CRM selection is one of the most consequential decisions a sales or marketing organization makes. It shapes everything from pipeline management to customer lifecycle workflows, and switching costs are enormous — data migrations, re-training, integration rewiring. So when you're researching a competitor or preparing for a sales conversation, knowing what CRM a company uses gives you meaningful intelligence. Are they locked into Salesforce? Running lean on HubSpot? Building custom on top of Airtable? Each answer implies different budget levels, process maturity, and pain points.
The surprising reality: most companies broadcast their CRM choice openly, via the JavaScript they load, the cookies they set, and the forms they embed on their website. You don't need insider access. You need to know what to look for.
Why Identifying a Competitor's CRM Matters
Before diving into methods, it's worth clarifying why this information is valuable beyond mere curiosity.
If you're a CRM vendor or implementation partner, knowing that a prospect runs Salesforce tells you they're in a contract, have a dedicated admin, and will need a compelling ROI case to switch. If they're on a starter HubSpot plan, they may be ready to graduate. If they're on Zoho or a niche CRM, they might be genuinely open to alternatives.
If you're a competitor, CRM choice signals operational sophistication. A company running enterprise Salesforce with Marketing Cloud has invested heavily in sales process. A company on a free CRM tier is probably moving fast and keeping costs low — a very different competitive profile.
If you're a sales rep calling into an account, knowing they use HubSpot CRM and you're selling a HubSpot-native integration changes your entire pitch from "this is what we do" to "this plugs directly into what you already have."
Signal 1: JavaScript Files and Script Tags
The most reliable way to detect a CRM is to look at what JavaScript a site loads. Every major CRM injects tracking or chat scripts client-side. Here are the dead giveaways:
- HubSpot —
js.hs-scripts.com,js.hsforms.net,js.hscta.net, cookiehubspotutk - Salesforce / Pardot —
pi.pardot.com,salesforceliveagent.com,force.comiframes - ActiveCampaign —
trackcmp.net, form embeds fromactivehosted.com - Pipedrive — LeadBooster chat widget from
leadbooster-chat.pipedrive.com - Zoho CRM — SalesIQ widget from
salesiq.zoho.com - Freshsales / Freshworks —
freshbots.ioor Freshchat scripts - Close — typically detectable via their tracking pixel or help doc URLs
Of course, reading raw script tags for every prospect is tedious. This is one of the primary use cases for SaaS Detective — it categorizes CRM and marketing automation tools automatically, so you see at a glance "HubSpot CRM" or "Salesforce Pardot" without digging through source code.
Signal 2: Web Forms and Landing Pages
Forms are the most obvious CRM signal. HubSpot forms are embedded via an hbspt.forms.create() JavaScript call. Pardot forms load from go.pardot.com or use the pardot-form class. Marketo forms are unmistakable with their mktoForm class and load from munchkin.marketo.net.
Even when forms are custom-styled to hide their origin, the underlying code structure often betrays the platform. Look at the form action URL, the hidden input field names, and the JavaScript validation library — all of these are CRM-specific.
Contact and Demo Pages
Go directly to a company's /contact, /demo, or /get-started page. These pages reliably load CRM form embeds. A single visit to a "Book a Demo" page with SaaS Detective open will tell you whether you're looking at HubSpot, Marketo, Calendly (which often reveals the underlying CRM via the booking confirmation flow), or a custom form routing to an API.
Signal 3: Chat Widgets
Many CRMs bundle their own live chat, or companies choose a chat tool that integrates natively with their CRM. The chat widget visible in the bottom corner of a website is often the fastest CRM signal:
- HubSpot — uses its own live chat as a native feature; you'll see the HubSpot branding in the widget by default unless they've customized it
- Salesforce — Einstein Bots or Service Cloud chat
- Intercom — very common alongside HubSpot or Salesforce; the Intercom messenger is visually distinctive
- Drift — often used with Salesforce or Marketo in mid-market B2B companies
- Crisp — common with smaller companies, often paired with a simpler CRM
Open a company's site, activate SaaS Detective, and check the CRM and Marketing Automation categories first. Then navigate to their /demo or /contact page and run SaaS Detective again — different pages often load different tools. In under two minutes, you'll have a confident picture of their full sales tech stack.
Signal 4: Email Infrastructure and SPF Records
CRMs send email — and email-sending domains leave DNS records. An SPF TXT record containing include:_spf.hubspot.com confirms HubSpot. include:_spf.salesforce.com is Salesforce. include:servers.mcsv.net is Mailchimp (often indicative of a simpler CRM setup). include:mktomail.com is unmistakably Marketo.
You can check these without any special tools. Just search for "DNS lookup [domain]" and look at the TXT records for SPF entries. This is especially useful when a company's website is a single-page app that loads very few third-party scripts — their email infrastructure often reveals their CRM even when the web presence doesn't.
Signal 5: Job Postings
This one is underrated. Job postings for Sales Operations, Marketing Operations, or RevOps roles almost always specify the CRM stack. A listing that says "3+ years Salesforce experience required, Marketo a plus" tells you their exact stack. Same for "HubSpot power user" or "Outreach and Salesloft admin." LinkedIn job search and Indeed both let you search job descriptions, making this a scalable research method.
This doesn't give you real-time data the way SaaS Detective does on a live site — a company might be mid-migration — but it's a useful corroboration signal, especially for larger organizations where the website is managed by a separate team from the CRM admin.
What CRM Choice Tells You About a Company
Once you've identified the CRM, the interpretation layer matters as much as the detection. Some useful heuristics:
- HubSpot (Starter/Pro) — growing company, likely under 500 employees, marketing-led, probably has a small sales team with a strong inbound motion
- HubSpot Enterprise — significant investment, complex sales ops, usually means they've committed to the HubSpot ecosystem long-term
- Salesforce + Marketo/Pardot — enterprise sales motion, long deal cycles, dedicated RevOps team, significant contract value
- Pipedrive or Close — SMB-focused, outbound-heavy, often a high-velocity sales model with shorter cycles
- No detectable CRM — either very early stage, server-side only CRM, or genuinely underinvested in sales process
These aren't rules — they're starting hypotheses. But going into a competitive analysis or sales call with a hypothesis is always better than going in blind.
Bottom Line
Figuring out what CRM a company uses is a three-step process: check their website for tracking scripts and form embeds, look at their DNS records for email-sending infrastructure, and corroborate with job postings. For the first step, SaaS Detective cuts the research time from minutes to seconds by automatically categorizing every detectable CRM and marketing automation tool on any page you visit. The interpretation — what that CRM choice means for your competitive positioning or sales approach — is where the real leverage lies.