The honest test of "your data is yours" is whether you can leave with it. Not a summary of it. Not links to it that live inside the tool you are canceling. The actual thing.
Most GRC platforms fail that test quietly. Their export gives you a CSV of your registers and, for the documents that matter most (your approved policies, your collected evidence), a column of URLs. Those URLs point back into the platform you are leaving. The day your subscription ends, they break, and the files you spent a year assembling are gone.
What portability should mean
If you are moving compliance tools, four things should be true:
- You leave with the files, not references to them. Your approved policy PDFs and your evidence documents should come across as real bytes you can keep, open, and re-import anywhere.
- Nothing routes through the new vendor. Your export should run with your own credentials, on your own machine, talking only to your current platform. The company you are moving to should never touch your source system or see your keys.
- It uses supported, official APIs. No screen-scraping, no fragile automation that breaks on the next UI change, and nothing that could modify your source data. Read-only, documented endpoints only.
- The format is open. Your data should land in a documented bundle you could import into Keel, hand to a script, or simply archive. Not a proprietary blob that only one destination understands.
keel-migrate, in the open
keel-migrate is our open-source, MIT-licensed export tool. It is public and auditable, so you can read exactly what it does before you run it. You give it a read-only API key for your current platform, and it exports your data to a portable bundle on your own machine. Nothing runs on our servers, and we never see your source credentials.
What comes over today, from Vanta and Drata:
- Your registers: vendors, risks, and people, with the fields that are the most painful to re-key by hand.
- Your policies: titles, versions, approval dates, and status.
- The documents themselves: your policy and evidence files, downloaded from the source platform's official API, checksum-verified for integrity, and stored in your Keel evidence library on import. Not links. The files.
We are also honest about the edges, because accuracy is the whole point of a tool like this. A few items a platform only ever exposes as a link (for example, Vanta's approved-policy PDFs, which have no downloadable file through the API) still need a manual export. A OneTrust source is available in beta today and currently brings your users and risk register. And automated integration monitors do not transfer; you reconnect those in Keel, where they feed Keel's own continuous checks.
Built for real programs, including big ones
A mature evidence library can be large. keel-migrate handles that by splitting a very large export into several bundle files automatically, so it exports and imports reliably without running into memory limits. You import each file into Keel in any order, and because the import is idempotent (matched by source id), nothing is ever duplicated, even if you re-run it.
The in-app importer shows you a preview of exactly what will land before anything is written, so there are no surprises.
Why publish the exit
There is a strategic reason a vendor builds a great export tool and open-sources it: confidence. A company that is sure of its product does not need to trap you. Publishing the exit makes the entrance easier to trust. If we make it easy to leave with everything, the decision to arrive costs you nothing.
Your compliance program is one of the most valuable things your security team builds. You should be able to pick it up and carry it wherever you go.
See keel-migrate on GitHub, or read how migration works and start free in Keel.