SettleTopRegistry
SettleTopRegistry
← Back to the registry
Agent passport

Complium - AI-Native PCI DSS Compliance Platform

QSA-built SaaS helps you achieve and maintain PCI DSS compliance end-to-end, from scope to ROC/AOC

Category
AI Apps and Agents
Registry category
Cybersecurity & ITData Protection & Compliance
Vendor
EIC
Location
Not disclosed
Reviews
Not rated (0 reviews on the listing)
Listed on
Microsoft Marketplace
Pricing
4 plans listed
Overall Provenance
2.1/10Low
High 7–10Moderate 3–6.9Low 0–2.9

Each fact carries one Provenance score: the average of its Disclosure and Evidence scores, the same rule the page uses for the overall score. Click any score to see the math behind it.

Vendor Provenance

Who actually operates this agent.

0.5 / 10
Data element
Answer
Provenance
Source
Legal entity
EIC
Publisher is a handle with no company record
Low
No source on record
HQ address
Not disclosed
No headquarters on the listing or an outside record
Low
No source on record
Ownership
Not disclosed
No ownership on record
Low
No source on record
Industry
Not disclosed
Low
No source on record
Employee count
Not disclosed
Low
No source on record
Founded
Not disclosed
Low
No source on record
Revenue
Not disclosed
Low
No source on record
About
QSA-built SaaS helps you achieve and maintain PCI DSS compliance end-to-end, from scope to ROC/AOC
Publisher description
High

Build Provenance

What the agent is built on.

4.2 / 10
Data element
Answer
Provenance
Source
Foundation model
Azure OpenAI
From the listing
High
Training data (model)
Not disclosed on this listing
No source discloses model training data
Low
No source on record
Agent framework / tools
Not disclosed on this listing
Low
No source on record
Hosting model
SaaS, hosted by the vendor
From the listing
High
Version history
1.0.0
Registry saw 4 distinct listing states across 9 captures
High

Reach Provenance

How the agent is distributed and adopted.

4.4 / 10
Data element
Answer
Provenance
Source
Distribution channel(s)
Microsoft Marketplace
Via SaaS
High
Review volume & rating
Not available
No ratings on the listing
Low
No source on record
Comments (pros)
Not available
No review text on record, so no pros could be drawn from user comments
—
No source on record
Comments (cons)
Not available
No review text on record, so no cons could be drawn from user comments
—
No source on record
Listing tenure
Not disclosed
No listed since date; last updated 2026-06-29
—
No source on record
Multi-channel presence
Single-channel
Listed on Microsoft Marketplace only in the registry
High
Public community signal
Not disclosed
No public GitHub, Discord or community metrics found
Low
No source on record
# installs
Not reported
Popularity index 0.00 on the marketplace; not an install count
—
No source on record
Listing type
Standard marketplace listing
From the listing
High

Data Provenance

What the vendor discloses about data handling.

1.4 / 10
Data element
Answer
Provenance
Source
Operational data sources
Not disclosed
Low
No source on record
Data residency
Not disclosed
Low
No source on record
Retention & deletion
Not disclosed
Low
No source on record
Published documentation
Legal links on the listing: Privacy Policy, License Terms
Links on the listing; documents not fetched by the registry
High
Data access requirements
Not explicitly disclosed
No OAuth scope or permission list found on the listing
Low
No source on record

Compliance Provenance

What standards the vendor meets, and who verified them.

0.0 / 10
Data element
Answer
Provenance
Source
Security
SOC 2
None on record
Low
No source on record
ISO/IEC 27001
None on record
Low
No source on record
ISO/IEC 27002
None on record
—
No source on record
ISO/IEC 27017
None on record
—
No source on record
SOC 3
None on record
—
No source on record
CSA STAR
None on record
—
No source on record
Privacy
GDPR
None on record
Low
No source on record
COPPA
None on record
—
No source on record
FERPA
None on record
—
No source on record
ISO/IEC 27018
None on record
—
No source on record
Health
HIPAA
None on record
Low
No source on record
HITRUST CSF
None on record
—
No source on record
Financial
SOC 1
None on record
—
No source on record
PCI DSS
None on record
—
No source on record
SOX
None on record
—
No source on record
Government
FedRAMP
Not found on the FedRAMP Marketplace
Checked by the vendor's web domain on 2026-08-27
Low
CMMC
None on record
Low
No source on record
NIST SP 800-171
None on record
—
No source on record
AI
NIST AI RMF
None on record
Low
No source on record
Platform
3rd party certification
None on record
Low
No source on record

What the publisher says

Complium: QSA-Engineered SaaS for PCI DSS v4.0.1

Complium is an end-to-end SaaS platform for achieving and maintaining PCI DSS v4.0.1 compliance. Built by EIC Limited—a Qualified Security Assessor (QSA) company—the platform mirrors an assessor's exact workflow. Evidence is structured per requirement for Report on Compliance (ROC) work, guiding you from scoping to the final deliverables. The entire workflow is strictly human-gated: AI operates as a tool to organize data, not as an assessor. EIC's embedded QSA independently reviews all evidence to determine final compliance, validate the ROC, and sign the Attestation of Compliance (AOC).

One Firm, Platform, and Validation: Most tools provide software only, forcing you to separately engage an assessment firm. Complium is exclusively delivered by EIC Limited. Because the SaaS platform and the assessment come from the same firm, EIC's QSA is embedded in the workflow. Your evidence is automatically structured for the exact process they use to validate your environment. EIC confirms QSA qualification for your region prior to onboarding.

Show the rest of the publisher’s description (19 more lines)

Azure-Connected Evidence Automation (Read-Only):

  • Microsoft Entra ID: Access-control and authentication evidence (Req 7, 8).
  • Azure Activity Logs: Audit-logging evidence (Req 10).
  • Microsoft Defender for Cloud: Configuration posture across network, secure-configuration, data-protection, and vulnerability families (Req 1–4, 6, 11). (Note: Cloud evidence covers a subset of testable controls; the rest is assessed via the platform by EIC's embedded QSA).

Six AI Capabilities (All Human-Reviewed): Powered by Azure OpenAI through a configurable provider layer:

  • Evidence Analysis: Extract and classify documents.
  • Compliance Copilot: Retrieval-augmented Q&A on PCI DSS v4.0.1.
  • Requirement-Status Suggestions: Proposed status with reasoning.
  • ROC Finding Narratives: Draft justifications for review.
  • Cloud Control Mapping: Map Defender findings to requirements.
  • Remediation Guidance: Plain-language steps for gaps.

Every AI output is a draft. No status is recorded or report produced until EIC's embedded QSA explicitly reviews and accepts it, in strict alignment with PCI SSC AI guidelines.

Data Isolation & Graph API Scopes: Complium requests zero write permissions, protects data with strict row-level security, and connects via Admin-Consent OAuth2, Azure Lighthouse, or Service Principal using these read-only scopes:

  • — Account-status inventory (Req 8)
  • — Directory configuration (Req 8)
  • — Sign-in and directory audit logs (Req 10, 7)
  • — Authentication and MFA policy (Req 8)
  • — Directory role assignments (Req 7)

Published by EIC Limited, a Qualified Security Assessor (QSA) company.

Preview

5 images

Plans and pricing

4 plans listed

Complium SAQ-D: AI-Assisted Workflow & In-App QSA Review$9,000.00/year Includes: 1-Year SaaS platform license, environment scoping tools, automated evidence collection, AI-assisted SAQ-D workflows, embedded QSA review, and final AOC generation.
Complium SAQ-A: AI-Assisted Workflow & In-App QSA Review$4,500.00/year Complium SAQ-A is built for e-commerce and mail/telephone-order merchants that fully outsource payment processing (for example, a hosted payment page or third-party processor). The platform maps your environment — iFrames and URL redirects — to the applicable SAQ-A requirements, with automated evidence collection and AI-drafted summaries, status suggestions, and narratives to speed documentation. Every AI-drafted artifact is routed to EIC Limited's certified QSAs for independent human review before it is accepted; AI never determines compliance status. Includes a 1-year platform license, automated evidence collection, AI-assisted documentation workflow, in-app QSA review, and Attestation of Compliance (AOC) output.
Complium ROC: AI-Assisted Evidence & In-App QSA Review$22,500.00/year Includes: 1-Year SaaS platform license, optional Azure cloud-evidence integration, automated evidence collection, AI-assisted ROC preparation workflows, embedded QSA review, and final ROC/AOC generation.
Complium PCI DSS SAQ A-EP / B / C / C-VT / P2PE / SPoC$6,000.00/year Complium for SAQ Types is an end-to-end SaaS workspace for merchants eligible for specific, tailored PCI DSS v4.0.1 SAQs. One subscription covers any applicable SAQ type, eliminating the need for separate tools.

Linked repositories

Unknown

Unknown means this listing does not publish a repository. It is not a statement that the code is closed.

Publisher resources

Sources

Reading the score

Disclosure · how many sources corroborate it

NoneNo source has it. Shown red, because Unknown means Unknown.
1 sourceA single place has it. A listing and its certification page and policy docs on one marketplace count as one source.
2+ contestedTwo or more sources cover it but they do not agree. The disagreement is shown, never dropped.
2+ agreeingTwo or more genuinely separate sources agree: another marketplace, or an outside record.
Steps below are possible but not automated yet, so today they sit open.
SettleTop confirmedSettleTop confirms it directly.

Evidence · what kind of evidence backs it

NoneNo source discloses it.
PublicPublicly available info, such as reviews, listing age, or vendor firmographics like legal entity and headquarters.
Vendor statedThe vendor's own claim on its marketplace listing, website, or policy documents.
Self-attestedThe vendor's self-attested certification or operator program, a marketplace program rather than an independent audit.
Steps below are possible but not automated yet, so today they sit open.
Vendor providedThe vendor hands SettleTop the underlying material, such as an SBOM or a data policy.
Vendor attestedThe vendor signs an attestation to SettleTop.
SettleTop verifiedSettleTop verifies it directly.

The SettleTop steps above are possible but not automated yet, so today they sit open and a perfect 10 is out of reach. Open information like firmographics and reach has fewer steps to climb, so it sits a little higher for the same visible evidence.

Information shown here reflects the best available information at the time of assessment and may be incomplete, outdated, or subject to change. It should be independently verified before being relied upon for any decision. SettleTop is not liable for any errors, omissions, or decisions made in reliance on this information.

Have information about this agent?

Send it to us for consideration

Spot something missing, wrong, or out of date? Share what you know. Every note reaches our team. It does not change the passport by itself: we review it first.

Name

Suggest specific values (optional)
Vendor Provenance

Build Provenance

Reach Provenance

Data Provenance

Compliance Provenance

A note to our team, not a change to the page. Prefer email? Write to support@settletop.com.