# SureStep — Full Reference > This file expands on /llms.txt with fuller descriptions, verified facts, and canonical links for AI systems, procurement reviewers, and press. Every figure below is published elsewhere on surestepsi.com — see /facts for the same facts in a single declarative table. ## Company Summary SureStep is a privately held GRC (Governance, Risk & Compliance) and Financial Crimes advisory firm, founded in 2009 by C. Michael Gibbs. SureStep has guided 100+ organizations across 26 industries — from global banks to regional insurers, telecommunications giants to industrial leaders — through GRC platform implementation, financial crime detection, ESG program design, and cloud transformation. SureStep is SOC 2 Type II certified and operates offices in Markham (Ontario, HQ), Monsey (New York), Singapore, and Hong Kong. SureStep also builds and delivers three software products — Navigator, Compass, and Meridian — that together form an AI-powered GRC platform layer on top of a firm's existing advisory relationship, rather than a standalone software vendor relationship. ## Elevator Facts - Founded: 2009 - Founder: C. Michael Gibbs - Clients: 100+ across 26 industries - Certifications: SOC 2 Type II (report available to prospective and existing clients under NDA — see /security); Climate Pledge signatory - Offices: Markham ON (HQ), Monsey NY, Singapore, Hong Kong - Meridian monitors 150+ regulatory bodies worldwide daily - Compass is a fine-tuned regulatory intelligence LLM with 73K+ cited obligations across 20+ frameworks, and every response carries an Ed25519-signed audit receipt - Navigator integrates with IBM OpenPages, ServiceNow IRM, RSA Archer, MetricStream, AuditBoard, Hyperproof, and any platform with an API — it does not require replacing an existing GRC investment ## Products ### Navigator — AI-Powered GRC Workbench URL: https://surestepsi.com/navigator Navigator is an AI compliance analyst that reads regulatory changes, determines applicability, maps impact across six dimensions (policies, controls, procedures, products, training, contracts), and generates prioritized action plans. Every AI decision requires human-in-the-loop approval — nothing is auto-applied. Navigator integrates with a firm's existing GRC platform (IBM OpenPages, ServiceNow IRM, RSA Archer, MetricStream, AuditBoard, Hyperproof, or custom platforms via an extensible connector framework and MCP server registry) rather than replacing it. Deployed as multi-tenant cloud SaaS. ### Compass — Regulatory Intelligence LLM API URL: https://surestepsi.com/compass Compass is a fine-tuned regulatory intelligence LLM, delivered as a REST API and SDK, with 73K+ cited obligations across 20+ frameworks (NIST 800-171, NIST CSF 2.0, PCI DSS v4, HIPAA, SOC 2, GDPR, EU AI Act, DORA, NIS2, CMMC 2.0, 12 CFR, and more). Every response uses RAG retrieval against the cited obligation corpus and is signed with an Ed25519 audit receipt for non-repudiation; receipts are Merkle-batched so integrity can be verified independently, without trusting Onyx AI Labs or SureStep. Deployable in the cloud, dedicated cloud, on-premises, or air-gapped. Documentation: https://docs.onyxailabs.com/compass ### Meridian — Regulatory Data Repository URL: https://surestepsi.com/meridian Meridian is a regulatory data repository monitoring 150+ regulatory bodies worldwide daily, including the full eCFR obligation corpus for Titles 12 and 31, 30+ compliance frameworks, and AI-tagged classifications across nine regulatory domains. Confirmed coverage: United States — 153 federal agencies via the eCFR (including SEC, FDIC, OCC, Federal Reserve, CFPB, FinCEN, CFTC, NCUA, FTC, FFIEC, DOJ, OFAC, Federal Register, EPA, HHS, DOD, DOE, DOT, DOL, FCC, NRC), plus state-level regulations (NY DFS Part 500, CA, TX); Canada — federal and provincial regulators (OSFI, FINTRAC, Bank of Canada, Dept of Finance Canada, BCSC, AMF, FSRA, CDIC); United Kingdom — FCA, PRA, Bank of England; European Union — EBA and EU-wide regulations via EURLEX (AI Act, DORA). Meridian is the data layer beneath the rest of the SureStep platform, browsable without login, with OAuth 2.0 REST API and MCP server access for agent-ready use. ## Pricing Posture SureStep does not publish product pricing on this site. Navigator, Compass, and Meridian are quoted per engagement — contact info@surestepsi.com or https://surestepsi.com/contact for pricing. The GRC Forge assessment (https://surestepsi.com/grc-forge) is a low-cost, fixed-fee engagement scoped on an initial call, rather than published as a list price. ## The Onyx AI Labs Relationship Onyx AI Labs builds the AI engine; SureStep delivers it for governance, risk, and compliance. Compass — the regulatory intelligence model inside SureStep's GRC platform — is a Cortex brain built by Onyx. Both companies were founded by C. Michael Gibbs and share 18 years of experience serving regulated industries. ## Services - Advisory Services — GRC strategy, regulatory compliance, financial crimes - GRC Solutions — IBM OpenPages implementation, SAS AML, ServiceNow IRM - Financial Crimes — AML/BSA, fraud detection, transaction monitoring - ESG Solutions — climate reporting, ESG program design - Cloud Transformation — GRC cloud migration, managed hosting ## Partnerships Technology & implementation partners: IBM, SAS, ServiceNow, AWS, RSA Archer, Qualys, Cube, Data Sentinel, EPS. ## Links - Homepage: https://surestepsi.com - Platform overview: https://surestepsi.com/platform - Navigator: https://surestepsi.com/navigator - Compass: https://surestepsi.com/compass - Meridian: https://surestepsi.com/meridian - GRC Forge assessment: https://surestepsi.com/grc-forge - Facts (entity reference): https://surestepsi.com/facts - Security / SOC 2 Type II: https://surestepsi.com/security - About: https://surestepsi.com/about - Resources: https://surestepsi.com/resources - Contact: https://surestepsi.com/contact