What we’re building next

Connect a GitHub organization read-only, through the Keel GitHub App or a fine-grained token, and collect evidence that the organization requires two-factor authentication, default branches are protected, secret scanning is on, and no critical or high Dependabot alerts are open. It shows exactly which repositories it checked, and a collection that fails is marked separately from a control that fails.

Read-only collectors for GitHub, Okta, Google Workspace, AWS and Microsoft Entra check identity and configuration settings and record each result against the controls it maps to. Every connection is collected about once a day, and you can collect on demand. Each connection shows when it last collected successfully, and one that stops collecting is shown as unhealthy instead of leaving its controls looking current.

A Zapier app connecting Keel to thousands of tools. In private beta — request access — the Zap editor offers triggers for a control status change and a new task, a Create Task action, and a search for your ISO 27001 readiness summary. Risks, vendors, evidence, policies and readiness changes are built on Keel’s API but not selectable in a Zap yet.

Live: export your vendors, risks and people from Vanta, Drata, Hyperproof, Oneleet or Secureframe with the open-source keel-migrate tool, then import them into Keel (large exports split across files automatically). Policies and evidence files travel only where the source platform’s API documents them. A OneTrust source is in beta (users and risks today). Coming next: more sources and direct-to-storage streaming for very large libraries.

A companion app for the on-the-go moments: approve access reviews and policies, complete assigned training, clear task reminders, and check readiness, with push notifications.

Draft answers for a full enterprise questionnaire in one pass, up to 250 questions, instead of splitting it across runs. Needs per-question credit metering first: today a run is charged one flat amount, so a ceiling that high would over-charge anyone answering a handful of questions.

When a framework publishes a new revision, see a clause-level diff of what was added, changed, merged, or retired, and a report of the delta work to re-certify. Built for migrations like ISO 27001:2013 → 2022 and CIS Controls v8.0 → v8.1.

If your domain is on Cloudflare, connect your Cloudflare account and Keel adds the ownership and routing records for your trust-center domain itself, so there is nothing to copy or paste.

Authored coverage for the EU NIS2 Directive (Directive (EU) 2022/2555) and the Digital Operational Resilience Act (Regulation (EU) 2022/2554), crosswalked to the ISO 27001 and SOC 2 controls you already run so most of the evidence carries over. Listed in the framework catalog now; content is being authored and IP-reviewed.

The same one-step setup for trust-center domains hosted at GoDaddy, Namecheap or Amazon Route 53: approve access once and Keel adds the ownership and routing records for you.

Export your program as NIST OSCAL — a System Security Plan (SSP) and a Plan of Action & Milestones (POA&M) — generated from the controls, evidence, and gaps you already track in Keel, so teams working toward FedRAMP or federal frameworks can hand assessors machine-readable artifacts instead of rebuilding them by hand.

Route review reminders, control changes, and readiness digests to your team’s chat.

See whether a domain publishes the things a security reviewer looks for first — a security.txt contact, a reachable privacy policy, a subprocessor list, a status page — and which controls each one supports. Reads only published, standard locations. Early idea: vote if you’d use it.

Upload a vendor’s SOC 2 report, DPA or security document and get the relevant findings extracted with page references, mapped to your vendor review. Nothing is marked reviewed until you review it.

When the same topic keeps coming up in questionnaire answers you have approved, Keel suggests trust-center content for it, so buyers find the answer before they ask. Nothing is published until you approve it.

Check a domain’s SPF, DKIM, DMARC, BIMI and MTA-STS records in one pass, and see which ISO 27001 Annex A controls each result speaks to. Public DNS only — nothing touches your systems, and no sign-in is needed. Early idea: vote if you’d use it.

An AI agent that can actually operate Keel and your connected tools on your behalf, gather evidence, draft controls and policies, chase down gaps, and prep an audit package, working through tasks step by step while you stay in control and approve the results. Ask Keel, which has shipped, is the first step: it answers questions inside Keel and suggests tasks you submit. This item is the later stage that works across your connected tools. Early idea: vote if you’d want it.

Rearrange your program dashboard and show or hide widgets, pin the charts and posture cards that matter most to your team, saved per user.

Connect the DNS host your domain already sits on and let Keel write the verification TXT record itself, instead of copying it into another control panel and waiting for it to propagate. Cloudflare first, then the registrars most customers actually use.

Two-way sync so a control gap in Keel becomes a ticket in the tracker your team already lives in, and closing it there marks the control remediated here.

Layer a FAIR-style quantitative model onto the risk register so you can express exposure as a probable financial range, not just a heat-map color, the language executives and boards fund against.

Beyond SSO: auto-provision and deprovision Keel users from your identity provider (Okta, Entra, Google) via SCIM, so joiners and leavers flow through without manual seat management.

Bring your own framework or add custom controls and crosswalk them alongside the built-in catalog.

A curated directory of independent auditors and assessors who already know Keel: request quotes and share a read-only audit workspace, so getting from “ready” to “certified” is one less scramble.

Hold each gated-document request for the publisher to approve or decline before any access link is issued, instead of emailing the requester automatically.

Show vendor and subprocessor logos on the trust center, pulled automatically via AI vendor enrichment or added by hand.

Expand the credential-free monitors beyond TLS, security headers, SPF, and DMARC (think DNSSEC, CAA, and certificate-expiry), each recorded as living evidence.

Save and reuse your own policy templates alongside Keel’s own template library, so your team can standardize on its house wording and structure.

A one-click report that lists every unaddressed requirement in a framework, so you can see what is left before an audit.