> Enrich.chat gives AI agents verified work emails and mobiles. To use it from an agent, read https://enrich.chat/agents.md . This is the Markdown version of https://enrich.chat/companies-using/ # Companies using HubSpot, Salesforce, AWS and other tools Pick a technology to see well-known companies where it was detected, grouped by sector, with links to their email formats. Then find the people who run that tool. By Enrich.chat Editorial. Updated October 15, 2026. ## Browse by technology - [Akamai](https://enrich.chat/companies-using/akamai/): CDN and security - [Atlassian Cloud](https://enrich.chat/companies-using/atlassian/): team collaboration (Jira, Confluence) - [AWS](https://enrich.chat/companies-using/aws/): cloud infrastructure - [Cloudflare](https://enrich.chat/companies-using/cloudflare/): CDN and security - [Datadog](https://enrich.chat/companies-using/datadog/): observability - [Demandbase](https://enrich.chat/companies-using/demandbase/): account-based marketing - [Google Workspace](https://enrich.chat/companies-using/google-workspace/): email and productivity - [Hotjar](https://enrich.chat/companies-using/hotjar/): product analytics - [HubSpot](https://enrich.chat/companies-using/hubspot/): marketing automation and CRM - [Intercom](https://enrich.chat/companies-using/intercom/): customer messaging - [Marketo](https://enrich.chat/companies-using/marketo/): marketing automation - [Microsoft 365](https://enrich.chat/companies-using/microsoft-365/): email and productivity - [New Relic](https://enrich.chat/companies-using/new-relic/): observability - [Optimizely](https://enrich.chat/companies-using/optimizely/): experimentation - [Pardot (Account Engagement)](https://enrich.chat/companies-using/pardot/): B2B marketing automation - [Salesforce](https://enrich.chat/companies-using/salesforce/): CRM - [ServiceNow](https://enrich.chat/companies-using/servicenow/): IT service management - [Stripe](https://enrich.chat/companies-using/stripe/): payments - [Zendesk](https://enrich.chat/companies-using/zendesk/): customer support software **Short answer:** A "companies using" list names the businesses where a technology, such as HubSpot, Salesforce or AWS, was detected in [public signals](https://github.com/enthec/webappanalyzer): website code, HTTP headers and DNS records. Pick a technology above to see well-known companies that use it, grouped by sector and linked to their email formats. Then find the people who own that tool and verify their work emails. ## Key takeaways - Detection reads public traces, such as a HubSpot script from hs-scripts.com or a TXT record in DNS that mentions salesforce.com. - A detection shows a tool was seen, not what the company pays. HubSpot's tracking code is available on free plans too. - Enrich.chat checks one company's stack with /v1/company/tech and finds that tool's owners with /v1/company/people. It does not search by technology. - CAN-SPAM makes no exception for business email, and UK GDPR still covers a named person's work address. ## What is a "companies using" list? A "companies using" list names the businesses where one technology, such as HubSpot, Salesforce or AWS, was detected in public signals. Each technology page in this directory lists well-known companies where that tool was seen, grouped by sector. Each company links to its [email format](https://enrich.chat/email-format/) page when one exists, and each page names the people who usually run the tool. Teams use these lists for three jobs: - **Integration partners.** If your product plugs into a platform, that platform's users are your best-fit accounts. The [HubSpot Marketplace](https://ecosystem.hubspot.com/marketplace/apps) lists apps that connect to HubSpot, and Salesforce's [AgentExchange, formerly AppExchange](https://appexchange.salesforce.com/), does the same for Salesforce. A list of companies using the platform shows who could install your app. - **Competitive replacement.** If you sell an alternative, the companies running the rival product are the accounts to win. Lead with the cost and effort of switching, not a feature list. - **Account-based targeting.** A technology narrows a broad market to accounts that already work the way your product expects. Pair it with size, industry and location, the [firmographic data](https://enrich.chat/blog/firmographic-data/) that tells you whether an account fits. ## How is technology usage detected? Technology usage is detected from what a company shows the public internet: code on its website, headers its servers send, and records in its DNS. Each tool leaves a known trace, called a fingerprint. The open [Wappalyzer-format fingerprints](https://github.com/enthec/webappanalyzer) on GitHub show what these traces look like. | Signal | What a scan reads | Real fingerprint example | | --- | --- | --- | | Website code | Script URLs, JavaScript variables and cookies | A script from hs-scripts.com or a variable named `_hsq` means [HubSpot](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json) | | HTTP headers | The headers a server sends back with a page | An `x-amz-request-id` header points to [Amazon Web Services](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/a.json) | | DNS records | Public TXT, MX and NS records for the domain | A TXT record that mentions salesforce.com points to [Salesforce](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/s.json) | For the full method, with every signal type and its blind spots, read how the [tech stack lookup](https://enrich.chat/tools/tech-stack-lookup/) works. ## What does a technology detection not tell you? A detection tells you a tool's trace was visible when someone looked. It does not tell you what the company pays, how many people use the tool, or whether it is still there today. - **Public signals only.** Tools that run behind a login, such as ERP, HR or finance systems, leave nothing on the website. A tool missing from a list is not proof that the company does not use it. - **Results can be stale.** A list shows what was seen on the last check, and companies drop tools between checks. That is why [BuiltWith's Domain API](https://api.builtwith.com/domain-api) returns a first-detected and a last-detected date for each technology. - **No depth or spend.** HubSpot's [tracking code guide](https://knowledge.hubspot.com/reports/install-the-hubspot-tracking-code) lists the code as available on all products and plans, and HubSpot offers a [free CRM](https://www.hubspot.com/products/crm). The same script can mean free tools or an enterprise contract. Even [BuiltWith's API](https://api.builtwith.com/domain-api) labels whether a technology is a paid product as yes, no or maybe. - **One website, not every team.** A trace on the main website may come from the marketing team alone. Another division can run a different tool. **Figure 1: What one technology detection tells you.** One signal, acme.com loading a script from js.hs-scripts.com, means HubSpot was detected. It tells you the tool's code ran on the website, which vendor and category it is, and when a crawler last saw it. It does not tell you whether the company pays or uses free tools, how many seats or teams use it, whether it is still in use, or which tools run behind a login. *What a single detection proves and what it leaves open. Sources: the [open HubSpot fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json), [HubSpot's tracking code guide](https://knowledge.hubspot.com/reports/install-the-hubspot-tracking-code) and [BuiltWith's Domain API docs](https://api.builtwith.com/domain-api). The domain is an example.* Treat each detection as a reason to research the account. Confirm it before you build a pitch on it. ## How do you turn a "companies using" list into pipeline? Pick the accounts that fit, find the people who own the tool by job title, then verify each contact before you write. An AI agent can run all three steps with Enrich.chat from one prompt. **Figure 2: From technology signal to verified contact.** A four-step flow. First, a public signal: acme.com loads a script from js.hs-scripts.com, which means HubSpot. Second, the account list: keep the companies using HubSpot that fit your sector, size and region. Third, the tool owners: the Enrich.chat company people endpoint is called with the title marketing ops. Fourth, a verified contact: Jane Doe, head of marketing ops, with a work email marked verified. *The path from a technology signal to a contact you can email. Endpoints from Enrich.chat's [agent docs](https://enrich.chat/agents.md). The script pattern is from the [open HubSpot fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json). The company and person are examples.* ### 1. Pick the accounts Open a technology page and keep the companies that match your customer profile. To confirm a company still runs the tool, call `/v1/company/tech` with its domain. It returns the technologies found on that domain, each with a category. Enrich.chat's people search filters by title, seniority, industry, location and company size, but not by technology. So start from a technology page here, the [lead list builder](https://enrich.chat/tools/lead-list-builder/), or your own list of domains. ### 2. Find the tool's owners by title Call `/v1/company/people` with the domain and a job title. The right title depends on the kind of tool: | Category | Tools in this directory | Titles to ask for | | --- | --- | --- | | CRM | Salesforce | Salesforce admin, RevOps, sales operations | | Marketing automation | HubSpot, Marketo, Pardot | Marketing operations, demand generation | | Cloud, CDN and security | AWS, Cloudflare, Akamai | Platform engineering, DevOps, infrastructure, security | | Observability | Datadog, New Relic | SRE, platform engineering | | Payments | Stripe | Finance, payments engineering | | Support and messaging | Zendesk, Intercom | Support operations, customer experience | | IT and workplace | ServiceNow, Microsoft 365, Google Workspace, Atlassian | IT service management, workplace technology | ### 3. Verify every contact Each work email comes back with a status: `verified`, `catch_all` or `unknown`. Send to verified addresses and treat catch-all ones as risky. The [catch-all checker](https://enrich.chat/tools/catch-all-checker/) explains why. A lookup with `found` false uses 0 credits. ```text Use www.enrich.chat to check the tech stack for each company domain in this list and keep the ones that use HubSpot. At each one, find the head of marketing operations and return their verified work email. Flag catch-all emails as risky. ``` Behind the prompt, the agent makes requests like these: ``` GET https://enrich.chat/v1/company/tech?domain=acme.com GET https://enrich.chat/v1/company/people?domain=acme.com&title=marketing%20ops ``` Each IP address gets 10 free lookups a day. After that, you can pick a monthly plan on the [account page](https://enrich.chat/account/), where your API key appears too. Plans start at $29 for 100,000 credits, with unlimited seats and no annual contract. Credits are spent only on matches: a company tech stack found uses 5, each person returned by the company people endpoint uses 5, and a work email found uses 10. Nothing found uses 0. See [pricing](https://enrich.chat/pricing/) and the guide to [Enrich.chat for AI agents](https://enrich.chat/agents/). To enrich a list of people you already have, use the [people enrichment API](https://enrich.chat/api/person-enrichment/). ## How do you check whether one company uses a technology? Enter the company's website in the free [tech stack lookup](https://enrich.chat/tools/tech-stack-lookup/). It lists each technology it can see on the domain, with a category such as CRM, payments or CDN. You get 10 free lookups shared across the website tools, with no signup. From an AI agent or your own code, the `/v1/company/tech` endpoint returns the stack for a domain. Once you know the stack, the [email finder](https://enrich.chat/tools/email-finder/) gets the work email for one named person at that company. ## Can you request a technology that is not listed? Yes. Email hello@enrich.chat with the technology's name and its website, and tell us what you plan to use the list for. A website scan can only find tools that leave a public trace, such as a script, a header or a DNS record. Tools that run only behind a login cannot be detected this way. While you wait, check any single domain for that tool with the [tech stack lookup](https://enrich.chat/tools/tech-stack-lookup/). ## Is it legal to email companies on a technographic list? In the US and the UK, B2B email to these companies is allowed when you follow each country's rules. Business addresses are not exempt, and a named work address is still personal data in the UK. - **United States: CAN-SPAM.** The [FTC's CAN-SPAM compliance guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) says the law makes no exception for business-to-business email. Use honest headers and subject lines, identify the message as an ad, include a valid postal address, explain how to opt out, and honor opt-outs within 10 business days. Each email that breaks the law can draw a penalty of up to $53,088. - **United Kingdom: PECR and UK GDPR.** The [ICO's business-to-business marketing guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) says the PECR rule on marketing email does not apply to corporate subscribers, so you do not need their consent under PECR. You must not hide who you are, and you must give a valid address for opting out. Sole traders and some partnerships count as individuals, so they need consent or the soft opt-in. An address that names a person is personal data under UK GDPR, and that person has an absolute right to object to direct marketing. The ICO notes that this guidance is under review. Good practice goes further than the law. Mention the tool only when it changes your message, keep a suppression list, and stop at the first no. Enrich.chat users are responsible for following CAN-SPAM, GDPR and TCPA rules, and anyone can remove their data through the [opt-out page](https://enrich.chat/opt-out/). To learn how enrichment fits into the wider sales process, read [what data enrichment is](https://enrich.chat/blog/what-is-data-enrichment/). ## Frequently asked questions ### How do I find companies that use HubSpot? Open the HubSpot page in this directory. It lists well-known companies where HubSpot was detected, grouped by sector, with each company's email format. To check one domain, use the free [tech stack lookup](https://enrich.chat/tools/tech-stack-lookup/), which looks for traces such as the [HubSpot script from hs-scripts.com](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json). To get every website that runs a tool, reverse-lookup vendors sell lists, such as [BuiltWith's Lists API](https://api.builtwith.com/). ### Is a "companies using" list the same as a customer list? No. A vendor's customer list shows companies that agreed to be named, such as the stories on [HubSpot's case studies page](https://www.hubspot.com/case-studies) or [Salesforce's customer stories](https://www.salesforce.com/customer-stories/). A "companies using" list is built from the outside, from code, headers and DNS records, so it can include companies that never announced the tool. Neither list is complete. Use the vendor's list for proof points and the detection list for prospecting. ### Why do lists of companies using the same technology disagree? Each provider counts in its own way. Some count websites and others count companies. Some keep a tool on the list long after anyone last saw it, which is why [BuiltWith's Domain API](https://api.builtwith.com/domain-api) returns first-detected and last-detected dates. Free plans add noise too: HubSpot's [tracking code](https://knowledge.hubspot.com/reports/install-the-hubspot-tracking-code) is available on all plans, so a website count can include companies that do not pay. Compare the method, not just the total. ### Can Enrich.chat search for companies by technology? No. Enrich.chat's people search filters by title, seniority, industry, location, company size and domain, but not by technology. The company tech endpoint returns the tech stack for one domain at a time, so you can check a list of domains you already have, or start from a technology page in this directory. To ask for a technology we do not list yet, email hello@enrich.chat. The [agent docs](https://enrich.chat/agents.md) list every endpoint. ### Is it legal to send cold email to companies that use a technology? In the US and the UK, business-to-business cold email is allowed when you follow the rules. The [FTC's CAN-SPAM guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) says the law makes no exception for business email: identify yourself, include a postal address and honor opt-outs within 10 business days. The [ICO's B2B guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) says the PECR consent rule does not apply to corporate subscribers, but UK GDPR still covers named work addresses. ## Sources 1. [CAN-SPAM Act: A Compliance Guide for Business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) 2. [Business-to-business marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) 3. [webappanalyzer: open Wappalyzer-format technology fingerprints (README)](https://github.com/enthec/webappanalyzer) 4. [HubSpot fingerprint, src/technologies/h.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json) 5. [Amazon Web Services fingerprint, src/technologies/a.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/a.json) 6. [Salesforce fingerprint, src/technologies/s.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/s.json) 7. [Install the HubSpot tracking code](https://knowledge.hubspot.com/reports/install-the-hubspot-tracking-code) 8. [Free CRM software](https://www.hubspot.com/products/crm) 9. [BuiltWith Domain API documentation](https://api.builtwith.com/domain-api) 10. [BuiltWith API (Lists API)](https://api.builtwith.com/) 11. [HubSpot Marketplace: apps](https://ecosystem.hubspot.com/marketplace/apps) 12. [Salesforce AppExchange is now AgentExchange](https://appexchange.salesforce.com/) 13. [HubSpot case studies](https://www.hubspot.com/case-studies) 14. [Salesforce customer stories](https://www.salesforce.com/customer-stories/) ## Try this prompt Find who runs a tool at your accounts ```text Use www.enrich.chat to check the tech stack for each company domain in this list and keep the ones that use HubSpot. At each one, find the head of marketing operations and return their verified work email. Flag catch-all emails as risky. ``` ## Related - [Tech stack lookup](https://enrich.chat/tools/tech-stack-lookup/) - [Firmographic vs technographic data](https://enrich.chat/blog/firmographic-data/) - [Company email formats, A to Z](https://enrich.chat/email-format/)