Corma versus Lumos
Looking for an alternative to Lumos? Lumos builds autonomous identity governance for enterprises, driven by its AI agent Albus. Corma brings identity-first governance to growing IT teams in Europe, so every app, license and euro is tied to a person and their access.
Identity-first SaaS management. Access, compliance, and spend through governance.
Autonomous identity platform. Employee AppStore, AI agent Albus and enterprise IGA.
.avif)
.avif)
Lumos is a San Francisco-based identity company that calls itself the first Autonomous Identity Platform. It combines identity governance, privileged access and SaaS management, offers employees a self-service AppStore in Slack or Teams, and uses its AI agent Albus to mine roles, run first-pass access reviews and remediate risk. Lumos has raised $65M from investors including Andreessen Horowitz and Scale Venture Partners.
Mid-market and large enterprises
2020 in San Francisco by Andrej Safundzic, Alan Flores-López and Leo Mehr
Comparing Corma and Lumos? Both govern who has access to which apps, automate onboarding and offboarding and cut unused licenses. This comparison covers access requests, access reviews, lifecycle automation, AI, SaaS discovery, license optimization and total cost.
Lumos is built around autonomous identity. Founded in San Francisco in 2020, it brings identity governance, privileged access and SaaS management into one platform. Employees request apps, roles or temporary admin rights in an AppStore inside Slack or Teams, while the AI agent Albus mines roles from HR and usage data, does the first pass of access reviews and flags drift and segregation-of-duties issues. In 2026 Lumos extended this into a group of identity agents covering human, machine and AI identities.
Corma is identity-first and built in Europe for growing IT teams. It connects to the identity provider and HR system you already run, finds apps through finance data, a browser extension and a Windows agent, and ties every application, license and euro to a person and their access. Provisioning, requests, reviews and license control sit in one product, hosted in the EU and ISO 27001 certified, with a free tier to start.
The dividing line is depth versus speed to value. Lumos goes deeper on AI-driven governance for enterprises with complex roles. Corma gets a mid-market team to governed access and lower SaaS spend quickly, without an enterprise identity programme. Read the full Corma versus Lumos comparison to see which fits your team.
The Comparison
Lumos merges identity governance, privileged access and SaaS management into an autonomous identity platform for enterprises, with an employee AppStore and an AI agent that mines roles and reviews access. Corma covers the governance core for growing IT teams: lifecycle, requests and reviews driven by your identity provider and HR system, with license usage and spend on the same record. Both aim at least privilege; they differ in scale, AI depth and how long it takes to get there.
Identity-first: every app, license and cost is tied to a person and their access.
Autonomous identity: IGA, privileged access and SaaS management, with the AI agent Albus acting on access risk.
Native provisioning and deprovisioning, driven by your identity provider and HR system.
Lifecycle automation across 300+ integrations, with roles mined by Albus from HR and usage data.
Self-service catalog with approval workflows; approved access is provisioned automatically.
AppStore in Slack, Teams or the web for apps, roles and temporary admin rights.
Built-in review campaigns with exportable evidence for ISO 27001, SOC 2 and NIS2.
Agentic access reviews: Albus does the first pass and surfaces the exceptions for people.
Identity provider, finance data, browser extension and Windows agent — sanctioned and unsanctioned apps.
Apps, accounts and entitlements discovered across 300+ integrations, including last-used data.
Ungoverned tools surface together with the accounts behind them, so access can be revoked from the same place.
Orphaned accounts, unused entitlements and access drift flagged for human, machine and AI identities.
Unused licenses surface from access data and can be revoked or canceled in one click.
Unused licenses identified from usage data within the SaaS management module.
Renewal dates, notice periods and spend forecasts in one view.
Software vendors and spend managed next to identities in the same platform.
Connected in minutes, productive within days to weeks, no professional services required.
Enterprise rollouts; Lumos cites Roku launching its AppStore in under 90 days.
Free tier, then per-user plans — you can start without talking to sales.
AWS Marketplace lists $27,000 per year for 250 users plus $180 per additional user; Vendr data puts the median deal at about $29,250.
Growing IT teams and mid-market organizations, roughly 50 to 5,000 employees.
Mid-market to large enterprise, including customers with more than 100,000 employees.
EU-hosted and ISO 27001 certified, with support in English, French and German.
San Francisco-based, backed by $65M from investors including Andreessen Horowitz and Scale Venture Partners.
Core SaaS governance with license and spend control, without a dedicated identity team.
Identity agents for role mining, segregation-of-duties checks and remediation across human, machine and AI identities.
Which platform fits your team?
Corma is best for
Teams that need EU data residency and ISO 27001 as a baseline
IT, security and compliance teams that have to prove who has access to what
Mid-market teams that want governance live without an enterprise rollout
Teams that want to start on a free tier
Lumos is best for
Enterprises with complex role models and segregation-of-duties needs
Organisations that want an AI agent to mine roles and triage reviews
Companies that want an employee AppStore in Slack or Teams
Security teams governing machine and AI identities next to people
Setup at a glance
Deployment in days to weeks for SMBs
Identity provider, HR system and core apps connected
Connects to your existing identity provider and HR system
AppStore published in Slack, Teams or the web
RBAC policies and approval workflows configured
Roles and policies proposed by Albus and approved by admins
Ongoing maintenance mostly automated by the platform
Lifecycle workflows and temporary admin access configured
User training focused on self-service access requests
Agentic access reviews scheduled, with exceptions routed to owners
Why IT teams rely on Corma
Automation
employees onboarded and offboarded automatically
Time spent
spent less with Corma per week for management
Cost Efficiency
saved monthly by optimizing SaaS licenses
Shadow IT
to detect Shadow IT applications
What IT teams say about Corma
“Corma is very useful and user friendly. It helps us save money and prevent potential security threats.”
Chief Operating Officer, Media
“I like how it’s very easy to see all the apps that have been accessed by our employees.”
Chief Engineering Officer, Healthcare and Biotech
“I think Corma is a really great app that has lots to offer and working with them has been great.”
IT & Security Administrator, Software
An AI identity programme, or governance live this quarter?
Lumos is a strong choice for enterprises that want AI deep in identity: role mining, agentic reviews, segregation-of-duties checks and an AppStore employees actually use. Corma focuses on growing IT teams that want the same core controls without an enterprise programme — identity-driven lifecycle, reviews and license control — from a European vendor with EU hosting and a free start. A demo on your own stack shows which path fits your team.
Book a demoCan Corma help with EU data privacy better than Lumos?
Yes, Corma’s EU-focused controls support GDPR specifically; Lumos is designed more around identity governance and automation across global environments.
How do Corma and Lumos differ on spend control?
Corma reduces SaaS license waste directly; Lumos also tracks spend and usage but ties it into wider access and lifecycle management.
What makes Corma more secure than Lumos?
Corma focuses on SaaS identity and access controls; Lumos emphasizes autonomous identity and broader access governance across IT and SaaS.
