fields-only approach for both integrations.
How does AI SaaS discovery help with GST input tax credit claims in India?
When a subscription is discovered, the AI CIO maps it to our vendor catalog which includes each vendor's GSTIN, applicable GST rate (typically 18% for most SaaS services under SAC 998315), and SAC code. This enrichment happens automatically at the normalisation stage, so every spend record in your dashboard already carries the GST metadata your finance team needs. Invoices that are missing a GSTIN or are from overseas vendors without Indian GST registration are flagged in a separate "input credit at risk" view, so your CA knows exactly which charges qualify for input credit and which don't before the next filing cycle — rather than discovering the gap during a GST audit.