Checking company websites one at a time to see who uses HubSpot or Salesforce is sampling, not list building. To find companies using HubSpot or Salesforce at scale, you query a technology detection API by technology name and get back the domains where that technology has been detected, with timestamps and source evidence attached to every record. The complication is that these two CRMs leave very different public traces, so a website-only crawler finds one and misses most of the other. This guide covers how to query CRM technology detections through an API, how to read the fields that tell you how strong each piece of evidence is, and how to turn the response into a prioritized account list.
TLDR:
- You find companies using HubSpot or Salesforce by querying a technology detection API by technology name, not by crawling sites individually or buying a static export.
- HubSpot is comparatively easy to detect from the public front end because its tracking code, forms, and CMS hosting leave visible traces. Salesforce is harder, because the core CRM sits behind a login.
- Every detection carries
first_seen_at,last_seen_at,source_count, andbehind_firewall, which is what separates strong evidence from a single weak hit. - Job descriptions are the highest-value source for enterprise CRM evidence: a company hiring a Salesforce administrator tells you something no script scanner can see.
- PredictLeads has recorded 1.5B+ technology detections since 2018 across 95M+ domains and 50,000+ tracked technologies, delivered via API, flat files, webhooks, and MCP.
What “Finding Companies Using HubSpot or Salesforce” Actually Means
Finding companies using HubSpot or Salesforce means querying a technology detection dataset for evidence that a given domain uses, or has recently used, that CRM. That word “evidence” is doing real work. A technology detection is a timestamped observation from a public source, not a read of a company’s internal software inventory. Treating it as the latter is how account lists get built on assumptions that fall apart on the first call.
The practical difference shows up in how you write the pitch. A detection with five supporting sources over 18 months supports a confident opening line. A detection from one keyword match in a single job post supports a question, not a claim. Both are useful. They are not the same signal, and an API that returns them as one undifferentiated boolean is hiding the thing you most need to know.
This is also why “companies using HubSpot” and “companies using Salesforce” are different data problems rather than the same query with a different string. Where a CRM lives in a company’s architecture determines what it leaves behind in public. For the broader category view, see our guide to the best technographic data providers.
Why HubSpot Is Easier to Detect Than Salesforce
HubSpot advertises itself in a company’s front-end code, and Salesforce mostly does not. That single asymmetry explains most of the coverage gaps you will see between technographic providers on CRM data.
HubSpot’s public footprint is wide
HubSpot’s product design pushes it toward the browser. The analytics tracking code loads external JavaScript, and HubSpot’s own documentation on verifying the tracking code describes the script domains a page request will show. Embedded forms, chat widgets, and meeting links add more. Sites hosted on HubSpot’s CMS resolve through a CNAME to a HubSpot-controlled hostname. Any of these is visible to a crawler that never authenticates into anything.
Salesforce’s front end is thin by design
Salesforce is a system of record that sales and service teams log into. A prospect browsing the marketing site usually touches none of it. What does surface is peripheral: email authentication records, since Salesforce documents an include:_spf.salesforce.com entry in its sender authentication guidance; customer portals and community sites on Salesforce-owned hostnames; and, most reliably, the job market. Companies staffing a CRM tell you about it in their careers page long before they mention it anywhere else.
| Detection surface | HubSpot | Salesforce |
|---|---|---|
| Website script tags | Common: tracking code, forms, chat | Uncommon: core CRM sits behind login |
| DNS records | CMS hosting CNAME, email records | SPF includes, portal and community hostnames |
| Cookies | Set by the analytics and chat scripts | Rare on the public marketing site |
| Job descriptions | Named in marketing and RevOps roles | Strongest source: admins, architects, developers |
Typical behind_firewall | Often false (front-end tag) | Often true (non-front-end evidence) |
The takeaway is blunt: if your provider only reads website markup, your Salesforce list will be a small and biased subset of the real one. PredictLeads records detections from five source types across 95M+ domains, which is what makes the enterprise half of this question answerable at all.
The Five Sources Behind a CRM Detection
A technology detection is only as trustworthy as the number and type of sources that produced it. PredictLeads assembles detections from website script tags, DNS records, IP ranges, cookies, and job descriptions, then attaches the evidence trail to the record rather than collapsing it into a yes or no.
The field that matters most for CRM work is behind_firewall. It is a boolean, and false means the detection came from a website JavaScript or HTML tag. Anything else, including the job-description route that surfaces enterprise tools, is where the enterprise coverage lives. Alongside it, seen_on_subpages, seen_on_job_openings, and seen_on_dns_records tell you which surface produced the observation, and Extended Technology Detections adds detection_source and detection_source_type so you can see the exact script, cookie, header, or keyword behind the call.
Job descriptions deserve their own note. A posting requiring three years of Salesforce administration experience is public, dated, and specific, but it is evidence, not a receipt. It may indicate current usage, a planned rollout, a migration in progress, client work at an agency, or nothing more than a hiring manager’s wish list. Read it as one strong input among several. We go deeper on this in our breakdown of job openings data as a technographic source and on the wider set of technographic data collection methods.
How to Find Companies Using HubSpot or Salesforce via API
The workflow is five steps. Two of them are the API calls, and three of them are the judgment that turns a raw response into a list worth working.
Step 1: Resolve the technology
Start in the Technologies catalog so you are querying a known entity rather than a guessed string. The endpoint accepts a fuzzy name.
curl --request GET \
--url 'https://predictleads.com/api/v3/technologies/hubspot' \
--header 'X-Api-Key: {your_api_key}' \
--header 'X-Api-Token: {your_api_token}'The catalog record returns the technology’s name, description, categories and parent categories, domain, and pricing_data with min_usd, max_usd, average_spend, interval, and tags such as enterprise or freemium. That pricing block is quietly useful: it is the difference between “they use a CRM” and “they use a CRM in a spend tier that matches our deal size.”
Step 2: Query the discover endpoint
Now ask for the companies. This is the call that produces the list.
curl --request GET \
--url 'https://predictleads.com/api/v3/discover/technologies/salesforce/technology_detections?page=1' \
--header 'X-Api-Key: {your_api_key}' \
--header 'X-Api-Token: {your_api_token}'Results come back ordered by first_seen_at descending, so the newest evidence is on page one. Most endpoints return up to 1,000 results per page and you walk the set with the page parameter, with count included in meta once page is present. Space your requests: the rate limit is 60 requests per second, a 429 arrives with a Retry-After header, and a 402 means you have hit the monthly credit limit. Full parameter detail sits in the Technology Detections endpoint documentation, and you can try calls without writing code in the SwaggerUI playground.
Running the same query in reverse works too. If you already hold a list of target accounts, call GET /companies/{domain}/technology_detections per domain and check whether either CRM appears, which is the shape most enrichment pipelines want. Our walkthrough on how to detect a company’s full tech stack covers that direction in detail, and the generic version of the discovery query is in how to find every company using a technology by name.
Step 3: Read the record fields
Every detection returns the company and technology references plus first_seen_at, last_seen_at, score, source_count, behind_firewall, department_onet_codes, location_data, and the seen_on_* flags. One more field earns attention on CRM lists: competitive_technology_detections, which surfaces detections of competing technologies at the same company. A domain showing evidence of both HubSpot and Salesforce is not a data error. It is usually marketing on one and sales on the other, and that is a specific conversation.
Steps 4 and 5
Scoring and delivery are substantial enough to get their own sections below. Everything above this line is mechanical. Everything below it is where lists stop being equal. PredictLeads exposes all of this through a single API covering 1.5B+ detections since 2018, with 59M+ new detections recorded in the last month.
How to Score a CRM Detection List Before You Send Anything
Rank the list by evidence strength, not alphabetically by domain. Three tiers cover almost every case, and each one supports a different opening.
| Tier | Field pattern | What it supports |
|---|---|---|
| Tier 1 Corroborated | source_count of 2 or more, recent last_seen_at, both seen_on_subpages and seen_on_job_openings present | A direct, specific opener. Reference the stack by name. |
| Tier 2 Single-source, current | source_count of 1, recent last_seen_at, often behind_firewall true from a job description | A question, not a claim. Good for discovery calls and nurture. |
| Tier 3 Aging | last_seen_at not refreshed across recent crawls | Research, not outreach. Treat as no longer detected, nothing stronger. |
Layer tenure on top of the tiers. Because first_seen_at is stamped on every record, you can sort Tier 1 accounts by how long the evidence has been continuous. A company where a competing CRM was first detected 10 to 11 months ago is approaching a common annual renewal window, which is a materially better moment for a displacement conversation than month three. That single sort is often worth more than doubling the list size, and it is only possible because the data is point-in-time rather than a current-state snapshot. Our post on technographic data accuracy covers how to sanity-check tiers against your own closed-won data.
Reading Migration Signals Without Overclaiming
A missing detection is not a cancelled contract. If a HubSpot detection stops refreshing, the honest statement is that the technology has not been detected since a specific date, and there are several ordinary explanations: the company changed a script, a vendor changed a signature, a page moved behind an interstitial, or a recrawl simply has not landed yet. Writing “we noticed you dropped HubSpot” on that basis is the fastest way to lose a reply.
What raises confidence is a second, independent signal pointing the same direction. If a HubSpot detection goes quiet and the same company posts three roles requiring Salesforce administration in the following weeks, that is stronger supporting evidence of a possible transition. It is still not confirmation. Frame outreach as an observation you are curious about rather than a fact you are asserting, and the conversation stays open either way. The same discipline applies to infrastructure moves, which we cover in finding companies migrating to cloud data warehouses.
PredictLeads keeps both ends of the timeline on every record, so you can measure the gap between last_seen_at and today rather than inferring it from a refreshed export that quietly overwrote last quarter’s state.
Delivering the List Into Your Stack
How you receive CRM detections should match how you plan to act on them. Four delivery methods cover the realistic cases.
| Method | How it works | Best for CRM detection work |
|---|---|---|
| API | Request-time lookups with an API key and token | Enriching a record the moment a lead enters the pipeline |
| Flat files | Bulk JSONL delivery to S3, Google Cloud Storage, or SFTP | Loading a full CRM-user universe into Snowflake or BigQuery |
| Webhooks | Push notifications on new data for companies you follow | Alerting when a new CRM detection appears at a named account |
| MCP | AI agents query the dataset conversationally | Ad hoc research and agent-driven qualification |
For teams that prefer not to write the integration, Make and n8n both ship a Search Companies Using Technology module that accepts a technology name such as Salesforce directly, and Clay offers a Search Company Technologies enrichment against a domain column. If the endpoint is running through an AI environment, the PredictLeads MCP server answers plain requests like “Find 10 companies using HubSpot” or “Find companies using Salesforce hiring developers.” Once the list is scored, our guide to pushing enriched company profiles into HubSpot and Salesforce covers the last mile, and the trade-offs across every channel sit in company data via API, flat files, webhooks, and MCP.
How PredictLeads Delivers CRM Technology Detections
PredictLeads is a company intelligence data provider, not a platform you log into, so the CRM detection list arrives as structured records you own and route wherever you need them. Technology Detections spans 1.5B+ detections since 2018 across 95M+ domains and 50,000+ tracked technologies, with 59M+ detections recorded in the last month and 429.7M+ in the last year.
The differentiator on CRM specifically is source breadth. Script tags, DNS records, IP ranges, cookies, and job descriptions each catch a different slice of the market, and every detection links back to the source that produced it, whether that is a subpage URL, a job opening URL, or a DNS record. That transparency is what makes the behind_firewall flag actionable rather than decorative.
Technology detections also sit next to the rest of the signal stack in one API, which is where most CRM plays actually get sharpened. Pair a Salesforce detection with Job Openings, where 279.2M+ records since 2018 are classified with O*NET occupation codes and seniority levels, to see who is staffing the system. Continue with pairing it with Financing Events, 210,800+ recorded since 2016, to find budget that just arrived. Pair it with Similar Companies, available for 18.9M+ companies with reasons attached to the top 20 matches, to expand a working segment. All of it is sourced only from publicly available information, with no PII in the company intelligence datasets, under SOC 2 Type II certification and GDPR and CCPA compliance.
Final Thoughts on Finding HubSpot and Salesforce Users
The list is the easy part. Any technographic source will hand you thousands of domains with a CRM attached to them. What decides whether that list produces meetings is whether you can tell a five-source, 18-month-old detection apart from a single keyword match in one job post, and whether you can resist saying “you dropped HubSpot” when what you actually have is a detection that stopped refreshing. Query by technology, read the evidence fields, tier the result, and write the email that the evidence actually supports.
Ready to see this in your own data?
Get 100 free API requests when you create an account – no credit card, no sales call.
Frequently Asked Questions
Call the discovery endpoint for technology detections with the technology name, for example GET /discover/technologies/hubspot/technology_detections, authenticated with your X-Api-Key and X-Api-Token headers. Results return ordered by first_seen_at descending, with up to 1,000 records per page and a page parameter for pagination. Each record includes the company reference plus last_seen_at, source_count, and behind_firewall. PredictLeads tracks 50,000+ technologies in its catalog, so the same call pattern works for any tool, not just CRMs.
Yes, because website markup is only one of five sources. PredictLeads also detects technologies from DNS records, IP ranges, cookies, and job descriptions, which is how enterprise tools that sit behind a login still surface. The behind_firewall boolean marks these cases: false means the detection came from a website JavaScript or HTML tag, and anything else indicates evidence from a non-front-end source. For Salesforce, job descriptions requiring administrator or architect experience are frequently the strongest available evidence.
behind_firewall is false when the detection came from a website JavaScript or HTML tag, meaning a public crawler could see it directly. Any other value indicates the evidence came from a different surface such as a DNS record or a job description. The distinction matters because website-only providers can only ever return the false population, which systematically undercounts enterprise software. PredictLeads records both across 95M+ domains.
High-traffic websites are crawled multiple times daily and job openings are refreshed approximately every 36 hours, so the job-description evidence behind enterprise CRM detections turns over quickly. Every record carries first_seen_at and last_seen_at, so you can measure freshness yourself rather than trusting an export date. Webhooks deliver new signals as they are detected for companies you follow. PredictLeads recorded 59M+ technology detections in the last month.
You can see supporting evidence, not confirmation. If a HubSpot detection stops refreshing, the accurate reading is that it has not been detected since a given date, and detection gaps have several ordinary causes including script changes, signature changes, and recrawl gaps. A concurrent set of job postings requiring Salesforce administration is stronger supporting evidence of a possible transition, and the competitive_technology_detections field surfaces overlapping vendors at the same company. Treat it as a reason to ask a question, not as a fact to assert.