It uses a distributed consensus algorithm to validate transactions. Anyone can run a validator node, and there are many companies/institutions out there doing that (Microsoft, MIT, etc).
The key property of Ripple you have to understand is that the consensus is decided by a set of nodes controlled by the Ripple team and their partners, and those nodes don't care about the opinion of any other node that's not on their whitelist. Everyone else just listens to what they decide the consensus is and follows along. While in theory you could listen to a different set of nodes, it'd be daft to: if those nodes ever come to a different consensus than the default nodes then you're screwed, and who you trust has no effect on who the default nodes listen to or how their consensus is formed.