Start for free Start for free

Shadow IT

Shadow IT is software or online services people use for work without the company knowing or approving it. Each one is a vendor nobody reviewed, with terms someone accepted for the company and nobody read.

What is shadow IT?

Shadow IT is any software, app or online service that people at your company use for work without the company knowing or approving it. Common examples are a free file-sharing account, a browser extension, a note-taking app, a scheduling tool or an AI assistant someone signed up for with their work email.

Most shadow IT is not bad intent. Someone needed to get a job done, the tool was free or cheap, and signing up took two minutes. The problem is what happened in those two minutes: they clicked "I agree" to the vendor's Terms of Service and privacy policy for the company, and nobody read them.

That makes every shadow IT tool a vendor you have not reviewed. It is not on your vendor inventory, it has no owner, and its terms apply to whatever data people put in. NIST's Cybersecurity Framework expects "Suppliers are known and prioritized by criticality" (GV.SC-04). A tool you do not know about cannot meet that.

A fast-growing subset is shadow AI: AI tools used without approval, where the main question is whether the tool trains on what people paste into it.

What it looks like in a vendor's terms

Self-serve terms often say the person who signs up is agreeing for their company. A typical clause reads like this:

If you use the Services on behalf of an organization, you agree to these Terms for that organization and confirm that you have authority to do so. Free plans are provided as is, and we may use content you submit to improve our services.
  • "On behalf of an organization" means one employee's click may commit your company to the terms.
  • "Confirm that you have authority" puts the question of who was allowed to agree on you, not the vendor.
  • "Provided as is" is a warranty disclaimer: the vendor promises nothing about quality or uptime.
  • "Use content you submit to improve our services" can include training AI models on your data.

A real change we caught

Free and self-serve tools change their terms too, and nobody gets the email. Venpo flagged that Lovable now trains its AI on your prompts and code by default. Since September 2026, prompts and code on Free and Pro plans train its models unless someone opts out. If an engineer signed up on their own to try it, your code could fall under that default without anyone at the company knowing the tool was in use.

Other examples show how much a click can carry: Apollo's new Terms let it scan the inbox you sync, and Grafana's new site terms say that using its website means agreeing to arbitration, a private process that replaces going to court.

Why it matters to you

Customer data in unknown places. If someone uploads a customer list or support tickets to an unapproved tool, that tool now holds your customers' data. It is not in your DPA, not on your own subprocessor list and not covered by any review.

Broken promises to customers. Your own contracts may list the vendors that handle customer data. Shadow IT can make that list wrong.

Audit findings. A SOC 2 auditor may test whether your vendor list is complete. Shadow IT is exactly what a complete list misses.

Cost. Small subscriptions on personal cards add up, and the same tool often gets bought twice by different teams. This feeds SaaS sprawl.

What to check

  • Spending: review company card statements and expense reports for software you do not recognize.
  • Login connections: list the apps people have connected to your Google Workspace or Microsoft account with "Sign in with" buttons or data access grants.
  • Browser extensions and AI tools: ask teams directly what they use. A short, no-blame survey finds more than a policy does.
  • Terms of anything you find: check whether it trains on your data, how long it keeps data, and whether it binds the company.
  • A quick approval path: make it easy to request a tool, so people do not route around the process.

How Venpo helps

Once you find a shadow IT tool and decide to keep it, add it to Venpo. The Fine Print Scan answers four questions about it (does it train AI on your data, how long does it keep data, does it sell data or use it for ads, can it raise prices), and Venpo emails you a plain-English alert when its terms, privacy policy or subprocessor list change.

Start for free

Frequently asked questions

Is shadow IT always bad?

No. It often shows a real need that approved tools do not meet. The risk is the unreviewed terms and data, so the goal is to find these tools and either approve, replace or remove them.

How do I find shadow IT without expensive software?

Start with card statements, expense reports and the apps connected to your company login. Then ask teams directly what they use, without blame.

Can an employee agree to software terms for my company?

Many self-serve terms say the person signing up confirms they have authority to bind their organization. Whether that holds depends on the facts and the law that applies, so treat any tool in use as one whose terms may apply to you.

What is the difference between shadow IT and shadow AI?

Shadow AI is shadow IT that involves AI tools. The extra concern is that what people paste in may be used to train the vendor's models.

Related terms

AI and Your Data Shadow AI Shadow AI is any AI tool people use for work without the company knowing or approving it, such as personal chatbot accounts, browser extensions, note-takers or AI features turned on without review. Vendor Management SaaS Sprawl SaaS sprawl is when a company ends up with more software subscriptions than it can track. Each tool brings its own terms, privacy policy, renewal date and access to your data, so cost and risk pile up unseen. Vendor Management Vendor Inventory A vendor inventory is one list of every company you buy from, with an owner, the data it handles, its risk tier, links to its legal documents and its renewal date. It is the starting point for managing vendor risk and for a SOC 2 audit. Vendor Management SaaS Management SaaS management is the practice, and the category of tools, for tracking which software subscriptions a company has, who uses them and what they cost. It covers licenses, spend and renewals, which is a different job from reading what each vendor's legal terms say. Terms Changes Clickwrap Agreement A clickwrap agreement is an online contract you accept by clicking "I agree" or ticking a box next to the terms. Courts typically enforce it when the terms were clearly shown. AI and Your Data AI Training on Customer Data AI training on customer data is when a vendor uses the information you put into its product, such as files, prompts and AI answers, to teach or improve its AI models.

Sources

Last reviewed