01 Software-to-evidence map
Find the system. Follow the data journey.
Use familiar software names to start an operating conversation: what enters, why it is used, who can act on it, where it travels and what evidence a later request needs.
Control outcomes only · current admin-menu paths must be verified in the live console
CRM + service
Zoho CRM
Leads, contacts, deals, campaigns, tickets, notes, attachments and workflow history
CRM + service
Zoho CRM
Leads, contacts, deals, campaigns, tickets, notes, attachments and workflow history- Which edition and data centre does the organisation use?
- Which user or integration can export the broadest dataset?
Module and field inventory with purpose owner, Notice and source-to-record trace, Role, profile and sharing review.
This preview intentionally avoids unverified menu-path instructions.
Work + storage
Google Workspace
Email, files, forms, identities, calendars, shared drives and administrative events
Work + storage
Google Workspace
Email, files, forms, identities, calendars, shared drives and administrative events- Which repositories are systems of record?
- Which external domains and OAuth apps can receive personal data?
Repository and shared-drive ownership map, Form-to-notice trace, Admin and OAuth review.
This preview intentionally avoids unverified menu-path instructions.
Work + storage
Microsoft 365
Mail, files, chats, meeting content, identities, sites, audit records and connected applications
Work + storage
Microsoft 365
Mail, files, chats, meeting content, identities, sites, audit records and connected applications- Which workloads and licences are in use?
- Which service principals have broad Graph access?
Workload and repository map, Privileged role and app-permission review, Guest and sharing sample.
This preview intentionally avoids unverified menu-path instructions.
CRM + service
Salesforce
Leads, contacts, accounts, opportunities, cases, activities, files, custom objects and integration events
CRM + service
Salesforce
Leads, contacts, accounts, opportunities, cases, activities, files, custom objects and integration events- Which custom objects contain personal data?
- Which integrations can read or write the broadest scope?
Object and field map, Profile and permission review, Package and integration inventory.
This preview intentionally avoids unverified menu-path instructions.
CRM + service
Freshworks / Freshsales
Contacts, accounts, deals, support tickets, conversations, attachments, sales activities and configuration events
CRM + service
Freshworks / Freshsales
Contacts, accounts, deals, support tickets, conversations, attachments, sales activities and configuration events- Which Freshworks products and plans are active?
- Where are attachments copied?
Product and workspace map, Role and agent review, Ticket/CRM duplication sample.
This preview intentionally avoids unverified menu-path instructions.
CRM + marketing
HubSpot
Forms, contacts, companies, tickets, email subscriptions, lists, campaign events, files and integrations
CRM + marketing
HubSpot
Forms, contacts, companies, tickets, email subscriptions, lists, campaign events, files and integrations- Which hubs and subscription tier are active?
- Which private apps have broad scopes?
Property and purpose inventory, Form-to-notice trace, Subscription withdrawal test.
This preview intentionally avoids unverified menu-path instructions.
Messaging
WhatsApp Business / Meta messaging
Phone identifiers, conversations, media, templates, agent notes, webhook events and CRM synchronisation
Messaging
WhatsApp Business / Meta messaging
Phone identifiers, conversations, media, templates, agent notes, webhook events and CRM synchronisation- Which WhatsApp product and provider are used?
- Where do webhook payloads and media land?
Channel entry-point notice record, Template and purpose register, Admin, system-user and agent review.
This preview intentionally avoids unverified menu-path instructions.
Finance + exports
Tally / spreadsheet hand-offs
Customer and vendor records, invoices, tax identifiers, payments, ledgers, backups and workbook exports
Finance + exports
Tally / spreadsheet hand-offs
Customer and vendor records, invoices, tax identifiers, payments, ledgers, backups and workbook exports- Where are company files and backups stored?
- Who can export and email reports?
Company and user map, Security-level review, Export and recipient register.
This preview intentionally avoids unverified menu-path instructions.
Commerce + payments
Razorpay
Payment identifiers, contact details, orders, refunds, disputes, dashboard records, webhooks and reconciliation exports
Commerce + payments
Razorpay
Payment identifiers, contact details, orders, refunds, disputes, dashboard records, webhooks and reconciliation exports- Which fields are sent at checkout?
- Where are webhook payloads stored?
Checkout field and notice map, Team-role review, Key and webhook inventory.
This preview intentionally avoids unverified menu-path instructions.
Commerce + payments
Shopify / WooCommerce
Customer accounts, carts, orders, addresses, support, apps or plugins, webhooks, exports and analytics events
Commerce + payments
Shopify / WooCommerce
Customer accounts, carts, orders, addresses, support, apps or plugins, webhooks, exports and analytics events- Which platform and extensions are active?
- Which apps/plugins access protected customer data?
Platform and extension inventory, Checkout field/notice map, Staff and collaborator review.
This preview intentionally avoids unverified menu-path instructions.
Cloud infrastructure
Amazon Web Services
Application records, object storage, databases, logs, snapshots, backups, identities, support events and cross-account transfers
Cloud infrastructure
Amazon Web Services
Application records, object storage, databases, logs, snapshots, backups, identities, support events and cross-account transfers- Which accounts, services and regions hold each data class?
- Are required data events enabled?
Service, region and data-class map, IAM and cross-account review, CloudTrail coverage and sample.
This preview intentionally avoids unverified menu-path instructions.
Cloud infrastructure
Microsoft Azure
Application data, databases, storage, logs, backups, identities, support events and cross-tenant transfers
Cloud infrastructure
Microsoft Azure
Application data, databases, storage, logs, backups, identities, support events and cross-tenant transfers- Which tenants, subscriptions and regions are in scope?
- Which principals have data-plane access?
Tenant, subscription and resource map, Directory/RBAC/data-plane access review, Activity Log and diagnostic-setting record.
This preview intentionally avoids unverified menu-path instructions.
No systems match those filters.
Try a broader data-flow term or show every family.
02 The useful next record
Turn system names into an owned service map.
For every service, record purpose, data categories, role assessment, access, locations, contract, sub-processors, deletion event, exit path and next review.
Open the processor-register guide