The Invoice That Never Arrives: Auditing the Free Tools Your UK Team Actually Relies On
Every small UK tech team has one. A tool that started as a quick fix — a free Trello board for a client project, a Notion workspace for the ops manual, a free CRM that now holds every sales lead since 2023. No invoice, no purchase order, no procurement questionnaire. Just a sign-up form and a box someone ticked without reading.
Free tiers feel frictionless because nobody asks for a budget line. But they are still contracts. The vendor sets the terms, changes the limits, and can suspend the account. The data inside is still your data, and if it includes personal information, you are still the controller under UK GDPR. The only thing missing is the paperwork that would have forced someone to think about it.
Start with the receipts you do have
Since there's no invoice, look for other traces. Check shared folders in your password manager. Search browser saved logins. Open the connected-apps list in Google Workspace or Microsoft 365 — free tools often ask for access to email or files and never get revoked. Search inboxes for 'your free trial ends soon'. Look at Slack channels named after tools, calendar invites for demos, and the notes from that hack day in 2024. Then ask each person a simple question: what did you sign up for with your work email in the last two years?
Put the answers in a spreadsheet with columns for the tool, what it does, who uses it, who owns the account, what data it holds, the admin email, whether it uses SSO or a personal login, the free-tier limits, and how critical it is. You are not trying to build an asset register. You are trying to find the tools nobody owns.
The real risk isn't the price — it's the data
Free tiers often live in personal accounts. The marketing manager's free Canva, the developer's personal GitHub, the founder's Google Drive. If that person leaves, the account and the data go with them. Worse, if the tool holds client files or personal data, you need a data processing agreement. Many free tiers don't offer one, or hide it behind a paid plan. Check the vendor's terms: where is data stored? Can you export it? What happens after 30 days of inactivity? Is there a sub-processor list?
If the tool holds customer names, emails, project details or survey responses, it is in scope for UK GDPR. A free survey tool collecting responses from the public is processing personal data — the same rules apply as for a paid one. The fact that no money changed hands does not change your obligations.
Admin access: who holds the keys?
List the account owner for each tool. If it is a personal email, that is a red flag. Move ownership to a role-based address such as ops@ or admin@, or a shared password manager entry with two-factor authentication. Check who has admin rights — often everyone, because it was easier at the time. Free tools have limited admin controls: you may not be able to remove a departed user without deleting their data. Test that before you need it. Also revoke OAuth tokens for free apps that can read email or files but are no longer used. A forgotten integration is still a live connection.
Read the limits, then diarise them
Free tiers are not infinite. Seat caps, record limits, automation quotas, API calls, storage, version history, support. The trap is the upgrade moment: you hit a limit mid-project and the only way forward is a card payment at the on-screen price. Some free plans are grandfathered — they exist until the vendor changes them. Others delete data after a period of inactivity. Does the tool let you export everything in a useful format, such as CSV, JSON or a ZIP archive? If not, you are renting, not owning.
Put a review date in the calendar for each tool: check limits and terms every six months. Better still, link it to the renewal calendar you already keep for paid software. Free tools drift; a date on the calendar stops the drift from becoming a surprise.
Decide: contract, budget line, or exit
After the inventory, sort each tool into one of three buckets. Proper contract: it holds personal data or runs a critical process. Buy the paid tier that includes a data processing agreement, admin controls, export and support. Put it through procurement, even if it is £10 a month. Budget line only: useful but low-risk. Assign an owner, add a small annual budget for the paid tier, and review yearly. Exit plan: no clear owner, no export, no data processing agreement, or it duplicates something you already pay for. Migrate the data, close the account, and confirm deletion. Do not just abandon it — dormant accounts are still attack surface.
A 90-minute audit for this week
Block the time. Step one: list every free tool you can find using the traces above (20 minutes). Step two: mark each one red, amber or green on data sensitivity and admin risk (20 minutes). Step three: open the terms page for each red tool and search for 'data processing', 'export', 'termination' and 'price change' (30 minutes). Step four: book a 20-minute decision meeting with one person who can say yes to a contract or a budget line.
The output is not a ban on free tools. It is a short list of tools that need a proper home, and a shorter list that need to go. The point is not to stamp out the free tier. It is to put a seal on the ones you rely on — a contract you have actually read, a budget line you can see, and a date to review it. Free is not frictionless. It is a contract with a landlord who can change the locks. The audit is how you find out which doors you are actually renting, and which ones you should own.
