SureStep IT Inc.
SureStep IT Inc. is a GRC and Financial Crimes advisory firm delivering regulatory data (Meridian), a regulatory LLM (Compass), and a GRC analyst workbench (Navigator) to 100+ enterprise clients across 26 industries, with regional offices in Canada, the US, Singapore, and Hong Kong.
- Company typePrivate
- Founded2009
- HeadquartersMarkham, Canada
- Headcount11–50
- GTM typeB2B
- OfferingServices
What SureStep IT Inc. does
SureStep IT Inc. is a privately held Governance, Risk, Compliance (GRC) and Financial Crimes advisory firm founded in 2009. Headquartered in Markham, Ontario, Canada, the company operates from offices in the United States, Singapore (since 2021), and Hong Kong, and reports more than 100 clients across 26 industries, with visible concentration in financial services, insurance, banking, healthcare, and the defense and government sector. The firm is founder-led by C. Michael Gibbs, with Stacie Heffern as COO and Joshua Andrews as Head of Client Services.
The product stack is anchored by three platforms: Meridian, the regulatory and risk data layer covering 73,000+ cited obligations across 150+ regulatory bodies; Compass, a fine-tuned regulatory large language model (LLM) using retrieval-augmented generation over Meridian, deployed on NVIDIA's DGX, TensorRT-LLM, and NIM microservices stack under a partnership with Onyx AI Labs, with Ed25519 cryptographic signing of outputs and support for on-premises and air-gapped deployments; and Navigator, the analyst-facing workbench. SureStep holds SOC 2 Type II certification, is a Climate Pledge signatory, and is a member of the Singapore FinTech Association and the NVIDIA Inception program.
Revenue is generated through a portfolio of advisory and consulting engagements, GRC platform implementations (notably IBM OpenPages, where the firm is an IBM Silver Partner, and SAS), managed services, Cloud Transformation projects, and Compass API subscriptions. Distribution is amplified through formal partnerships with IBM, SAS, AWS, ServiceNow, NVIDIA, and Onyx AI Labs, positioning the firm as a systems-integrator-adjacent vendor with proprietary AI-augmented IP rather than a pure consulting shop.
SureStep IT Inc. firmographics
Firmographics- Name
- SureStep IT Inc.
- Legal name
- SureStep IT Inc.
- Website
- https://surestepsi.com
- Company type
- Private
- Founded year
- 2009
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- SureStep IT Inc. is a GRC and Financial Crimes advisory firm delivering regulatory data (Meridian), a regulatory LLM (Compass), and a GRC analyst workbench (Navigator) to 100+ enterprise clients across 26 industries, with regional offices in Canada, the US, Singapore, and Hong Kong.
- Ownership category
- akta.pro rank
SureStep IT Inc. industry classification
Industry- Product category
- Governance, Risk, and Compliance (GRC) Software and Services
- NAICS
- Computer Systems Design and Related Services (54151), Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (518210)
- SIC
- Services-Computer Programming, Data Processing, Etc. (7370)
- akta.pro primary industry
- Governance, Risk & Compliance (GRC) Platforms (BPAEAPAA)
- akta.pro secondary industry
- Risk, Controls & Governance (GRC) Platforms (FSAFAOAG)
Keywords
Where SureStep IT Inc. is headquartered
LocationHeadquarters
- HQ city
- Markham
- HQ country
- Canada
- HQ region
- North America
Offices4 records
Markets served
SureStep IT Inc. business model
Business model- GTM type
- B2B
- Offering type
- Services
- Cost components
- Personnel, Technology or R&D, Operations, Marketing or Sales
Revenue model
- Advisory and Consulting Services: Strategic guidance on GRC, ESG, and risk transformation programs ranging from SMB to large enterprise engagements. Includes GRC Forge assessments that uncover gaps and deliver roadmaps.
- GRC Platform Implementation: End-to-end implementation services across IBM OpenPages, ServiceNow IRM, and SAS platforms. Includes configuration, customization, data migration, and deployment services.
- Managed Services: Ongoing platform management, support, and optimization services including administration, monitoring, updates, and BAU enhancements. White-glove service model.
- Compass API Access: API access to the Compass regulatory intelligence engine with cryptographic audit trails. Offered as cloud, dedicated cloud, on-premises, or air-gapped deployment.
- Cloud Transformation Services: Secure, compliant migration of GRC platforms to AWS including managed services and GRC Data Lake implementation.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Other | Multi-year contract | Enterprise Advisory Services |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels8 records
SureStep IT Inc. product offering
Product offeringCore offering
SureStep is a GRC and Financial Crimes advisory firm that sells advisory, implementation, managed, and cloud transformation services alongside its proprietary GRC Navigation System — a three-layer AI platform (Meridian data layer, Compass intelligence API, Navigator workbench) that monitors 150+ regulatory bodies, delivers citation-backed compliance answers with cryptographic audit trails, and automates regulatory change impact assessment for enterprise compliance teams.
Product overview
SureStep offers the GRC Navigation System, a three-layer integrated platform consisting of Meridian (regulatory data layer monitoring 150+ regulatory bodies), Compass (regulatory intelligence API powered by Onyx AI Labs with 73K+ cited obligations), and Navigator (AI-powered GRC workbench for regulatory change assessment and action planning). The system provides end-to-end regulatory change management with cryptographic audit trails from raw alerts to board-ready action plans. Meridian feeds Compass via RAG, and Compass powers Navigator's AI assessments.
Differentiator
Problem solved
Functional benefit
Brands
- Meridian: A living regulatory intelligence data layer monitoring 150+ regulatory bodies across five countries with structured obligations and daily change detection.
- Compass
- Navigator
- SureStep Fortress (S2 Fortress)
- SecureGRC
- GRC Forge
Products and services
- Meridian A living regulatory intelligence data layer monitoring 150+ regulatory bodies across five countries, providing structured obligations, daily change detection with before/after diffs, and source-faithful snapshots of regulatory documents. Designed for compliance and risk teams at regulated enterprises.
- Compass A fine-tuned regulatory intelligence LLM (powered by Onyx AI Labs) with RAG retrieval from 73K+ cited obligations across 20+ frameworks, providing citation-backed natural language compliance Q&A with Ed25519 cryptographic audit receipts. Available as cloud, dedicated cloud, on-premises, or air-gapped deployment for regulated enterprises and developers.
- Navigator An AI-powered GRC workbench that reads regulatory changes, determines applicability, maps impact across six dimensions (policies, controls, procedures, products, training, contracts), and generates prioritized action plans with human-in-the-loop approval. Integrates with IBM OpenPages, ServiceNow IRM, and RSA Archer.
- GRC Navigation System The integrated three-layer platform combining Meridian (data), Compass (intelligence), and Navigator (interface) for end-to-end regulatory change management from raw alerts to board-ready action plans with cryptographic verification.
- SecureGRC An AWS-hosted managed IBM OpenPages environment for GRC operations, providing a turnkey cloud alternative to on-premises OpenPages deployments.
- SureStep Fortress (S2)
Quantifiable outcome
- Regulatory change analysis reduced from 2-4 weeks to hours with AI-powered Navigator
- +7 more outcomes
Companies that use SureStep IT Inc.
Customer profileNamed customers15 records
Segments8 records
Ideal customer profiles3 records
SureStep IT Inc. technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration4 records
AI capability4 records
Feature6 records
SureStep IT Inc. partnerships and signals
Strategic signalPartnerships
17 partnerships are on record, tiered core, supporting, strategic and regional.
- SAScoreStrategic partnership to revolutionize financial crimes management with AI-driven solutions. SureStep serves as a SAS partner providing implementation and advisory services for SAS Viya, SAS MRM, SAS AML, and SAS GCM. Co-marketing at SAS Innovate events and joint thought leadership.
- IBMcoreSilver IBM Business Partner specializing in IBM OpenPages implementation. SureStep has completed numerous IBM OpenPages deployments, upgrades, and migrations. Collaborative delivery with IBM on client engagements.
- AWScoreAWS is a trusted technology partner for cloud transformation services. SureStep offers SecureGRC - an AWS-hosted managed IBM OpenPages environment. AWS carbon offsets are used for SureStep's own ESG program.
- ServiceNowcoreSureStep implements and integrates with ServiceNow IRM. Custom connectors have been developed for ServiceNow integration with IBM OpenPages and other platforms.
- Onyx AI LabscoreCompass regulatory intelligence LLM is powered by Onyx AI Labs. Onyx AI Labs provides the fine-tuned model infrastructure, Ed25519 signing infrastructure, and RAG retrieval system for Compass.
- NVIDIAcoreCompass is built on the NVIDIA stack including DGX hardware, TensorRT-LLM inference acceleration, and NIM microservices. Member of NVIDIA Inception Program.
- IBM CognossupportingIBM Cognos is used for reporting and analytics within GRC implementations. Integrated with IBM OpenPages for real-time CDE reporting and dashboard solutions.
- RSA ArchersupportingSureStep supports RSA Archer implementations as part of its GRC Solutions practice. Connector framework supports Archer integration with Navigator.
- Climate Pledge SignatorystrategicSureStep has signed The Climate Pledge, committing to net-zero carbon emissions by 2040 - a decade ahead of the Paris Agreement. Implements own ESG frameworks.
- Singapore FinTech AssociationregionalSureStep Fortress (S2) achieved certification by the Singapore FinTech Association, enabling go-to-market for SMB compliance solutions in APAC.
- Empowered SystemssupportingStrategic partnership announced for collaboration on GRC solutions and market expansion.
- SupplyWisdomsupportingPartnership connecting supply chain risk management with GRC programs. Joint go-to-market for integrated risk solutions.
- OCEGsupportingPartnership around Principled Performance methodology and GRC best practices. Training and certification alignment.
- QualyssupportingPart of trusted technology partner ecosystem for security and compliance integration.
- CubesupportingIBM OpenPages and ServiceNow connectors for Cube regulatory and ESG data platform.
- Data SentinelsupportingPart of trusted technology partner ecosystem for data governance and compliance.
- EPSsupportingPart of trusted technology partner ecosystem.
Scale indicators7 records
Recent moves7 records
Expansion highlights5 records
SureStep IT Inc. competitors and assessment
Company assessmentBroad incumbents
- RSA (Archer):
- ServiceNow (Integrated Risk Management): ServiceNow IRM is a large enterprise GRC platform SureStep integrates with. It is a broad incumbent whose embedded AI and workflow capabilities overlap with Navigator for risk and compliance operations.
- IBM (OpenPages): IBM OpenPages is a broad GRC platform that SureStep implements and extends. IBM is both a core partner (Silver Business Partner) and a broad incumbent whose native AI capabilities compete with Compass and Navigator.
Emerging players
- LogicGate: LogicGate offers a no-code GRC platform (Risk Cloud) for risk, compliance, and security teams. It is an emerging competitor with partial overlap on the workflow and policy automation side of SureStep's Navigator offering.
Direct peers
- AuditBoard: AuditBoard is a cloud-based audit, risk, and compliance platform popular with mid-market and enterprise customers. It competes head-to-head with SureStep's GRC Navigation System on internal audit, SOX, and risk management use cases.
- Diligent: Diligent is a GRC SaaS platform serving boards, risk, and compliance functions across regulated enterprises. Directly comparable to SureStep's enterprise GRC platform and advisory positioning, with overlap on risk, audit, and compliance workflows for large organizations.
- NAVEX Global: NAVEX provides ethics, risk, and compliance software including policy management, whistleblower, and GRC workflow tools. It is a direct competitor in the enterprise GRC and compliance operations category that SureStep targets.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks6 records
Key highlights7 records
Customer concentration
SureStep IT Inc. social profiles
Digital presenceSureStep IT Inc. compliance and trust
Trust signalCompliance1 record
SureStep IT Inc. financial estimates
Financial estimateRevenue estimate
Valuation estimate
SureStep IT Inc. leadership team
Management profileNumber of profiles
Profiles3 records
SureStep IT Inc. funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
SureStep IT Inc. M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about SureStep IT Inc.
What does SureStep IT Inc. do?
SureStep is a GRC and Financial Crimes advisory firm that sells advisory, implementation, managed, and cloud transformation services alongside its proprietary GRC Navigation System — a three-layer AI platform (Meridian data layer, Compass intelligence API, Navigator workbench) that monitors 150+ regulatory bodies, delivers citation-backed compliance answers with cryptographic audit trails, and automates regulatory change impact assessment for enterprise compliance teams.
Is SureStep IT Inc. a public or private company?
SureStep IT Inc. is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was SureStep IT Inc. founded?
SureStep IT Inc. was founded in 2009. It employs 11 to 50 people.
Where is SureStep IT Inc. based?
SureStep IT Inc. is headquartered in Markham, Canada, in the North America region.
How does SureStep IT Inc. make money?
Five revenue lines are on record. Advisory and Consulting Services are the primary driver. The others are GRC Platform Implementation, managed Services, compass API Access and cloud Transformation Services.
Who are SureStep IT Inc.'s main competitors?
Broad incumbents on record are RSA (Archer), ServiceNow (Integrated Risk Management) and IBM (OpenPages). LogicGate is listed as an emerging player. Direct peers are AuditBoard, Diligent and NAVEX Global.
Does SureStep IT Inc. have an API?
Yes. Compass REST API with four endpoints: POST /query (natural language compliance Q&A), POST /extract-obligations (structured obligation extraction), POST /generate-controls (mapped control generation), GET /governance/verify (independent receipt verification). Standard REST API with OpenAPI spec. One API key unlocks all capabilities. Merkle-batched API responses with Ed25519 signed receipts for non-repudiation. Deployment options include Cloud, Dedicated Cloud (single-tenant), On-Premises, and Air-Gapped. Developer documentation is at docs.onyxailabs.com/compass.
What industry is SureStep IT Inc. in?
SureStep IT Inc.'s product category is Governance, Risk, and Compliance (GRC) Software and Services. Its primary akta.pro industry code is BPAEAPAA, Governance, Risk & Compliance (GRC) Platforms, with a secondary code of FSAFAOAG, Risk, Controls & Governance (GRC) Platforms. Its NAICS code is 54151 and its SIC code is 7370.