The revealing thing about a large company is not how many people work there. It is how many other companies work there without appearing on the payroll. Caterers enter the building. Cloud vendors enter the servers. Lawyers enter the contracts, manufacturers enter the supply chain and payment processors enter the cash register. Each arrival is accompanied by a small parade of questions: Who owns you? Where is your data? Are you sanctioned? Will you still be solvent on Tuesday?
Certa.ai makes software for that parade. Founded by Jagmeet “Jag” Lamba in 2017, the Saratoga company is neither simply a procurement tool nor merely a cyber-risk score. It is a configurable operating layer for the entire third-party relationship - intake, checks, contracts, approvals, monitoring, remediation and goodbye. The mundane phrase is “third-party risk management.” The more accurate phrase is institutional trust with receipts.
- What it does: joins third-party data, policy, tasks and evidence in one lifecycle.
- Who buys it: large, regulated companies including Uber, Box, Mars, Honeywell and Aviva.
- How it earns: annual enterprise SaaS contracts, quoted to fit modules, volume, integrations and AI use.
- The useful idea: agents clear routine work; people decide the consequential exceptions.
01 / THE CLUEA form that took too long
Lamba encountered the problem while working with large organizations at McKinsey. Promising vendors could spend an absurd amount of time becoming approved vendors. The delay looked administrative, which is why it was easy to underestimate. But a slow approval is a slow product launch, a late payment, a supplier who walks away or a risk waved through because everybody is tired of the process.
The first move was not to invent a universal rulebook. It was to let enterprises preserve their own. Certa's no-code Studio turns policies into forms, decision logic, task queues and approvals. Its integrations pull in data from systems such as Coupa, SAP Ariba, Oracle, NetSuite, D&B and specialist screening providers. A third party can then move through one record instead of being recreated in procurement, legal, finance, security and compliance.
Engineer, former consultant, and the man who looked at vendor onboarding and decided the form was the plot.
02 / THE PROOFSeven hundred suppliers walk into a workflow
Uber was the sort of early customer that could either prove the idea or flatten it. At points it was adding more than 700 suppliers a month across countries, languages and business units. The existing onboarding work was manual and outsourced. Transparency was poor, errors were common and only about 40 percent of payments arrived on time.
Certa centralized the workflow and its dashboards. Uber later reported a 50 percent year-over-year reduction in operating cost and on-time payment rising to 95 percent. Box, another named customer, reported that its cycle time fell by more than 78 percent. Those are customer-reported results, not a universal promise, but they expose the real economic argument. The saving is not one clever model. It is fewer handoffs, fewer duplicate facts and less hunting for the person who owns the next click.
“Humans stay in control. Agents take the busywork.”Certa's operating principle
03 / THE CHANGEFrom automating steps to rationing attention
Certa's early product automated onboarding. The newer thesis is broader and more interesting: risk teams should manage by exception. Its Data Agent gathers web and document evidence and pre-fills questionnaires. The Risk Agent looks for signals inside contracts and control frameworks. The Adjudicate Agent dismisses false positives, approves low-risk cases within policy or sends a recommendation with reasons to a person.
That is a careful change in emphasis. Old automation asked, “Can software finish this task?” Exception management asks, “At which moment is human judgment worth its cost?” Certa says its current Data Agent reaches 95 percent accuracy with more than 80 percent coverage, while adjudication can make analysts four times as efficient. Those figures come from the company; the practical test is whether linked evidence lets a skeptical reviewer reproduce the conclusion.
The 2025 release of OS3 rebuilt the foundation around this division of labor. Navigation became simpler, entity records gained a 360-degree view, and administrators could change workflows in natural language. Enterprise controls such as SCIM, role permissions and audit histories remained the unshowy but indispensable half. In compliance software, a fluent answer without provenance is not intelligence. It is gossip wearing a tie.
Early customers did. Lamba has described refusing to let adopters down and changing the product around their needs. The lesson was that a point solution was insufficient: enterprises wanted one configurable layer spanning procurement, risk, legal, finance and compliance.
04 / THE BILLNo price tag, because the work is the price tag
Certa publishes no list price and offers no verified self-serve plan. Contracts are quoted. The variables include which risk domains are enabled, how many third-party records are managed, which systems must connect, which AI agents are included and how much implementation is required. This is normal enterprise arithmetic, though never especially charming.
| Cost driver | What expands the bill |
|---|---|
| Scope | More risk domains, geographies and third-party types |
| Volume | More records under management and monitoring |
| Connections | ERP, procurement, identity, contract and data integrations |
| Change | Policy mapping, workflow design, training and governance |
What failed first? Independent reviews have historically pointed to basic dashboards, limited reporting customization, integration documentation and scalability constraints. Certa's response is visible in the product sequence: OS3 was explicitly rebuilt for speed, scale and simpler navigation, while newer agents emphasize evidence and adjudication. A buyer should still ask for current references at comparable volume. Software road maps are full of fixed problems that remain surprisingly lively in production.
05 / THE MARKETThe connective tissue, not another organ
Certa competes in three directions at once. ServiceNow, SAP Ariba and Coupa offer broad enterprise suites. ProcessUnity, OneTrust and similar platforms cover governance and third-party risk. BitSight, SecurityScorecard, UpGuard and a host of specialists sell a particular signal or risk domain. Certa's position is orchestration: keep the third-party record and make all those systems useful in one process.
Broad systems of work, often powerful but heavy to alter.
A configurable lifecycle joining people, agents, policies and outside data.
Deep specialist signals that still need somewhere to go.
That positioning explains partnerships with EcoVadis for sustainability ratings, Resistant AI for document forensics, Trustpair for bank-account verification, Xapien for enhanced due diligence and Box Sign for signatures. Certa need not be best at producing every signal if it is the place where signals become decisions.
The model fits a company with thousands of third parties, multiple regulators and enough repetition to reward automation. It fits poorly when there is no agreed policy to encode, too little volume to justify implementation, or no executive willing to settle arguments between procurement, security and compliance. No-code does not mean no decisions. An elegantly automated muddle is still a muddle, only punctual.
06 / THE COPYABLE BITDesign the exception before buying the agent
The lesson other companies can borrow costs nothing: map the ordinary case, define the evidence required to clear it and write down precisely which exception demands a person. Then measure handoffs, cycle time, rework and false positives. Only after that should software enter the conversation. Uber's memorable result was not a chatbot. It was a leaner centralized system with an owner, a queue and visibility.
Certa has since grown into more than 100,000 users, over 120 countries and 10 million entities processed. In 2026, Gartner placed it in the Leaders quadrant of its first Magic Quadrant for this category, and Aviva chose it after a competitive process to support nine risk domains across several businesses and jurisdictions. The small annoyance that began the company has become board-level infrastructure.
This is Certa's cleverest observation: a company does not have a perimeter anymore. It has relationships. The quality of the company increasingly depends on how quickly it can begin the good ones, notice the dangerous ones and end the wrong ones. Somewhere in between, a form is waiting. At least now it knows where to go.