Features
Salesforce cost and security intelligence — without the admin or the SOQL.
Every feature exists because something was broken before.
| Feature | Pain it removes | How it works |
|---|---|---|
| Cost-Saving Advisor | Idle seats and over-bought add-ons quietly renew every year because nobody audits them. | Ranks every licence and add-on opportunity by annual dollar impact, priced at your own invoiced rates once you upload an invoice — with step-by-step actions to reclaim each one. |
| Licence utilization | Paying for seats that haven’t logged in for 60+ days. | Purchased versus used by licence type, plus inactive and never-logged-in users with their last login date. |
| Actual annual spend | No single view of what Salesforce really costs — and list-price calculators overstate it. | Sums your real Salesforce invoices into a trailing-twelve-month figure, shows how far under list you already pay, and flags any balance outstanding. |
| Invoice reconciliation | Per-line rates exist nowhere but the invoice PDF. | Upload an invoice and every line is read out, matched against live licence utilization, and turned into your real per-seat cost including the add-ons that ride each seat — then applied to the estimate and the advisor in one click. |
| Contracts and renewal dates | Auto-renewal arrives before anyone has prepared for the negotiation. | Your Salesforce contracts with term dates, billing frequency, auto-renew status and the days left on each. |
| Security posture score | Security gaps stay invisible until an audit or an incident. | A 0–100 score rolled up from privileged-access, OAuth, login, permission and integration checks — with ranked fixes. |
| Privileged-access audit | Over-privileged profiles and permission sets accumulate silently. | Flags every user and permission set granting Modify All Data, View All Data or Manage Users — with last login. |
| Login and OAuth monitoring | Failed-login spikes, frozen accounts and stale OAuth grants go unnoticed. | Login history, failed-login trends, frozen and locked users, connected apps, named credentials and unused OAuth tokens. |
| AI Copilot in plain English | Every answer needs SOQL or the Report Builder. | Ask in plain English; the AI picks the right report from a reviewed, read-only query catalog — it never writes its own SOQL. |
| Multi-org and board-ready reports | Production, UAT and sandboxes each need separate tooling; reports mean screenshots. | Connect every org and switch in one click; export any view to CSV or PDF, or generate an executive report. |
| Names obscured by default | Licence and MFA reports are full of colleagues’ names and work addresses. | People are partially masked before anything reaches the screen, a CSV or a PDF, so a licence audit can go to finance without the staff directory. |
What makes it different
Real rates, read-only, and no injection surface
It reads what Salesforce actually invoiced you
Not a list-price model. Your real invoices are summed into a trailing-twelve-month figure and compared against list. Most tools in this space cannot see a negotiated rate at all.
It only ever reads
Every call is a SOQL SELECT — nothing created, changed or deleted, no Apex, no Metadata API, no package installed in your org. Connect it as a read-only user and Salesforce enforces that for you.
Your business data is not queried
No Account, Contact, Lead or Opportunity records, no files. What it reads is configuration — licences, profiles, permission sets, login history, OAuth grants and your Salesforce invoices.
The AI cannot be talked into a new query
The copilot chooses from a fixed catalog of reviewed, read-only SOQL, so there is no injection surface to review.
How it compares
Nothing marked absent that a competitor genuinely does
| Salesforce reports | Licence-management tools | Security posture tools | SF2BI | |
|---|---|---|---|---|
| Licence utilization | Build it yourself | Deep | No | Deep |
| Security posture score | Split across Setup | No | Deep | Deep |
| Cost and security in one view | No | No | No | Yes |
| Reads your actual invoices | No | No | No | Yes |
| Per-line rates from the invoice PDF | No | Varies | No | Yes |
| Plain-English questions | No | Varies | Varies | Yes |
| Read-only, no package to install | n/a | Varies | Varies | Yes |
Ask the copilot
Questions you can ask right now
- Which Salesforce licences haven’t been used in 60+ days, and what are they costing us?
- What did Salesforce actually invoice us over the last twelve months?
- Which contracts auto-renew, and how many days until each one does?
- Show me every user with Modify All Data and when they last logged in.
- Failed login attempts in the last 7 days, grouped by source IP.
- Which add-on licences are sitting idle?
- List connected apps with OAuth tokens that haven’t been used in 90 days.
- Which users are frozen or password-locked right now?
See where your Salesforce spend leaks — and who holds too much access.
Read-only. No package to install. 50K free tokens, no credit card.