Data portability
Own your compliance data
Your vendors, risks, people, policies and the documents behind them are yours. Export them with keel-migrate (an open-source tool you run on your own machine, using each platform’s official API), taking whatever each platform’s API lets out, then bring them into Keel. It reads Vanta, Drata, Hyperproof, Oneleet and Secureframe today, with OneTrust in beta. Your credentials never leave your computer.
keel-migrate is one of several things we build in the open. See all of them on our open source page.
Open source · MIT · read-only · runs locally. Vanta, Drata, Hyperproof, Oneleet and Secureframe today, with OneTrust in beta; more on the roadmap.
The open-source tool
Export on your terms, not theirs
keel-migrate is a small, auditable command-line tool. You give it a read-only API key for your current platform; it exports your data to one or more portable bundle files. Nothing runs on our servers, and we never see your source credentials.
-
Runs on your machine
A command-line tool you run yourself. Your API credentials never leave your computer and are never written to disk or sent to Keel.
-
Official APIs, read-only
Talks only to the source platform’s own documented API, over HTTPS, read-only. It never scrapes the UI and cannot modify anything in your source system.
-
Open source (MIT)
The whole tool is public and auditable: read exactly what it does before you run it. No black box, no account required.
-
A neutral, open format
It writes one or more documented bundle files (a large export is split automatically). Import them into Keel, or keep them. The format is open, so your data is not locked to any destination.
# No install step. Requires Node.js 18.17+.
# Vanta (read-only OAuth client)
export VANTA_CLIENT_ID=… VANTA_CLIENT_SECRET=…
npx keel-migrate export --source vanta --out ./out
# Drata (read-only API key)
export DRATA_API_KEY=…
npx keel-migrate export --source drata --out ./out
# Hyperproof (OAuth client with read-only scopes)
export HYPERPROOF_CLIENT_ID=… HYPERPROOF_CLIENT_SECRET=…
npx keel-migrate export --source hyperproof --out ./out
# Oneleet (API service key and tenant id)
export ONELEET_API_KEY=… ONELEET_TENANT_ID=…
npx keel-migrate export --source oneleet --out ./out
# Secureframe (API key and secret)
export SECUREFRAME_API_KEY=… SECUREFRAME_API_SECRET=…
npx keel-migrate export --source secureframe --out ./out
# OneTrust (beta: read-only OAuth client; exports users + risks)
export ONETRUST_HOSTNAME=… ONETRUST_CLIENT_ID=… ONETRUST_CLIENT_SECRET=…
npx keel-migrate export --source onetrust --out ./outOpen source, so read it before you run it. Requires Node.js 18.17 or newer. Full instructions, including large exports, are in the repository README.
What comes over
Your registers and policies, mapped for you
-
Vendors
Your third-party register: name, website, criticality, status, and review dates.
-
Risks
Your risk register with treatment and status, plus likelihood × impact and residual scores wherever the source platform scores its risks. A risk the source never scored arrives unscored and is marked Needs scoring in your register.
-
People
Your personnel directory: names, emails, roles, and active/offboarded status.
-
Policies
Your policy register: titles, status, approval dates, and versions.
-
Policy & evidence documents
Where the source API serves a file, it is downloaded and inlined (checksum-verified), then stored in your Keel evidence library on import. The table below shows which sources serve which documents.
| Source | Exports | Policy documents | Evidence files | Risk scores | Where it connects |
|---|---|---|---|---|---|
| Vanta | Vendors, risks, people and policies | A link where one exists, not the file | Yes, the files themselves | Likelihood and impact, where scored | api.vanta.com |
| Drata | Vendors, risks, people and policies | Not included | No | Likelihood and impact, where scored | public-api.drata.com |
| Hyperproof | Vendors, risks, people and policies | A link where one exists, not the file | Yes, the files themselves | Likelihood and impact, where scored | US only (not EU or GovCloud) |
| Oneleet | Vendors, risks, people and policies | Downloaded when served by its API, otherwise a link | No | Likelihood and impact, where scored | api.oneleet.com |
| Secureframe | Vendors, risks and people | No policies | No | None sent | US only (not UK) |
| OneTrust Beta | Risks and people | No policies | No | None sent | Your own tenant host, including regional ones |
What comes over depends on what each platform’s API lets out. Vanta exposes its approved-policy PDFs only as a link into its web app, so those need a manual export. Where a source sends no likelihood or impact, the risk arrives unscored and the register marks it Needs scoring. OneTrust is in beta because it reads only people and risks while its vendor and policy API paths are confirmed. Automated integration monitors don’t transfer. You reconnect those in Keel, where they feed Keel’s own checks.
Then import into Keel
From export to a working program in minutes
Export
Run keel-migrate locally to produce your bundle file (or a set of files for a large export).
Upload
Drop the bundle into Keel’s importer. Nothing contacts your old platform.
Preview
See exactly what will import before anything is written.
Import
Bring it in. Re-runs are idempotent: nothing is duplicated.
Straight talk
Moving your data, honestly
keel-migrate helps you take your own data to a new home. It doesn’t end any agreement you have with your current provider. Check your existing contract’s terms before you switch. We built the tool to use each platform’s official, supported API precisely because your right to your own data shouldn’t depend on anyone’s permission.
Vanta, Drata, Hyperproof, Oneleet, Secureframe and OneTrust are trademarks of their respective owners. Keel is not affiliated with, sponsored by, or endorsed by them. Product names are used factually to describe the platform you are exporting your own data from. See our trademark notice.