How to Find Companies Using HubSpot or Salesforce (October 2026)

By Robert Fon / October 21, 2026

Most teams searching for “companies using HubSpot or Salesforce” run one query and expect one kind of answer, but the two platforms leave almost opposite footprints in public data. HubSpot is built to be seen by website visitors, so its tracking scripts, forms, and chat widgets show up in a standard website scan. Salesforce sits behind a login, so a script scan alone misses most Salesforce accounts, and the real evidence lives in DNS records, job postings, and other signals a URL crawl never touches. This guide shows how to query technology detection data for each platform, score what comes back, and use job openings to catch Salesforce accounts that scripts cannot see.

TLDR

• Finding companies using HubSpot is mostly a front-end detection problem: tracking scripts, embedded forms, and chat widgets show up in a routine website scan.
• Finding companies using Salesforce is mostly a behind_firewall problem: the core CRM has no public interface, so the evidence sits in DNS sender records, job postings, and the company’s own email authentication setup.
• A technology detection record is evidence that a signal was observed at a point in time, not confirmation of an active, paid license, so score every match by source_count and recency before you act on it.
• A technology that stops showing up is “no longer detected,” not “canceled.” Script changes, recrawl gaps, and signature updates can all produce the same gap.
• PredictLeads has logged 2B+ technology detections since 2018 across 240,000+ tracked technologies and 99M+ companies with technology data, built from five independent detection sources.

What Finding Companies Using HubSpot or Salesforce Actually Means

Finding companies using HubSpot or Salesforce means querying a technology detection dataset for evidence that each platform appears on a company’s website, in its DNS records, in its job postings, or in another public signal, not pulling a verified list of active software licenses. Every match is a timestamped observation, carrying a first_seen_at and last_seen_at date and a source_count showing how many independent signals support it. That timestamp matters more for these two platforms than for most technologies, because HubSpot and Salesforce sit at opposite ends of how visible a technology is from the outside.

Technographic data of this kind works the same way regardless of which CRM or marketing platform you are checking: it provides evidence of which technologies a company uses or has recently used, drawn from public sources, not a confirmed install list pulled from the vendor. For a broader look at how this category of data gets built across providers, see our comparison of technographic data providers. PredictLeads tracks this evidence across 240,000+ technologies and 99M+ companies with technology data, built from 2B+ detections logged since 2018.

HubSpot vs. Salesforce: Why One Is Easier to Detect Than the Other

HubSpot and Salesforce are both CRM-adjacent platforms, but they leave different trails in public data. HubSpot’s free and marketing-hub tiers are designed to be visible: tracking code, embedded forms, and live chat widgets all render in a browser, so a website scan picks them up directly. Salesforce’s core CRM has no public front end at all. What shows up instead are indirect traces: sender authentication records for outbound email, portal subdomains, and job postings that name the platform by requirement.

Signal	HubSpot	Salesforce
Website script tags and forms	Common: tracking code, embedded forms, chat widgets	Rare: no public front end for the core CRM
DNS records (SPF, CNAME)	Occasional: email-sending records	Common: sender authentication and portal subdomains
Cookies	Common: tracking and session cookies	Rare
Job descriptions	Occasional: marketing hire postings	Common: admin and developer postings name Salesforce directly
Typical behind_firewall value	Often false (visible website tag)	Often true (non-visible source)

That contrast is exactly what the behind_firewall field is built to flag. A false value generally means the detection came from a visible website tag, which is common for HubSpot. A true value means the evidence came from a source other than a public-facing script, which is common for Salesforce and for any enterprise tool that operates behind a login.

The Five Detection Sources Behind Every Match

PredictLeads builds every technology detection from one or more of five independent sources, and knowing which source produced a match tells you how much to trust it. For the full breakdown of how each method works, see how technographic data is collected.

• Website script tags: the embedded JavaScript, CSS, or HTML that a tool injects into a page, the main source for HubSpot’s visible widgets.
• DNS records: TXT, MX, NS, CNAME, SOA_MNAME, and SOA_RNAME entries, including the SPF records that reveal which email platform a company authorizes to send on its behalf.
• IP ranges: hosting and infrastructure ranges associated with a known vendor.
• Cookies: session and tracking cookies set by a tool’s script.
• Job descriptions: postings that name a technology as a required or preferred skill, often the only public trace of a tool like Salesforce.

Extended Technology Detections add a detection_source and detection_source_type (script_src, cookies, dom, keyword, and more) to each record, so you can see exactly which of the five sources produced a given match. For the general version of this workflow across any technology, not just these two, see how to detect a company’s technology stack.

How to Query the API for HubSpot or Salesforce Detections

Querying for HubSpot or Salesforce detections is a five-step process whether you are checking one company or scanning the market for every account running either platform. The full endpoint reference for this workflow is in our technology detection API guide.

Steps 1 to 3: Resolve, Query, and Read the Record

Step 1. Resolve the technology in the catalog with a fuzzy-name lookup: GET /technologies/hubspot or GET /technologies/salesforce against the base URL https://predictleads.com/api/v3. This confirms the technology ID and returns its category and pricing data from the Technologies catalog.

Step 2. Query the discovery endpoint for every company showing that technology: GET /discover/technologies/salesforce/technology_detections?page=1, authenticated with your X-Api-Key and X-Api-Token headers. Results are ordered by first_seen_at descending, and each discovery request typically costs 1 credit per record returned.

Step 3. Read the core fields on each record: first_seen_at, last_seen_at, behind_firewall, source_count, and the linked company reference. For more detail, call GET /extended_technology_detections/{id} to see the detection_source and detection_source_type behind that specific match.

Steps 4 and 5: Score and Deliver

Step 4. Score and filter the results using the tiers in the next section, weighting source_count and how recent last_seen_at is more heavily than the raw presence of a match.

Step 5. Deliver the filtered list to your stack. Pull it live through the API, schedule a bulk export to your warehouse through flat files, set up a webhook on the TechnologyDetectionsDataset to get pushed a new match the moment it is found, or query it conversationally through MCP at mcp.predictleads.com with a prompt like “Find companies using Salesforce hiring developers.”

Keep the rate limit in mind: the API allows 60 requests per second and returns a 429 with a Retry-After header if you exceed it, and a 402 if you exceed your monthly credit limit.

Scoring the Matches: Which Detections You Can Trust

Not every detection deserves the same confidence, so it helps to sort matches into three tiers based on source_count and recency. For more on why this matters across any technology, see technographic data accuracy: what most providers get wrong.

Tier 1: Corroborated

A detection with a source_count of two or more and a recent last_seen_at is corroborated: multiple independent sources agree the technology is in use right now. This tier supports a direct opener, for example referencing the specific tool by name in outreach.

Tier 2: Single-Source, Current

A detection from only one source but with a recent timestamp still means something was observed, just not confirmed by a second signal. Treat this tier as grounds for a qualifying question, not a factual claim.

Tier 3: Aging

A detection with an older last_seen_at and no recent reconfirmation may no longer reflect the company’s current stack. Use this tier for background research, and verify before citing it in outreach.

Tracking a Possible HubSpot-to-Salesforce Migration

A HubSpot detection that stops appearing, or a new Salesforce detection that appears alongside an existing HubSpot one, is not proof that a company has switched CRMs. Treat it as “no longer detected” rather than “dropped” or “canceled,” since a script change, a recrawl gap, or a signature update can all produce the same gap without any change on the company’s side.

Job postings add stronger supporting evidence of a possible transition, not confirmation of one. A company posting for a “Salesforce Administrator” role while an existing HubSpot detection is still active is a meaningfully stronger signal than either data point alone. PredictLeads classifies every posting with O*NET occupation codes across 279.2M+ job records logged since 2018, see how job openings data improves technographic accuracy, so you can pair a technology detection with a hiring signal from the same company before you reach out.

Connections data adds a third angle: when a company lists Salesforce or HubSpot on its own Integrations or Partners subpage, that relationship is captured as a connection record with a category of integration, sourced from the page itself rather than inferred from a script. Stacking a technology detection, a hiring signal, and a connection record gives you three independent reasons to believe a transition is underway instead of one.

How PredictLeads Delivers CRM Technology Detections

PredictLeads tracks technology evidence for HubSpot, Salesforce, and 240,000+ other technologies across 99M+ companies, built from 2B+ detections logged since 2018 across five independent sources: website script tags, DNS records, IP ranges, cookies, and job descriptions. Every record carries first_seen_at, last_seen_at, behind_firewall, and source_count, so you can apply the same tiering logic shown above to any technology in the catalog, not just these two.

The same company record also connects to Job Openings (279.2M+ records since 2018, classified by O*NET code) and Connections (371.8M+ relationship records since 2019, including integration and vendor categories), so a CRM detection, a hiring signal, and a partnership mention come from one API instead of three separate tools. If you plan to act on these signals directly inside your CRM, see how PredictLeads and Polytomic power GTM execution in HubSpot and Salesforce.

Method	How It Works	Best For
API	Query the discover or company endpoint in real time	On-demand lookups, enrichment at request time
Flat files	Scheduled bulk export of detection records to S3, GCS, or SFTP	Backfills and warehouse analysis in Snowflake or BigQuery, see our API vs. flat files vs. webhooks comparison
Webhooks	Push notification when a followed company’s TechnologyDetectionsDataset changes	Real-time alerting when a target starts or stops showing a signal
MCP	Natural-language queries at mcp.predictleads.com	AI agent workflows and conversational access

All of this is built from public sources only, including company websites, career pages, and DNS records, never gated or private data. PredictLeads is SOC 2 Type II certified and compliant with GDPR and CCPA, and delivers this data through API, flat files, webhooks, and MCP so you can pull it live, schedule a bulk export, get pushed a new match, or query it conversationally.

Final Thoughts on Finding Companies Using HubSpot or Salesforce

HubSpot and Salesforce sit at opposite ends of the same detection problem: one is built to be seen, and one is built to be used from the inside. Querying both correctly means reading the right source for each platform, scoring what comes back by source_count and recency, and pairing a technology detection with a hiring signal before you treat a possible migration as fact. The company list is only as useful as the evidence behind it. For the general version of this workflow across any technology in the catalog, see how to find every company using a technology by name.

Frequently Asked Questions

How do you find companies using HubSpot in 2026?

Query the PredictLeads Technology Detections dataset for HubSpot by resolving it in the Technologies catalog, then calling the discovery endpoint to list every company with an active detection. Most HubSpot matches come from website script tags, embedded forms, and tracking cookies, since the platform is built to be visible on the front end. Each match carries a first_seen_at and last_seen_at date and a source_count, so you can confirm the signal is recent before acting on it. PredictLeads has logged 2B+ detections since 2018 across 240,000+ technologies, HubSpot included.

Can you detect Salesforce usage if it never appears in a company’s website code?

Yes. Salesforce’s core CRM has no public front end, so most detections come from DNS sender-authentication records, portal subdomains, and job postings that name the platform rather than from a website scan. The behind_firewall field flags this: a true value means the evidence came from a source other than a visible website tag. PredictLeads combines five detection sources, including DNS records and job descriptions, specifically to catch tools like Salesforce that a script-only scan would miss.

What does the behind_firewall field mean in a technology detection record?

The behind_firewall field is a boolean that shows whether a detection came from a visible website tag or from another source. A false value generally means the technology was detected through website JavaScript or HTML, the common path for front-end tools like HubSpot’s forms and chat widgets. A true value means the evidence came from DNS records, job descriptions, cookies, or IP ranges instead, which is typical for enterprise software like Salesforce that runs behind a login. This distinction helps you judge how a match was found, not just whether one exists.

How fresh is HubSpot and Salesforce detection data?

High-traffic company websites are crawled multiple times daily, and every detection record carries a first_seen_at and last_seen_at timestamp so you can measure exactly how current a match is. Job postings, often the only public trace of Salesforce usage, refresh approximately every 36 hours across the Job Openings dataset. Webhooks can also push a notification the moment a followed company’s technology detections change, instead of waiting for your next scheduled pull. Always check last_seen_at before treating an older match as current.

Can PredictLeads tell when a company switches from HubSpot to Salesforce?

Not with certainty from a detection record alone. A HubSpot detection that is no longer appearing should be read as “no longer detected,” since script changes, recrawl gaps, and signature updates can all produce the same gap without a real switch. A new Salesforce detection, paired with a Salesforce-related job posting or an integration mention in Connections data, is stronger supporting evidence of a possible migration, but it still is not confirmation. Treat it as a reason to ask a qualifying question in outreach, not a fact to state outright.