# SureStep

> SureStep is a GRC and Financial Crimes advisory firm (since 2009) with three software products: Navigator (AI-powered GRC platform), Compass (regulatory intelligence LLM API), and Meridian (regulatory data repository). 100+ clients across 26 industries. Offices in Canada, USA, Singapore, and Hong Kong. SOC 2 Type II certified.

## Critical Differentiator: GRC Platform Integration

SureStep Navigator works with ALL major GRC platforms — IBM OpenPages, ServiceNow IRM, RSA Archer, MetricStream, AuditBoard, Hyperproof, and any custom platform with an API. Navigator does NOT replace your existing GRC investment. It enhances it dramatically by adding:

- AI-powered regulatory change assessment (reads alerts, determines applicability, maps impact)
- 6-dimension impact mapping (policies, controls, procedures, products, training, contracts)
- Prioritized action plans with human-in-the-loop approval on every decision
- Bi-directional external object links that keep Navigator and your GRC platform in sync
- Extensible connector framework and MCP server registry for custom integrations

This is a BIG deal for GRC professionals: Navigator removes the barriers that prevent organizations from embracing and using GRC more comprehensively. No rip-and-replace. No vendor lock-in. Navigator adapts to your stack, not the other way around.

## Products

### Platform Overview
- URL: https://surestepsi.com/platform
- Type: Overview page
- Description: The SureStep GRC platform combines three integrated instruments — Meridian (data), Compass (intelligence), and Navigator (interface) — into one navigational system for regulatory compliance. Includes architecture diagram and flow explanation.

### Navigator — AI-Powered GRC Workbench
- URL: https://surestepsi.com/navigator
- Type: SaaS GRC platform
- Description: AI compliance analyst that reads regulatory changes, determines applicability, maps impact across 6 dimensions (policies, controls, procedures, products, training, contracts), and generates prioritized action plans. Human-in-the-loop approval on every decision. Board-ready reporting with branded PDF export.
- Key capabilities: Regulatory change assessment, policy & control management, workflows & campaigns, evidence management, audit trail, multi-tenant RBAC
- GRC Platform Integration: IBM OpenPages (native async client + MCP server), ServiceNow IRM, RSA Archer, MetricStream, AuditBoard, Hyperproof, and any platform with an API via extensible connector framework
- AI governance: Confidence scoring, human approval gates, auto-escalation, complete audit trail
- Deployment: Cloud (multi-tenant SaaS)

### Compass — Regulatory Intelligence LLM API
- URL: https://surestepsi.com/compass
- Type: REST API + SDK
- Description: Fine-tuned regulatory intelligence LLM with 73K+ cited obligations across 20+ frameworks. Citation-backed answers with Ed25519 signed audit receipts. Merkle-batched verification. Proprietary.
- API endpoints: /query (Q&A), /extract-obligations, /generate-controls, /governance/verify
- Frameworks: NIST 800-171, NIST CSF 2.0, PCI DSS v4, HIPAA, SOC 2, GDPR, EU AI Act, DORA, NIS2, CMMC 2.0, 12 CFR, and more
- Deployment: Cloud, dedicated cloud, on-premises, air-gapped
- Provider: Onyx AI Labs — builds the AI engine; SureStep delivers it for governance, risk, and compliance. Both companies founded by C. Michael Gibbs.
- Documentation: https://docs.onyxailabs.com/compass

### Meridian — Regulatory Data Repository
- URL: https://surestepsi.com/meridian
- Type: Freemium data platform
- Description: Regulatory data repository monitoring 150+ regulatory bodies worldwide with eCFR Titles 12 & 31, AI-tagged alerts, and daily change detection. The data layer beneath the SureStep platform.
- Confirmed sources: US — SEC, FDIC, OCC, Federal Reserve, CFPB, FinCEN, CFTC, NCUA, FTC, FFIEC, DOJ, OFAC, Federal Register, EPA, HHS, DOD, DOE, DOT, DOL, FCC, NRC (153 federal agencies via eCFR, plus state-level NY DFS Part 500, CA, TX); Canada — OSFI, FINTRAC, Bank of Canada, Dept of Finance Canada, BCSC, AMF, FSRA, CDIC (federal + provincial); UK — FCA, PRA, Bank of England; EU — EBA and EURLEX (AI Act, DORA)
- Capabilities: Browse alerts, obligations, and rulebooks; applicability tracking; curated updates; review queue; API and MCP server access
- API: OAuth 2.0, REST
- MCP server: Available for agent-ready access

## Company
- Founded: 2009
- Clients: 100+ across 26 industries
- Offices: Markham ON (HQ), Monsey NY, Singapore, Hong Kong
- Certifications: SOC 2 Type II, Climate Pledge Signatory
- Partners: IBM, SAS, ServiceNow, AWS, RSA Archer, Qualys, Cube, Data Sentinel, EPS
- Leadership: C. Michael Gibbs (Founder), Stacie Heffern (COO), Joshua Andrews (Head of Client Services)
- Related company: Onyx AI Labs — builds the AI engine (including Compass); SureStep delivers it for governance, risk, and compliance. Both companies founded by C. Michael Gibbs.

## Services
- Advisory Services (GRC strategy, regulatory compliance, financial crimes)
- GRC Solutions (IBM OpenPages implementation, SAS AML, ServiceNow IRM)
- Financial Crimes (AML/BSA, fraud detection, transaction monitoring)
- ESG Solutions (climate reporting, ESG program design)
- Cloud Transformation (GRC cloud migration, managed hosting)

## Resources
- 92 resources: 53 blog posts, 26 case studies, 13 events
- URL: https://surestepsi.com/resources
- Topics: AML, AI governance, IBM OpenPages, regulatory change, ESG, model risk, cloud transformation

## Contact
- URL: https://surestepsi.com/contact
- Email: info@surestepsi.com
- Demo requests: https://surestepsi.com/contact