Does Asato make us compliant with a regulation?

No. Asato is not a compliance product, and nothing on this page is legal advice. Asato shows what you pay for and do not use, with a yearly price and an owner on each item. Your own policy decides what is protected, and a person you name approves each fix.

Asato for financial services

Q: Will Asato flag our standby site as waste?

Not if your policy protects it. Before Asato recommends anything, it takes out the people and systems your policy protects. A standby site, an archive kept for a retention rule and an emergency account are things a firm holds on purpose. Your team names what is protected when it checks the findings, and those items are left alone. Only what is neither in use nor held on purpose is priced and sent for approval.

Q: We already keep an asset inventory. What does Asato add?

A price, the use and an owner. Asato does not replace your inventory. It reads the records you already keep, matches them so each item is counted once, and adds what each item costs a year and whether anyone uses it, with an owner on each. You keep every system you run.

Q: We review every vendor before they connect. When does the week start?

After your review. The week starts once your own review allows the read-only connection. Asato holds SOC 2 Type 2, ISO/IEC 27001:2022 and HITRUST e1 certifications, each independently certified. The scope, period and issuer of each are in the Asato Trust Center, at trust.asato.ai.

Pay only for what you use or hold on purpose. This page is written for banks, insurers, and asset and wealth managers. Asato builds one record of the technology a firm pays for and sorts every item three ways: in use, held on purpose, or neither. What the firm's own policy protects, such as a standby site, an archive kept for a retention rule or an emergency account, is taken out before anything is recommended. What is neither in use nor held on purpose gets a yearly price and an owner. Nothing changes until a person the firm names approves it, and each step is logged. Asato's fee is a share of the savings, and if it finds no savings, the customer pays nothing.

Headline on the visual page: "Pay only for what you use or hold on purpose." The sentence under it: "One record of what your firm pays for: in use, held on purpose, or neither."

When to use it

A bank, an insurer or an asset or wealth manager pays for software, hardware, support contracts or AI seats and cannot say which of them anyone uses.
The firm keeps an asset inventory for control, and finance cannot read cost or use from it.
A cost report shows idle technology, and nobody can say which of it is held on purpose and which is not needed.
An acquisition has left two estates, with applications that do the same job and contracts that still run.
Branches have closed, or people have left or moved, and the licenses and support lines are still paid.
The firm wants every change approved by a person it names, with a log of who approved it, what changed, where and when.

Not a fit

A compliance product. Asato does not make a firm compliant with any regulation, and nothing on the page is legal advice.
A replacement for an asset inventory, a CMDB, a service management system or a contract repository. Asato connects to those systems and does not replace them.
A decision made by software. Asato recommends. A person the firm names approves each fix, or sets a policy that governs fixes of that kind.
Negotiating with a vendor on the firm's behalf. Asato does not negotiate. The buyer, or its reseller, negotiates with Asato's count.
Basic inventory tracking with no need to act on the result.

The job in one line

Pay only for what you use or hold on purpose.

The problem: one record, two readers

Section heading on the visual page: "One record. Two readers." The line under it: "It is kept for control. Finance needs it for cost."

A regulated financial firm is asked to keep a record of the technology it holds, and it keeps it for control. Finance needs most of the same facts to find what the firm pays for and does not use. In the page's example each reader has half of the record.

The asset inventory says who owns each asset, where it is, how it is classified, when its support ends and how fast it must be recovered. It does not say what the asset costs a year, or whether anyone uses it.
A cost report says what each asset costs and whether it is in use. It does not say whether an idle asset is held on purpose.

The difference matters in financial services, because some of what looks idle is meant to be idle. A standby site exists so that it can take over. An archive platform is kept because a retention rule says the records must stay readable. An emergency account is meant to be used rarely. On a cost report, each of these looks the same as a license nobody needs.

Two public texts say what the record is for, and one filing says why it matters:

New York, 23 NYCRR Part 500, section 500.13(a), in force since November 1, 2025. New York's cybersecurity regulation requires the financial firms it covers to keep an asset inventory that tracks each asset's owner, location, classification or sensitivity, support expiration date and recovery time objectives. Source: New York State Department of Financial Services, https://www.dfs.ny.gov/system/files/documents/2023/12/rf23_nycrr_part_500_amend02_20231101.pdf. The page states this in this section, as the first of its three source notes, and adds an observation of its own: finance needs the same record with two more facts, what each asset costs a year and whether anyone uses it.
FFIEC IT Examination Handbook, Architecture, Infrastructure, and Operations booklet, June 2021, section III.B, IT Asset Management. The IT handbook that US bank examiners work from tells management to keep hardware and software inventories, and lists license utilization and support cost among the things an inventory helps management understand. Source: https://ithandbook.ffiec.gov/it-booklets/architecture-infrastructure-and-operations/iii-common-aio-risk-management-topics/iiib-it-asset-management/
Wells Fargo, 2025 Annual Report. Wells Fargo reported that its technology, telecommunications and equipment expense rose 14% in 2025, to $5.2 billion, and named software maintenance and licenses among the causes. Source: https://www.wellsfargo.com/assets/pdf/about/investor-relations/annual-reports/2025-annual-report.pdf. Wells Fargo is cited for its own published figure. The page does not say that Wells Fargo is an Asato customer.

What these sources do not say: neither text requires a firm to remove unused licenses or to cut cost. They ask for an inventory, and the handbook names cost among its uses. The page does not say that Asato's record carries the fields a rule lists, or that Asato satisfies any rule.

Three questions to answer before anything changes

Everything a financial firm pays for is in use, held on purpose, or neither. Written as a formula: paid for = in use + held on purpose + neither. Only the third part is waste. Each part of the formula is a question, and Asato answers all three from the customer's own records.

What do you hold, and what does each item cost a year? (paid for) Asato builds one record of what the firm holds, across software licenses, hardware (network, compute and end-user devices), contracts and AI spend. Each item is counted once and carries a yearly price and an owner.
- Link: asset lists, contracts, sign-in records and network logs are matched, so each item is counted once.
- Think: each item gets a yearly price and an owner, from the customer's own records.
- Execute: Asato keeps watching, so the record stays current between audits.
- Goes deeper: licenses are covered by Right-size software, and hardware and support contracts by Stop paying for idle hardware.
Is it in use, held on purpose, or neither? (in use + held on purpose) Each item is tied to its use, such as sign-ins for a license or traffic for a device. Held on purpose is the customer's call: before Asato recommends anything, it takes out the people and systems the customer's policy protects. The customer's team names what is protected when it checks the findings. What is left, neither in use nor held on purpose, is priced and goes to its owner.
- Link: each item is tied to its use: sign-ins for a license, traffic for a device.
- Think: what the customer's policy protects is taken out before anything is recommended, and the rest is priced.
- Execute: each recommendation goes to its owner, with the evidence and the yearly price.
- Goes deeper: overlapping applications after a merger are covered by Rationalize your portfolio, and AI seats and usage by Control AI spend.
Who approved letting it go, and where is the proof? (neither) Nothing changes until a named person approves it. A person the customer names approves each fix, or sets a policy that governs fixes of that kind. An Asato agent then carries out the fix, and each step is logged: who approved it, what changed, where and when. If the fix needs a person, the agent opens the ticket or prepares the renewal brief. For a support contract, it prepares the change to the contract.
- Link: each finding is tied to the contract that bills it.
- Think: each fix carries its yearly price, its owner and the date to decide by.
- Execute: a person the customer names approves. An Asato agent carries out the fix, and each step is logged: who approved it, what changed, where and when.
- Goes deeper: renewals and dates are covered by Stay ahead of contracts.

The three steps under each question are the same three the platform runs everywhere. Link: the Asset Knowledge Graph links every asset, person, contract and cost into one record. Think: the Data Intelligence Engine turns the record into recommendations, each with a price and an owner. Execute: agents carry out the fixes a named person approves, and keep watching. The platform page has the detail.

What a saving is

Found, Approved and Saved are separate figures and are never added together. Found is what Asato identified. Approved is what a named person signed off. Saved is what came off the bill. Nothing an agent does makes a saving Saved: a Saved figure is agreed jointly by the customer and Asato at the close of the engagement.

Example data on the page

The product screens on the visual page show example data, not a customer result. One fictional firm is used throughout. It is not named and is not modeled on any real firm.

Paid for: $48,000,000 a year, on one record of 1,319 lines. Each line has a yearly price and an owner.
The formula at rest: $48,000,000 paid for = $42,996,800 in use + $2,810,800 held on purpose + $2,192,400 neither. The page also shows these as $48.0M, $43.0M, $2.8M and $2.2M.
Eight rows of the record are shown: office suite licenses, 9,200 seats, $4,140,000 a year, owner End-user computing. AI assistant seats, 3,900 seats, $1,404,000, owner Digital workplace. A work management tool that came with an acquisition, 2,100 seats, $882,000, owner Operations. Branch network support, 2,480 devices, $4,464,000, owner Network engineering. A standby site, 96 servers, $2,100,000, owner Resilience. A records archive, one platform, $700,000, owner Records management. Emergency accounts, 24 accounts, $10,800, owner Security. The other 1,312 lines, $34,299,200.
Held on purpose, protected by the firm's own policy and left alone, $2,810,800 a year: the standby site (96 servers, no traffic outside tests, $2,100,000, resilience policy), the records archive (no sign-in in 14 months, $700,000, retention policy) and the emergency accounts (24 accounts, no sign-in in 90 days, $10,800, access policy).
Neither, $2,192,400 a year, Found: 1,480 office suite licenses with no sign-in in 90 days ($666,000, owner End-user computing). Support on 184 switches at closed branches with no traffic in 90 days ($331,200, owner Network engineering). 1,860 seats on a second work management tool that came with an acquisition, not opened in 90 days ($781,200, owner Operations). 1,150 of 3,900 AI assistant seats not opened in 90 days ($414,000, owner Digital workplace).
One fix followed to its log: support on 184 switches at closed branches, $331,200 a year, on a contract that renews on June 30. Found: $331,200 a year. The owner is Network engineering, and its VP approves at 09:14. Approved: $331,200 a year. By 09:31 an Asato agent has prepared the change to the support contract. The agent does not switch anything off. Saved: not yet.
Nothing in the example is Saved. The $2,192,400 a year is a Found figure.

Figures on the page, with their captions

Each figure on the visual page carries one caption. A caption takes no room on the page: it shows when a reader points at its figure, or taps the figure on a touch screen. The captions are given here in full. The caption of each panel that shows example data is labeled "Example data". In a figure, a ring marks a Found figure, a dashed ring marks an Approved one, and solid green marks a Saved one. No figure on this page shows a Saved figure.

The figures on the visual page move. Each one builds up once when the reader reaches it: its rows light in turn, its bars grow and its numbers count up to the values given here. It then rests on its complete state. The hero figure repeats: it sorts the record part by part, rests on the whole record, and starts again, and its pause control stops it on the complete figure. For a reader who has asked for reduced motion, every figure shows its complete state at once. Every number in this file is the value a figure rests on.

What you pay for, in three parts (hero). Example data: this example finds $2,192,400 a year that is neither in use nor held on purpose, on $48,000,000 a year of technology spend. It is found, not saved. The three parts read: in use, $43.0M, used in 90 days. Held on purpose, $2.8M, by your policy. Neither, $2.2M, price and owner. Inside the panel, at rest: nothing changes until a named person approves it. While the figure builds, the same line reads in turn: everything the firm pays for, on one record. In use: people and systems used it in the last 90 days. Held on purpose: a standby site, a records archive, emergency accounts. Neither: each line has a yearly price and an owner.
Two idle assets, on two records. Example data: two assets at a fictional firm. The five inventory fields are the ones New York's regulation lists. Finance sees two idle assets, and only the inventory shows which one is held on purpose. The standby site, 96 servers: owner Resilience, location Site B, classification critical, support expires March 2028, recovery time 4 hours, $2,100,000 a year, not in use. The branch switches, 184 devices: owner Network engineering, location 23 closed branches, classification internal, support expires June 2027, no recovery time set, $331,200 a year, not in use. The panel's own line: same on the cost report, different on the inventory.
Three parts, three questions. The formula again, with one question under each part: paid for, in use + held on purpose, neither. Asato's method: everything a firm pays for is in use, held on purpose, or neither. Only the third part is waste, and each part is a question Asato answers from your own records.
One record of what you hold. Example data: eight rows of one record of 1,319 lines. Each line has a yearly price and an owner, and the record adds up to $48,000,000 a year.
Every line, sorted three ways. Example data: three things this firm holds on purpose are protected by its own policy and left alone. Four lines are neither in use nor held on purpose: $2,192,400 a year found. The bar is to scale: white is in use, gray is held on purpose, outlined is neither.
One fix, from finding to log. Example data: one of the four findings. Nothing changed until the VP approved. The saving stays Approved: a Saved figure is agreed jointly by the customer and Asato at the close of the engagement. The log in the panel reads: who, VP, Network engineering. What, support on 184 switches, change prepared. Where, network support contract. When, approved 09:14, prepared 09:31.

Trust and governance

Section heading on the visual page: "Read-only by default." The line under it: "Write access where you grant it."

What Asato reads. Metadata: records about technology, such as licenses, devices, usage, sign-in activity and costs. Contracts and invoices are read only if the customer connects them. Asato never reads employees' documents, email or messages.
Read-only by default. Write access where the customer grants it. Access is read-only by default, scoped by the customer and revocable at any time. Write access is added one system at a time, where the customer grants it.
Named approval. No change reaches a live system until a named person approves it, and every action is logged. A person the customer names approves each fix, or sets a policy that governs fixes of that kind.
The customer's policy comes first. Before Asato recommends anything, it takes out the people and systems the customer's policy protects.
Training. Customer data never trains any model.
Certifications. SOC 2 Type 2 (issued June 2025), ISO/IEC 27001:2022 (valid to September 2028) and HITRUST e1 (from July 2026), each independently certified. Scope, period and issuer for each are in the Asato Trust Center: https://trust.asato.ai
Not a compliance claim. Asato does not make a firm compliant with any regulation, and the page gives no legal advice.

Works with

More than 100 tools, read-only, covering four kinds of record: users (identity and access systems), assets (asset lists, CMDB and device management), usage (sign-in activity, security and network logs) and cost (finance, procurement and contract systems).
The sources are listed at https://www.asato.ai/platform-integrations.

Compared with the tools a firm already owns

The asset inventory, CMDB or service management system. It keeps the record of what the firm owns, for control. Asato reads that record, matches it against the firm's other systems, and adds what each item costs a year and whether anyone uses it.
Software asset and SaaS management tools. They track licenses and software spend. Asato does this work too, across every kind of technology, and carries out the fixes the firm approves. A firm can start beside the tool it runs and decide at that tool's renewal.
Cost-allocation tools. They allocate technology cost. Asato recommends what to stop paying for, with an owner for each item.

A customer keeps every system it runs.

Who uses it

CFO or head of technology finance: gets what is neither in use nor held on purpose, each item with a yearly price, and Found, Approved and Saved reported as separate figures.
CIO or CTO: gets a named approver behind every change, and nothing switched off by an agent on its own.
IT asset and vendor managers: run it. Each item is counted once, with its owner and its use beside it.
Risk, resilience and security: name what the firm's policy protects, and it is taken out before anything is recommended.
Internal audit: can follow one change from finding to log: who approved it, what changed, where and when.

How a firm starts

Section heading on the visual page: "No savings, no fee." The line under it: "Your Asset Clarity Report: a priced list of savings, in one week." The one action beside them is "Get your Asset Clarity Report", at https://www.asato.ai/talk-to-sales.

The page now shows this section as one band: its title, its sub-title and the button. The steps are kept here for agents. A regulated firm reviews a vendor before it connects, so the week starts once the firm's own review allows the read-only connection. The review runs in four steps:

Connect. Read-only access to the records for one area, once the firm's own vendor review allows it. Nothing is installed.
Model. Asato matches the records and counts each item once.
Checkpoint. The customer's team checks the findings and names the people and systems its policy protects.
Report. The customer holds its Asset Clarity Report: a priced list of what to stop paying for, with an owner on every item.

How a customer starts and what it costs are set out on the home page: https://www.asato.ai/index

Questions

The page shows at most five questions, the ones that belong to it. Any others are kept here for agents.

Will Asato flag a standby site as waste?

Not if the customer's policy protects it. Before Asato recommends anything, it takes out the people and systems the customer's policy protects. A standby site, an archive kept for a retention rule and an emergency account are things a firm holds on purpose. The customer's team names what is protected when it checks the findings, and those items are left alone. Only what is neither in use nor held on purpose is priced and sent for approval.

A firm already keeps an asset inventory. What does Asato add?

A price, the use and an owner. Asato does not replace the inventory. It reads the records the firm already keeps, matches them so each item is counted once, and adds what each item costs a year and whether anyone uses it, with an owner on each. The customer keeps every system it runs.

Can Asato change anything without approval?

No. Nothing changes until a named person approves it. A person the customer names approves each fix, or sets a policy that governs fixes of that kind. Each step is logged: who approved it, what changed, where and when. Write access is added one system at a time, where the customer grants it.

What does Asato read?

Metadata. Asato reads records about technology, such as licenses, devices, usage, sign-in activity and costs. It reads contracts and invoices only if the customer connects them. It never reads employees' documents, email or messages. Customer data never trains any model.

A regulated firm reviews every vendor before they connect. When does the week start?

After the firm's review. The week starts once the firm's own review allows the read-only connection. Asato holds SOC 2 Type 2, ISO/IEC 27001:2022 and HITRUST e1 certifications, each independently certified. The scope, period and issuer of each are in the Asato Trust Center, at https://trust.asato.ai.

Does Asato make a firm compliant with a regulation?

No. Asato is not a compliance product, and nothing on the page is legal advice. Asato shows what a firm pays for and does not use, with a yearly price and an owner on each item. The firm's own policy decides what is protected, and a person the firm names approves each fix.

What does it cost?

Asato is paid mostly on results: a small share when it finds a saving, and the larger share only once that saving shows up on the customer's invoice. If it finds no savings, the customer pays nothing.

What does "held on purpose" mean?

It means the firm keeps the item for a reason other than daily use, and its own policy says so. The page's examples are a standby site, an archive kept for a retention rule and an emergency account. Asato does not decide this. The customer's policy does, and Asato takes out the people and systems that policy protects before it recommends anything.

When is a saving counted as Saved?

When the customer and Asato agree it, at the close of the engagement. Found, Approved and Saved are separate figures and are never added together. An agent carrying out a fix does not make a saving Saved.

Does Asato negotiate with vendors?

No. Asato supplies the count and the evidence behind it. The buyer, or its reseller, negotiates.

What happens after the first week?

Asato keeps watching. The first week finds the waste. After that, a subscription keeps Asato running: it carries out the fixes the customer approves and keeps watching for new waste.

Next step

Get your Asset Clarity Report at https://www.asato.ai/talk-to-sales.

Last updated: 2026-10-06