One platform, every GRC job
Keel is built on a single control & evidence graph. Each module below is a view over the same data, so you collect evidence once and reuse it everywhere.
Compliance & controls
One control library, crosswalked across SOC 2, ISO 27001, PCI DSS, HIPAA, ISO 9001, NIST CSF, and ESG, collect evidence once, satisfy many.
Learn more →Risk management
A living risk register with likelihood × impact scoring, treatments, and owners, linked to the controls that mitigate each risk.
Learn more →Policy management
A library of 50+ framework-mapped policy templates you fill in, approve, and export as branded PDFs, or draft with AI and import your own. A register tracks owners, review cadence, and coverage gaps.
Learn more →Vendor risk
Track third parties by criticality with review cadences, so nothing you depend on goes unreviewed.
Learn more →People & access reviews
Sync your staff from Microsoft Entra, Google Workspace, or CSV, then certify access with keep/revoke/modify, recorded as audit evidence.
Learn more →Evidence & trust center
Attach evidence to controls once, then publish a branded, public trust center with a green-check posture and downloadable policies. Continuous checks keep some evidence flowing automatically.
Learn more →
Track every third party by criticality, with review cadences so nothing you depend on goes unreviewed.
The busywork, done for you
Keel’s AI isn’t a chatbot bolted on the side - it’s wired into the modules where the work actually happens. It writes the first draft so you approve instead of author, and every action is credit-metered and fully optional.
One rundown of your whole program
Readiness gaps, missing or overlapping policies, vendors due for review, stale evidence and overdue access reviews, and framework crossover suggestions for your industry - each with a link to act. The core analysis runs with AI off and uses no credits; an optional deep pass adds a board-ready narrative and a prioritized plan.
AI Insights: your whole program, analyzed
One rundown of your entire workspace - framework readiness gaps, missing or overlapping policies, vendors due for review, stale evidence and overdue access reviews, plus framework crossover suggestions for your industry. The core analysis runs on your live data with AI switched off and uses no credits; add an on-demand deep pass for a board-ready narrative and a prioritized plan.
AI policy drafting from scratch
Name a policy - Access Control, Incident Response, Data Retention - and Keel writes a clean, framework-mapped first draft right in your editor, ready to tailor and export as a branded PDF.
AI risk drafting
Describe your business, or just your framework, and Keel drafts a set of concrete, scored risks to seed your register - each an editable starting point, never boilerplate.
Policy & document import, cleaned up by AI
Drop in a messy Word doc or an old policy and Keel rewrites it into clean, framework-mapped Markdown you can approve and export as a branded PDF - no re-typing, no reformatting.
AI vendor profiles from a URL
Paste a vendor’s website and Keel drafts the risk profile for you - what they do, the data they touch, their certifications and sub-processors - so your inventory fills itself in.
AI questionnaire builder
Describe the vendor and your concerns; Keel assembles a structured, auto-scored security questionnaire from a curated library of 100+ questions. Consistent, on-brand, and ready to send in one click.
Control implementation guidance
For any control, Keel writes plain-English, step-by-step implementation guidance and the exact evidence to collect - so “where do I even start” becomes a checklist you can act on today.
Answer inbound questionnaires
When a prospect sends you a security questionnaire, Keel drafts the answers from your own controls and policies - honest, grounded, and ready to review - turning a day of copy-paste into minutes.
Policy-gap & readiness analysis
Keel compares your policy set to a framework and flags what’s missing, and writes a board-ready audit-readiness summary over your live posture - the prep work, done for you.
Remediation, risks & summaries
Turn a failing control into a task list, draft vendor risks from a profile, summarize a control’s evidence and review whether it’s sufficient, flag odd access in a review, and generate trust-center copy - each an optional, credit-metered click.
AI credits are included on every paid plan - 1,500/mo on Starter, 5,000 on Pro, 15,000 on Enterprise - with pay-as-you-go top-ups when you need more.
Crosswalked across every framework you need
Apply a framework and one-click a curated, pre-mapped control set. A single control satisfies clauses across all of them at once.
ISO/IEC 27001
The international standard for an Information Security Management System (ISMS), including the Annex A control set. Keel’s flagship framework.
CIS Critical Security Controls
A prioritized set of safeguards to mitigate the most common cyber attacks, mapped to Implementation Groups.
PCI DSS
Payment Card Industry Data Security Standard - requirements for organizations that store, process, or transmit cardholder data.
SOC 2
Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) for service organizations. The report buyers ask for most.
NIST Cybersecurity Framework
Outcome-based framework organized by the Govern, Identify, Protect, Detect, Respond, and Recover functions.
NIST SP 800-53
Security and privacy controls for information systems and organizations, scoped to the 800-53B Moderate baseline.
HIPAA
US regulation for protected health information: Security Rule safeguards (administrative, physical, technical), Breach Notification, and core Privacy Rule standards.
ISO 9001
Quality Management System (QMS) requirements - consistent quality and continual improvement.
AI Governance Essentials
A Keel-authored baseline for responsible-AI governance - plain-language expectations across governance, risk, data, transparency, human oversight, security, lifecycle, and third parties, ready to evidence today and later map to a formal AI standard.
ISO/IEC 42001
AI Management System (AIMS) - governance for responsible development and use of AI. Management clauses 4-10 plus the Annex A reference controls (nine objective groups).
NIST AI Risk Management Framework
Voluntary framework for managing AI risks, organized around the Govern, Map, Measure, and Manage functions (the nineteen categories across the four functions).
EU AI Act
EU regulation on artificial intelligence (Regulation (EU) 2024/1689), setting obligations by risk tier: prohibited practices, high-risk requirements and obligations, transparency, and general-purpose AI models.
ESG Essentials
A Keel-authored baseline ESG program (Environmental, Social, Governance) for SMBs - plain-language expectations you can evidence today and later map to a formal standard.
More frameworks are added as data, not code - CIS Controls and NIST 800-53 are live now, with GDPR and NIST 800-171 on a scheduled rolling launch. Framework names are referenced factually; Keel is not affiliated with their owners.
Fits the stack you already run
Sync your directory, and push and pull data with a REST API and outbound webhooks (REST Hooks). A no-code Zapier app is in private beta.
Zapier integration
Trigger tasks, log evidence, open risks, and alert your team automatically across 6,000+ apps. Now in private beta.
Explore Zapier →Integrations, API & webhooks
Directory sync, a REST API, webhooks, and an MCP server connect Keel to the tools (and AI agents) you already use.
See integrations →Prove it, not just claim it
Framework crosswalk
Map a control to many frameworks at once, the “collect once, comply everywhere” engine.
One-click starter controls
Apply a curated, pre-mapped control set for your framework in a single click.
Guided onboarding
A step-by-step setup hub takes you from zero to a working program in an afternoon.
Readiness reports
Branded, auditor-ready reports and a posture digest you can email yourself in a click.
Statement of Applicability
Generate the mandatory ISO 27001 SoA from your program (all 93 Annex A controls with applicability, justification, and status) as a branded PDF.
Information asset register
Inventory your information and associated assets with an owner and a classification (the ISO 27001 Annex A 5.9 and 5.12 register), each rated for confidentiality, integrity, and availability.
Nonconformities & CAPA
Run the ISO 27001 / 9001 Clause 10 loop: log a nonconformity, guided 5 Whys / Fishbone root cause, corrective actions, and an effectiveness check before it can close.
Internal audits
Plan a Clause 9.2 internal audit, work a checklist auto-generated from the framework’s clauses, record findings, raise nonconformities, and export a branded audit report.
Audit programme & calendar
Plan and maintain the internal-audit programme (the ISO 27001 / 9001 Clause 9.2.2 requirement), scheduling audits by area on a cadence, with an upcoming-and-overdue calendar and one-click launch into a full audit.
Security incident register
Report, triage, contain, and learn from incidents (the ISO 27001 Annex A 5.24–5.28 workflow), and raise corrective actions, with the record SOC 2 expects.
Business continuity & BIA
A business impact analysis and continuity register (the ISO 27001 Annex A 5.29 and 5.30 requirement), with RTO, RPO, recovery strategy, and continuity-test tracking per critical process.
Management reviews
Run the Clause 9.3 review with the agenda pre-filled from your program (audit results, nonconformities, incidents, readiness), plus minutes, decisions, and a branded PDF.
Legal & regulatory register
Track the legal, statutory, regulatory, and contractual obligations that apply to you (the ISO 27001 Annex A 5.31 register), each with an owner and a compliance status.
Security objectives & KPIs
Set measurable information security objectives (the ISO 27001 Clause 6.2 requirement), with a metric, baseline, target, owner, and a live on-track / at-risk / achieved status.
Competence & training-gap matrix
Evidence that the people doing security work are competent (the ISO 27001 Clause 7.2 requirement), with per-person competences, basis, status, and certification expiry.
Documented information register
The controlled master list of every document the ISMS depends on (the ISO 27001 Clause 7.5 requirement), each with an owner, approver, classification, version, review cadence, and retention rule.
Nonconforming outputs (NCR)
Control nonconforming product and outputs (the ISO 9001 Clause 8.7 requirement), with quarantine, the full disposition set, re-verification after rework, and a one-click bridge to CAPA. Part of the Keel Quality add-on.
Quality dashboard
The whole quality-management system on one surface (nonconforming outputs, CAPA, the audit programme, objectives, competence, and document control), with a live “needs attention” roll-up. The home of the Keel Quality add-on.
Supplier quality & SCARs
Control externally provided products and services (the ISO 9001 Clause 8.4 requirement), with an approved-supplier list, qualification status, quality scores, and Supplier Corrective Action Requests (SCARs). Part of the Keel Quality add-on.
Complaints & feedback
Capture, investigate, and resolve customer complaints across any channel (the ISO 9001 Clause 9.1.2 / 10.2 requirement), and escalate systemic ones to a linked CAPA. Part of the Keel Quality add-on.
Change control
Plan and control changes to processes, products, documents, and systems (the ISO 9001 Clause 6.3 / 8.5.6 requirement), through impact assessment, approval, implementation, and verification. Part of the Keel Quality add-on.
Directory sync & access reviews
Automated staff sync plus periodic access certification, a real SOC 2 / ISO control.
Security-awareness training
A built-in library of framework-mapped courses: assign to your whole team or specific people, let staff self-enroll, and collect certificates and a per-person history as evidence.
Continuous checks
Credential-free monitors verify TLS, security headers, SPF, and DMARC on a schedule and record each pass/fail as living evidence.
Trust center
A customizable public page, logo, cover, checklist, documents, that helps close deals.
API, webhooks & MCP
A REST API, webhooks, and a Model Context Protocol server connect Keel to the tools (and AI agents) you already use.
AI built in
Draft policies, profile vendors, and assemble questionnaires in seconds - AI woven through every module, with credits included on every paid plan.