If your team is manually tracking SaaS licenses in spreadsheets, chasing down offboarding checklists, or finding out about shadow IT after the fact, Corma was built for exactly that situation. It combines SaaS license management with identity access governance in a single platform, targeting mid-market IT teams that are too big for manual processes but too lean for enterprise tooling.
What Is Corma?
Corma is a license and access governance platform designed for modern IT teams. Corma positions itself as an access management platform to centralize apps, automate access reviews and provisioning, and reduce software spend. Founded in 2023 in Paris, the company is associated with HEC Paris's startup ecosystem and initially focused on scale-ups of roughly 300 to 1,000 employees. Its platform covers SaaS management, identity and access management, and software asset management in one place, primarily serving IT teams.
What Is Corma Used For?
Corma covers the full lifecycle of SaaS access and spend management across growing tech companies:
- Automated Onboarding and Offboarding: Provisions and deprovisions user access across SaaS applications using automated workflows.
- Shadow IT Discovery: Detects and helps control unsanctioned apps across your organization.
- License Cost Optimization: Flags unused and inactive licenses, tracks SaaS contracts and renewal dates, and surfaces potential seat savings across the software stack.
- Automated Access Reviews: Runs periodic access certification campaigns, producing audit-ready PDF and CSV reports to support ISO 27001 and SOC 2 compliance.
- Self-Service Access Requests: Gives employees Slack-based access request workflows before access is granted.
- Centralized User Visibility: Displays HR status and IdP status side by side so IT can spot mismatches, such as a user marked active in the IdP but terminated in HR, before they become a security problem.
- AI Agent Detection: Provides visibility and control over AI tools from a centralized view.
Key Features of Corma
Corma's platform is organized around eight functional modules covering the full lifecycle of SaaS access and spend.
SaaS Visibility and Shadow IT Detection gives IT a centralized inventory of every application in use, including unsanctioned tools, free trials, and AI apps employees use without authorization. Corma's proprietary Extractor Agent captures data directly from SaaS admin pages via browser automation, meaning apps without API integrations remain discoverable. Detected apps are categorized as Authorized, Unauthorized, Tolerated, or To Review, and automatically scored for compliance risk based on data hosting location, data sensitivity, security certifications, and known incidents. As of February 2026, the browser extension received additional updates.
Automated Onboarding and Offboarding automates onboarding and offboarding workflows and access provisioning across apps. When a new hire is detected via an integrated HR tool, Corma surfaces them as a suggested onboarding candidate with pre-filled data, then provisions access using pre-configured app bundles. For offboarding, it automatically removes accesses and requests for the departing user on the managed apps they had access to. User groups can help ensure new users receive the right tools from day one.
Automated Access Reviews and Audit Trails let admins create periodic access certification campaigns by selecting apps in scope, setting deadlines, and assigning reviewers by role: app owner, access owner, contract owner, manager, license user, or a named individual. Reviewers decide to maintain, revoke, or comment on each user's access. Corma provides real-time audit logs and exports audit-ready PDF and CSV reports. Corma mentions ISO 27001 certification and tools that can help with audits like ISO 27001 or SOC 2, and references GDPR in the context of maintaining compliance, but it does not explicitly list ISO 27001, SOC 2, and GDPR together as supported compliance frameworks.
License Optimization and Cost Management identifies unused and underused licenses based on SaaS usage data. The Contracts module surfaces active, inactive, spare, and over-allocated license counts alongside a Seat Savings figure representing estimated potential savings. A February 2026 update introduced additional product changes. OCR contract upload, improved in March 2026, uses OCR to automatically extract data from invoices and contracts.
Access Governance and Least-Privilege Enforcement covers role-based access controls across the SaaS stack, with integrations into Okta, Google Workspace, and Azure AD to simplify access control and support automated user provisioning. Employees can submit self-service requests through supported channels such as Slack integrations. Approval flows route requests before access is granted, and Corma also offers customizable provisioning and deprovisioning workflows.
Multi-Agent Automation Engine extends Corma's automation reach beyond standard API integrations. The Extractor Agent captures data from SaaS admin pages where APIs fail. Provisioning Agents automatically assign and revoke access across connected apps. A March 2026 update added a Clicker Automation backup system: if browser-based automation fails, a manual backup task is created automatically with notifications sent to the access owner and app owner.
Corma Differentiators
- AI-powered SaaS discovery that detects applications beyond traditional API integrations
- Deep visibility into shadow IT and unauthorized SaaS usage
- Automated user lifecycle management for onboarding and offboarding workflows
- Continuous SaaS spend optimization through license usage insights
- Centralized access governance and monitoring across SaaS applications
Corma Pros & Cons
Corma covers a lot of ground for a platform that launched in 2023. Here's where it earns its place and where IT teams should look carefully before signing.
Corma Pros
- AI-powered SaaS discovery beyond traditional API integrations: Corma's browser extension and OS agent cover apps that lack standard API or SCIM support, closing a gap that API-first platforms typically leave open.
- Strong shadow IT visibility: Detected apps are automatically categorized and scored for compliance risk, giving IT a clear picture of unsanctioned tool usage across the organization.
- Automated user lifecycle management: Corma handles onboarding and offboarding workflows across managed apps, reducing manual handoffs between IT and HR.
- Advanced license optimization and spend monitoring: The platform surfaces unused and over-allocated licenses alongside estimated seat savings, helping teams reduce SaaS waste.
- Fast implementation with minimal integration complexity: Multi-agent architecture reduces dependency on native integrations, so teams get SaaS visibility without requiring full API coverage across the stack.
Corma Cons
- Newer platform with a limited enterprise track record: Corma has a shorter deployment history than more established SaaS management competitors.
- Smaller integration marketplace compared to legacy competitors: As a younger platform, Corma's native integration catalog is narrower than more established vendors.
- No contract renegotiation service: Corma flags renewal dates and surfaces savings opportunities but does not offer managed contract renegotiation.
Corma Pricing
Corma offers flexible pricing tailored to an organization's SaaS environment and management requirements. Pricing is customized based on factors such as number of users, SaaS stack size, and level of automation required. Corma has no minimum fee, making it more accessible to small and mid-size teams, and offers a freemium version for teams that want to get started without a high commitment. Organizations typically request a demo or custom quote to determine the most suitable plan.
Organizations with fewer than 50 users are eligible for discounts of up to 80% through Corma's startup program. Billing intervals are not disclosed on the public pricing page. Plan upgrades and downgrades are available at any time during the subscription cycle.
Automate the SaaS Access Workflows Around Your License and Access Governance
Corma is built to govern SaaS access and licenses. But the service desk workflows that surround those operations, access request tickets, onboarding coordination, approval escalations, and cross-team IT incidents, still tend to live in scattered Slack threads and manual handoffs between IT, HR, and managers.
Corma is an integration partner for Siit. Here's what Siit adds to organizations running Corma for SaaS governance:
- Request Intake in Slack and Teams: Employees request software access, license upgrades, or tool approvals directly in Slack or Microsoft Teams. Siit's AI captures the request, routes it to the right person, and tracks it through to resolution, without leaving it as just another Slack thread.
- Cross-Departmental Approval Coordination: When a new hire needs access to multiple tools across several departments, Siit handles the approval routing automatically. It pulls employee data from HR systems like BambooHR, HiBob, or Rippling and helps automate workflows without manual follow-up.
- Automated Onboarding Workflows: Siit coordinates new hire workflows from a single automated process triggered when a new employee record appears in the HRIS, including identity setup in Okta or JumpCloud and related provisioning actions.
- Access Removal Coordination: When Corma flags an inactive license or triggers an offboarding workflow, Siit can pick up the service desk side: creating the removal ticket, routing it for approval, and notifying the relevant team in Slack or Teams once the action is complete.
- IT Ticket Visibility Without Context Switching: Siit's shared dashboard gives IT teams a centralized view of all open requests, with full employee context from connected systems, so access decisions are made with complete information rather than back-and-forth Slack threads.
Try It With Siit
Corma handles the SaaS governance layer. Siit handles the service desk workflows around it, so access requests, approvals, and onboarding coordination stop living in Slack threads and start getting resolved automatically.
Book a demo to see how the two work together.
Corma Alternatives
Several platforms compete in the SaaS management and access governance space, with varying emphasis on procurement, security, or identity workflows:
- Torii: Workflow automation and shadow IT discovery for mid-market to enterprise teams. Both Torii and Corma appear in the 2025 Gartner Magic Quadrant for SaaS Management Platforms. Torii's primary strength is low-code workflow building; Corma's distinguishing focus is the explicit unification of IAM and SAM functions.
- Zluri: Identity governance and SaaS management platform, recognized as a Leader in the 2025 Gartner Magic Quadrant for the second consecutive year. Zluri targets enterprise organizations.
- BetterCloud: All-in-one SaaS management covering security, lifecycle automation, and data loss prevention. BetterCloud was founded in 2011; Founded in 2011, BetterCloud has a significantly longer enterprise deployment track record than Corma. BetterCloud's strength is in file governance and deep security policy enforcement across Google Workspace, Microsoft 365, Slack, and Zoom.
- Zylo: Zylo is an enterprise SaaS management platform with strengths in contract tracking and spend benchmarking, and it integrates with procurement and finance systems. Zylo is enterprise-focused; Corma targets mid-sized organizations and emphasizes access governance alongside SaaS license management and cost optimization rather than procurement workflows alone.
- Nudge Security: Security-first SaaS management covering continuous monitoring and risk assessment. Nudge Security emphasizes SaaS discovery, security integration, and spend management features.
The SaaS management market spans procurement-first, security-first, and governance-first tools. Corma sits at the intersection of license management and identity governance, which makes it most comparable to Zluri for feature coverage, while remaining more accessible for teams that aren't ready for enterprise-scale tooling.
