MagicPill Labs · Discovery Audit
Tech Stack Audit
01 / 05
57 tools, scored against how you actually use them
- 3 Critical Apple Ecosystem · Alchemer · GoDaddy
- 36 High Sensitive data meets ungoverned access
- 16 Medium Controls exist, one gap to close
- 2 Low Device-only utilities, nothing to govern
Read this as 17 tools that need action first, not 39 fires. The scoring assumes the worst plausible plan tier wherever you have not confirmed one, so the shape is a statement about missing information as much as about risk.
18 of 57 tools can take an agent today
| Tool | API | Hooks | MCP | Zapier | n8n |
|---|---|---|---|---|---|
| Claude Business | |||||
| Microsoft 365 | |||||
| SharePoint | |||||
| NetSuite | |||||
| Shopify | |||||
| Docusign | |||||
| SurveyMonkey | ? | ||||
| Adobe Workfront | |||||
| Dropbox | |||||
| Mailchimp | |||||
| Hootsuite | |||||
| Blender | |||||
| CorelDRAW |
Every column is a way software can be driven automatically. The point is not the column names. It is that a third of your stack is already reachable, so the first automations need no new purchases.
27 things the business needs. Nine have no owner.
- 3 Fully covered
- 3 Thin or mixed
- 9 Paid for twice
- 3 Unclear owner
- 9 Nobody owns it
- When someone leaves, all 57 accounts get switched off by hand, one at a time
- Client business runs through WhatsApp and iMessage with no company record of it
- Three storage systems, and no rule about which one sensitive work belongs in
- Company files sync to staff members' personal Apple accounts
- No password manager, on a stack where most tools have no single sign-on
- Nothing stops a sensitive file from leaving the building
- A dozen AI features are switched on across the stack, and nobody is watching them
- No record of which vendors have actually agreed to protect your data
- Youth-facing work with no children's-data safeguard anywhere in the process
~$240K a year, and none of it was written down
$160–335K
Estimated range across all 57
$16–71K
Recoverable through consolidation alone
One account, three ways to lose a week
GoDaddy
No single sign-on · MFA unconfirmed
- Every email your company sends is authenticated by records held here
- Your website resolves through it
- Your domain itself is registered on it
This is what a risk finding looks like when you strip the jargon out of it. Not a vulnerability number, but a list of what stops working, and how many people it takes down with it.