SaaS discovery · spend reconciliation · AI attribution

Resolve every dollar
of software spend.

Axiom Layer reconciles software, device, contract, license, and AI usage evidence across finance, identity, cloud, DevOps, and RouteShift data — then turns each mismatch into an owned workflow.

Start free

Why Layer See pricing

Free to 25 employees
Read-only OAuth · no agents
First flag in ~5 minutes
How we handle data

Composite scenario. Names changed.

v 1.0 · Reconciliation ledger

Scope · identity, finance, usage

00The premiseWhy this exists

Every organization runs on software it has forgotten about.

Layer starts where procurement, SSO, expense data, and usage logs disagree. It maps OAuth grants, licensed seats, corp-card charges, hardware assignments, contract renewals, and RouteShift AI usage back to the owner who can act on them.

Axiom Layer is the instrument that resolves them. It connects to your SSO, finance system, billing tools, SaaS APIs, and asset records — then reconciles every charge against a real person, a real team, and a real pattern of use. If it survives reconciliation, it is owned. If it does not, it is drift.

Act I·The discovery

One employee. Three evidence trails. One owner that did not exist.

RouteShift's first scan with Layer surfaced the mismatch that finance, identity, and usage logs could not explain alone. The headline was not the count — it was the unresolved owner. Scroll the story.

01 / Subject

Meet Sarah Chen.

Software Engineer II at RouteShift. 18 months in. EMP-3318. Layer connects Brex, Okta, GitHub, RouteShift, and the connector catalog — then rebuilds her spend profile from evidence, not survey data.

02 / SaaS ledger

Her SaaS bill looked fine.

The known tools were on corporate workspaces, under existing owners, and tied to expected teams. Finance had charges. IT had SSO. Nothing looked urgent until usage entered the ledger.

03 / AI · the gap

Then Layer looked at her AI usage.

A model vendor was being reimbursed through receipts, but the workspace did not exist in SSO. No owner, no contract, no RouteShift budget policy, and no audit trail.

04 / Outlier

One vendor jumped out.

Layer matched the vendor charge to API activity and routed it as an outlier. The issue was not the tool; it was that spend, identity, and policy were split across three systems.

05 / Drilldown

Layer attributed every token.

Layer attributed billed requests, input, output, cache reads, project tags, and RouteShift policy context back to a single team. The vendor moved from "miscellaneous expense" to eng/ai.

06 / Signal

The owner was missing.

The workflow was legitimate, but the approval chain was not. Layer created the ownership trail finance, security, and engineering needed before the next billing cycle.

07 / Reconciled

All before standup.

Scan complete. The flag landed with the engineering manager, finance owner, and IT admin. By the next review, the workspace had SSO, budget policy, and a real cost center.

01020304050607scan · 04:18 UTC

RouteShift · Employee spend

Sarah Chen

Software Eng II·EMP-3318·resolved owner

Known SaaSOK

Owned

finance + SSO

AI · usageGap

Unowned

policy missing

1 · SaaS line itemsMonthly $

Notion·Business

$15.00

Linear·Standard

$14.00

Figma·Professional

$15.00

1Password·Business

$8.00

GitHub·Enterprise seat

$21.00

2 · AI · model usageMetered · 30d

Model vendor·API workspace

receipt

OpenAI·workspace

owned

Google·AI Studio

owned

Anthropic·Claude

review

Act II·The pattern

What looked like one outlier was the leading edge of a curve.

Layer rolled Sarah's drilldown up. The chart below is a sample of what came back: approved usage stayed visible, while unmanaged usage sat outside the policy lane. The coral line is where Layer raised a flag. The cyan line is what SSO would have caught — except SSO is not always where AI tools log in.

Engineering · AI spend · 6 mo

engineering · sample roll-up

Approved usage stayed flat while unmanaged usage escaped policy.

sample outlier · unmanaged

approved baseline

actual · all sourcesapproved · SSO + finance

Signals · what Layer saw

signals · ranked

The signals that proved it.

Mar 14

AI coding tool activated on engineering laptops via personal expense

MDM + finance evidence

Mar 22

Model API workspace billed to corp cards · no SSO link

expense receipt + identity gap

Apr 02

Usage spike tied to one project, owner unresolved

API metering + RouteShift policy

Apr 18

Rate-limit warnings appeared outside the approved workspace

usage webhook · team review

May 04

Unowned AI spend routed to finance, IT, and engineering

Layer reconciliation · finance ↔ usage

The pattern Layer found

Engineering AI spend wasn't growing linearly. It was growing in step functions — every time a new model dropped, one engineer would adopt it on their personal card, then twenty. SSO never saw it. Finance saw aggregate spend but couldn't attribute it. Layer joined the two.

The pattern you have

Probably the same. some engineering AI spend is unattributed until finance, identity, and usage are reconciled. Layer surfaces it in your first scan — and keeps surfacing it as new tools land. The instrument doesn't care whether it's AI, design tools, or productivity. It cares whether it survives reconciliation.

Act III·The reconciliation

Three sources of truth. One ledger. One action.

Layer's job isn't to flag — every dashboard flags. Layer's job is to resolve. Each vendor gets matched against the finance ledger, the identity provider, and the SaaS itself. The axiom is whatever all three agree on.

Source · finance

Brex · vendor ledger

Anthropic, Inc.$1,846.70

CardholderSarah Chen

Card··3318

Charge date04 May 26

GL code6020 · SaaS

Verified · 1 / 3

Source · identity

Okta · sign-in log

Anthropic consolenot configured

Workspace—

SSO domainmissing

Last sign-in—

Coverage0%

Missing · 0 / 3

Source · vendor

Model vendor · usage API

Accountsarah.chen@…

PlanAPI workspace

Spend, 30dmatched

Requestsmetered

Usagetracked

Verified · 2 / 3

↳ Result

Vendor confirmed. Spend matches between finance and vendor. Identity is missing — Anthropic is paid for but not under SSO. Layer's recommended action: enroll Anthropic in Okta, convert the personal-card subscription to a workspace plan, and reclassify $1,846.70 from Sarah's expense to Eng AI tools.

Apply · 1 click

What Layer just did

Joined three independent sources of truth in real time. Confirmed a vendor exists, confirmed how much is being paid, confirmed exactly what is being consumed — and surfaced the one gap that mattered: nobody owns this. A finance dashboard would have shown the charge. An SSO dashboard would have shown nothing. Layer shows both, and what they imply together.

What you'd do next

Click Apply. Layer routes the workflow to IT for SSO enrollment, to the cost center owner for re-classification, and to Sarah for the workspace migration. The audit trail is automatic. The next time the same pattern shows up — and it will — Layer applies the same fix without asking.

Axiom Layer is the system of record for software spend — reconciling finance, identity, and usage into a single ledger you can audit, attribute, and act on.

Evidence surfaces reconciled: finance, identity, usage, contracts, devices, RouteShift

Endpoint agents required for the first SaaS and spend scan

Owner paths: IT, finance, and the accountable team

Connectors across identity, finance, cloud, DevOps, HRIS, and MDM

04The connectors62 sources · 35 one-click

We pull from every source a charge can hide in.

62 integrations across identity, MDM, mail, finance, cloud, DevOps, and HR. The 35 one-click OAuth connectors link in seconds and unlock deeper reconciliation — the rest connect by read-only API key. Discovery stays read-only throughout: Layer observes, never writes back. No agents, no service-account sprawl.

One-click OAuth · deeper access (35)API key · read-only sync (27)

OAUTHOKOktaIdentity

OAUTHENMicrosoft Entra IDIdentity

OAUTHGWGoogle WorkspaceIdentity

OAUTHOLOneLoginIdentity

OAUTHJCJumpCloudIdentity

OAUTHPIPing IdentityIdentity

OAUTHDUDuoIdentity

OAUTHOSOkta SSOSSO

OAUTHGSGoogle SSOSSO

OAUTHSAGeneric SAMLSSO

OAUTHGMGmailMail

OAUTHM3Microsoft 365 MailMail

OAUTHINMicrosoft IntuneMDM

JFJamfMDM

KJKandjiMDM

MOMosyleMDM

HXHexnodeMDM

ADAddigyMDM

CSCrowdStrikeSecurity

S1SentinelOneSecurity

TNTaniumSecurity

QLQualysSecurity

OAUTH1P1PasswordSecurity

LVLevelEndpoint

BXBrexFinance

RPRampFinance

QBQuickBooksFinance

OAUTHXOXeroFinance

NSNetSuiteFinance

BLBill.comFinance

EXExpensifyFinance

STStripeFinance

OAUTHGCGoogle CloudCloud

OAUTHAZMicrosoft AzureCloud

AWAWSCloud

CFCloudflareCloud

DODigitalOceanCloud

OAUTHGHGitHubDevOps

OAUTHGLGitLabDevOps

OAUTHBBBitbucketDevOps

OAUTHJRJiraDevOps

OAUTHLNLinearDevOps

OAUTHSNSentryDevOps

DDDatadogDevOps

PDPagerDutyDevOps

OAUTHSLSlackCollaboration

OAUTHMTMicrosoft TeamsCollaboration

OAUTHZMZoomCollaboration

OAUTHNONotionCollaboration

OAUTHCNConfluenceCollaboration

OAUTHASAsanaCollaboration

OAUTHFGFigmaCollaboration

OAUTHDBDropboxCollaboration

OAUTHBOBoxCollaboration

OAUTHZDZendeskCollaboration

OAUTHRIRipplingHRIS

OAUTHGUGustoHRIS

WDWorkdayHRIS

BHBambooHRHRIS

DLDeelHRIS

NWNetwork scanNetwork

MECisco MerakiNetwork

Identity (7)SSO (3)MDM (6)Endpoint (1)Security (5)Mail (2)Finance (8)Cloud (5)DevOps (8)Collaboration (10)HRIS (5)Network (2)

05The intelligenceIllustrative sample data

See every dollar. Reconcile every app.

Discovery closes the shadow-IT gap month over month. AI spend attribution shows exactly which providers burn your budget.

Shadow IT discovery — apps found vs managed

Illustrative sample: discovered apps rise from 34 to 134 over twelve months while managed apps climb from 12 to 127, closing the shadow-IT gap.

Discovered versus managed apps by month, illustrative sample data
Jan	34 discovered	12 managed
Feb	41 discovered	18 managed
Mar	52 discovered	27 managed
Apr	61 discovered	35 managed
May	73 discovered	48 managed
Jun	89 discovered	62 managed
Jul	97 discovered	74 managed
Aug	108 discovered	85 managed
Sep	119 discovered	96 managed
Oct	126 discovered	108 managed
Nov	131 discovered	118 managed
Dec	134 discovered	127 managed

AI spend by provider — $/month

Illustrative sample: monthly AI spend led by OpenAI at $4,200, followed by Anthropic at $3,100 and Google at $1,800.

06Why LayerVersus the status quo

Spreadsheets describe. Suites surveil. Layer reconciles.

Most teams track software in a spreadsheet that rots, or buy an enterprise suite that taxes every connector and needs services to onboard. Layer takes the middle that actually holds: every connector on every plan, evidence from finance, identity, and usage — and each mismatch routed to an owner.

What each approach gives you · generalized patterns, not vendor quotes
Capability	Axiom Layer	Spreadsheets	Enterprise suite
Unlimited connectors on every paid plan	Included	Manual	Per-connector or tiered
Read-only OAuth · zero endpoint agents	Included	—	Varies by connector
Finance × identity × usage reconciliation	Included	Manual	Partial · SSO-centric
AI token spend attributed to team & project	Included	Manual	Add-on or absent
Renewal calendar with owner & deadline routing	Included	Manual	Included
Contract terms extracted from uploads	Included	Manual	Varies
Duplicate-tool & license-waste flags with Apply workflow	Included	—	Flags · services remediation
Audit trail on every resolution	Included	Manual	Included

Methodology · reviewed September 2026

The Layer column is verified against the product surface named per row. Spreadsheet and enterprise-suite columns describe generalized patterns from public vendor packaging and docs — not quotes. Verify everything else against current vendor packaging before deciding.

Unlimited connectors on every paid plan — Layer pricing and billing plan source
Read-only OAuth · zero endpoint agents — Trust page and enforced Tier-1 boundary
Finance × identity × usage reconciliation — Reconciliation ledger product surface
AI token spend attributed to team & project — RouteShift metering joined to finance
Renewal calendar with owner & deadline routing — Renewals product surface
Contract terms extracted from uploads — Contract upload and extraction flow
Duplicate-tool & license-waste flags with Apply workflow — Spend opportunities engine
Audit trail on every resolution — Action and access audit log

07The mathIllustrative · your inputs

What does drift cost you?

Move the sliders to your stack. The estimate assumes a share of seats carry unused or duplicate spend — Layer's first scan replaces the guess with evidence.

Employees120

Unused or duplicate spend · $/seat/mo$24

Seats affected · %18%

Model: employees × $/seat × affected share × 12 mo. Range shows ±30% to keep it an estimate, not a quote.

Employees — headcount Layer would keep honest.
$/seat — unused or duplicate spend per affected seat.
Affected share — seats carrying that waste today.

Assumptions reviewed September 2026. Estimated until your first scan replaces them with observed apps, owners, and renewal dates.

Illustrative recoverable · /yr

$4,351–$8,081

≈ $518/mo midpoint logic

Your first scan replaces this range with named apps, owners, and renewal dates — or confirms there's nothing to recover.

Start free See pricing

08PricingStart free · scale later

Priced per headcount. No per-connector tax.

Every paid plan reconciles the full stack — unlimited connectors included. Free starts with Google Workspace and your first 50 apps.

Free

Up to 25 employees
Google Workspace connector
First 50 discovered apps
Weekly digest reports

Get started free

Starter

$299/mo

Up to 50 employees
All connectors
Full reconciliation suite
Email alerts & CSV export

Start free trial

Spend control, plus compliance — on the same reconciled data.

Axiom Layer is the system of record. Pair it with Axiom Codex and the connections Layer already maintains auto-evidence SOC 2, ISO 27001, HIPAA, and PCI DSS controls — no second integration pass.

You are here

Axiom Layer

IT asset & spend reconciliation

SaaS discovery, hardware tracking, license management, contract extraction, shadow-IT detection, and spend attribution — all from read-only OAuth.

Axiom Codex

Compliance automation

SOC 2, ISO 27001, HIPAA, and PCI DSS on autopilot. Uses live data from Layer to satisfy controls and generate audit-ready evidence.

axiomcodex.io →

10QuestionsEverything else

The things people ask before they connect.

Axiom Layer is the system of record for your software stack. It discovers every SaaS subscription, hardware device, OAuth grant, and license, then reconciles each charge against finance, identity, and usage — so you can see exactly what you run, who owns it, and what it costs.

11 · Get started

Run your first reconciliation in five minutes.

Connect Okta, Brex, and one SaaS API. Layer surfaces your version of Sarah Chen on the same day — and the pattern behind her by the end of the week. No procurement. No deployment. No agents.

Start free →

OpenAI	$4,200 per month
Anthropic	$3,100 per month
Google	$1,800 per month
AWS	$1,200 per month
Copilot	$900 per month
Other	$400 per month

The premise: forgotten software runs every organization