Compliance tooling has a quiet lock-in problem. Your controls, evidence, risks, and vendor data go in, and getting them back out (or wiring them into the systems your team actually lives in) ranges from painful to impossible. For a technical team, that's a dealbreaker hiding behind a polished dashboard.

Keel takes the opposite position: your GRC data is yours, it's programmable, and it's portable. Here's the surface area that makes that real.

A REST API for the whole program

Keel exposes a public REST API under /api/v1, authenticated with a per-workspace API key. It's not a token afterthought. It's how the product's own automations work. You can read and write the objects that make up your program:

  • Controls, evidence, risks, vendors, tasks, people, policies: list, create, and link.
  • Evidence accepts either an uploaded file (stored in object storage with the same size, type, and quota rules as the UI) or a URL recorded as link-evidence, optionally attached to a control.
  • Readiness is queryable, so you can surface "are we audit-ready?" wherever your team already looks.

Because the API mirrors the app's own write paths, anything you can do by clicking, you can do by scripting.

Outbound webhooks, so events flow out

Keel emits events (a control's status changed, evidence was created, a risk or vendor was added, a policy was approved, readiness moved) through REST Hooks. Subscribe from your own service and react however you like: post to Slack when a high risk opens, open a Jira ticket when a control drifts, sync new people from your directory. The plumbing is a first-class part of the platform, not a bolt-on. (A no-code Zapier integration is on the way to make the same events available to thousands of apps without writing a subscriber.)

An MCP server, so your AI agents can use it

This is the part most GRC tools don't have: Keel ships a Model Context Protocol server that wraps the same /api/v1 surface. MCP is the emerging standard for giving AI assistants safe, structured access to a system. With it, an agent can answer "which controls are failing and what evidence is stale?" or draft a remediation plan grounded in your actual posture, reading from Keel through a typed, permissioned interface rather than screen-scraping a dashboard.

The strategic point: a compliance program built on an open interface is ready for the agentic tooling that's arriving now. A closed, in-platform assistant can only ever do what its vendor shipped. An open API plus MCP means your agents, your workflows.

keel-migrate: get your data in (and prove you can get it out)

Portability cuts both ways, and the honest test of "your data is yours" is whether you can leave. Keel maintains keel-migrate, an open-source, read-only tool that exports your registers, policies, and documents out of another GRC platform and into an open bundle format you can import into Keel, or keep. It runs on your machine with your own credentials; nothing routes through us. Today it supports Vanta and Drata in full, with a OneTrust source in beta, and the adapter pattern documented so the list can grow.

The subtext is deliberate: a vendor confident in the product doesn't need lock-in. Publishing the exit makes the entrance easier to trust.

Why this matters for a technical buyer

If you're the engineer evaluating compliance tools, the questions under the demo are: Can I automate this? Can I get my data out? Will it play with the AI tooling we're adopting? For most platforms the honest answers are "partly," "barely," and "no."

For Keel: a documented REST API, outbound webhooks, Zapier, an MCP server, and an open-source migration path. Programmable, portable, and open by default.

Building on top of Keel? The API and MCP server are live. Start free (no card) and generate an API key from your workspace settings.