Web-based Applications: finding and governing SaaS
Every browser tab can be a piece of software that handles company data. The Web-based Applications category labels those tools, so security teams can see which SaaS is in use, including the shadow IT nobody approved.
This page explains the scope, the borders with neighbouring categories, and how vendors turn the label into discovery and policy.
What the Web-based Applications category includes
The test: is the site a tool you work in, rather than a page you read? If people log in to create, edit, track or transform data, the site belongs here.
Productivity suites
Browser-based documents, spreadsheets and presentations, outside their storage and mail components.
Core business useProject and task tools
Boards, timelines, ticketing, issue tracking and team planning applications.
Core business useCRM and sales tools
Customer records, pipelines, quoting and sales engagement platforms.
Holds customer dataHR and payroll
Recruiting systems, employee records, time tracking and payroll portals.
Holds personal dataDesign and media editors
Online graphic design, photo editing, diagramming and video editing in the browser.
Often adopted by teams directlyForms and surveys
Form builders, survey platforms and quiz tools that collect responses from others.
Collects data from outsidersScheduling and booking
Meeting schedulers, appointment booking pages and shift planning tools.
Low risk, high spreadE-signature and contracts
Document signing, contract management and approval workflows.
Holds legal documentsOnline converters
PDF tools, file format converters, compressors and OCR sites that process uploaded files.
Frequent data-loss riskAccounting and invoicing
Bookkeeping, invoicing and expense tools for small and mid-sized businesses.
Holds financial dataPassword and identity tools
Web vaults, single sign-on portals and authenticator dashboards.
High trust requiredNo-code builders
Form-to-app builders, automation platforms and internal tool makers.
Can connect many systemsExclusions and neighbouring categories
SaaS is a delivery model, not a subject, so the category could swallow half the web. These borders keep it focused on general work tools and leave specialised software to its own categories.
Marketing site or app? A vendor's public homepage often carries Computers & Technology or Business, while the login and app subdomains carry Web-based Applications. Subdomain-level data lets policy treat them differently.
From logs to a shadow IT list in five steps
Shadow IT is software staff adopt without IT approval. It is rarely malicious; it is usually a team solving a problem fast. The category turns raw traffic into a list you can act on.
1. Collect domains
Export DNS, proxy or firewall logs for a few weeks to capture regular use.
2. Categorize them
Match every domain against the database; filter to Web-based Applications and its neighbours.
3. Compare with the approved list
Anything not on the sanctioned list is a shadow IT candidate.
4. Rate each app
Ask what data it touches, who uses it and whether an approved tool does the same job.
5. Decide and communicate
Sanction, coach towards an alternative, or block. Tell the teams affected why.
Discovery is not a one-off audit. Re-run it monthly or after each refresh, so new tools appear as they are adopted instead of a year later during an incident review.
Bulk work like this is easier with the domain category lookup for spot checks and the licensed files for whole log sets.
Sanctioned, tolerated, unsanctioned
Most organisations sort SaaS into three lanes. The category label puts an app on the board; the organisation decides which lane it belongs in.
Sanctioned allow
Tolerated monitor
Unsanctioned coach or block
Coaching pages work better than hard blocks for tolerated tools. Showing users the approved alternative at the moment of use reduces shadow IT without stopping work, and it tells IT which needs the approved tools do not yet meet.
Which web apps carry the most risk
Risk in this category comes from what users put into the tool. These four questions rank apps faster than any vendor score.
Does it take uploads?
Converters, OCR and editors receive whole documents. Anonymous ones are the classic data-loss route.
Does it hold personal data?
HR, CRM, forms and surveys create privacy obligations wherever the data lands.
Does it connect to other systems?
Automation and no-code tools hold tokens to email, storage and CRM accounts.
Is the operator known?
Clear terms, a company behind it and a track record lower the risk; new anonymous tools raise it.
Newly registered domains matter here too. Lookalike "free tool" sites appear daily, and some collect uploads for the wrong reasons. About 300,000 new domains are categorized every day and checked again after a week and a month.
Questions to ask before sanctioning a web app
Once discovery finds an app, someone has to decide its lane. A short, repeatable review keeps decisions consistent and quick.
Record the outcome against the domain. When the same app appears in another department's traffic months later, the decision is already made.
Spotting fake "free tool" sites
Popular tool types attract imitators. They rank in search, look useful and then push downloads or harvest uploads. Their domains are labelled by what they do, not by what they claim.
Download instead of result
A converter that returns an installer rather than your file is a red flag.
Brand lookalike
A name one letter away from a well-known tool, on a domain registered recently.
Sign-in prompts
A "free" tool that asks for your work email password to continue.
No operator
No company name, terms or contact anywhere on the site.
Typical site types and their labels
The first label describes most of the site. Web-based Applications often shares a domain with a vendor's marketing or a specialised category, and the labels below show the most common combinations.
| Site type | What it does | Usual labels |
|---|---|---|
| Project management app | Boards, tasks, team workspaces | Web-based Applications |
| Online PDF toolkit | Merge, split, convert, compress uploads | Web-based Applications |
| Survey platform | Builds forms, collects responses | Web-based ApplicationsBusiness |
| Accounting software for SMEs | Invoices, ledgers, bank feeds | Web-based ApplicationsFinancial Services |
| Office suite with storage | Editors plus drive plus mail | Web-based ApplicationsCloud Storage / File HostingEmail and Messaging |
| Classroom quiz tool | Teacher-made quizzes, student answers | Web-based ApplicationsEducation/Reference |
| Online design editor with AI features | Templates, editing, generated images | Web-based ApplicationsAI / LLM Tools |
| Appointment booking page | Public calendar for clients to pick a slot | Web-based ApplicationsBusiness |
| Online whiteboard | Shared canvases, sticky notes, workshop templates | Web-based Applications |
| Automation platform | Connects apps with triggers and actions, stores access tokens | Web-based ApplicationsDeveloper Tools / Code Hosting |
| Vendor marketing homepage | Features, pricing, case studies; the app lives on a subdomain | Computers & TechnologyBusiness |
| Fake "free converter" site | Pushes downloads or collects files | Malware / Phishing / Suspicious |
Policy table: schools, businesses, guest Wi-Fi, parental control
Defaults differ less in the category decision than in what happens next: review, coaching or tenant-level controls.
| Environment | Category default | What usually follows |
|---|---|---|
| Schools (CIPA) | Allow approvedReview others | CIPA is about harmful images, not SaaS. Student data privacy rules are the bigger driver; many districts keep an approved edtech list. Check the current guidance in your state. |
| Businesses | AllowMonitor | Discover shadow IT, sanction what teams need, coach or block high-risk converters and unknown form tools. |
| Regulated industries | Allow-list | Only reviewed apps reachable; others blocked with a request process. Common in finance and healthcare. |
| Guest Wi-Fi | Allow | Guests use their own tools; the network has no data to protect from them. |
| Parental control | Allow | Homework tools live here. Parents may review sign-ups on younger profiles. |
For business buyers, our guide to web filtering software for business covers how SaaS rules fit into a wider policy, and web filtering for SaaS companies covers the vendor side.
Multi-category cases
Domains carry several categories, ranked by how much of the site each one describes. In SaaS, ranking separates the app from its storage, mail or AI features.
Suite domains
One domain for editors, storage and mail.
Web-based Applications + Cloud Storage + EmailApps with AI features
A writing or design tool that adds generation.
Web-based Applications + AI / LLM ToolsClassroom tools
Quiz, worksheet and class management apps.
Web-based Applications + Education/ReferenceFinance tools
Invoicing and expense apps for businesses.
Web-based Applications + Financial ServicesTransfer tools
Send-a-large-file services with simple editors.
Cloud Storage first, Web-based Applications secondHow vendors use the Web-based Applications label
The label is the backbone of SaaS discovery features in products that do not have, or do not want, a full app catalog.
| Product | Feature built on the category |
|---|---|
| Secure web gateway | Shadow IT report grouped by category, with first-seen dates for each app |
| DNS filter for SMBs | A "SaaS in use" dashboard that small businesses can read without a security team |
| MSP platform | Per-client SaaS inventories and alerts when a new app appears in a client's traffic |
| Data loss prevention | Extra inspection on uploads to Web-based Applications and Cloud Storage domains |
| School filter | Approved edtech list enforcement, with unknown apps routed to review |
| Browser security | Warnings when users paste sensitive data into unsanctioned web tools |
The full web filtering database delivers this label with the other 58 categories, the IAB taxonomy and the AI tools category set, as files that run in your own systems.
Web-based Applications FAQ
What is the Web-based Applications category?
It groups sites that are software used in the browser: SaaS productivity, project, CRM, HR, design, form, scheduling and document tools, plus online converters and utilities.
How does the category help with shadow IT?
Run network or DNS logs against the category and every SaaS tool in use shows up, including ones IT never approved. That list is where sanctioning, coaching or blocking starts.
Should businesses block web-based applications?
Not as a category. Work depends on SaaS. Allow sanctioned apps, review or coach on unsanctioned ones, and block specific high-risk tools such as anonymous converters.
Are AI tools part of Web-based Applications?
No. AI chat, writing and image tools carry AI / LLM Tools, with a separate set of 16,000+ AI-tool domains in 18 categories, updated daily.
Where do cloud storage and email go?
Each has its own category. Web-based Applications is for tools that do work on data rather than mainly store or send it.
Does the category work at subdomain level?
Yes, where it matters. App and login subdomains can carry Web-based Applications while a vendor's marketing site carries Computers & Technology or Business.
Is the category useful if my firewall has an app catalog?
Yes. Catalogs cover well-known apps. A domain category also covers the long tail of small and new tools that catalogs miss.
Do browser extensions count as web-based applications?
Extensions are installed software, not domains. The services they call in the background are domains, and those carry the category that fits the service, often Web-based Applications.
How often does the SaaS landscape change in the data?
Continuously. New tools appear in the daily delta files for newly registered domains, and every other domain is refreshed monthly, so discovery reports stay current.
Can schools use this category to enforce an approved app list?
Yes. Allow the approved edtech domains, route other Web-based Applications domains to a review page, and keep the CIPA-relevant categories blocked as usual. Teachers then request new tools instead of finding workarounds.
How is it licensed?
With the full database, for internal use or OEM embedding. Starter database tiers start from $999; enterprise and OEM licences are quoted per deployment.
Put SaaS discovery into your product
120 million categorized domains, including Web-based Applications and its neighbours, with daily files for new domains and a lookup API. Tell us how your product handles shadow IT today.
Talk to usLicense the database