One platform for your whole GRC program

A library of 75+ framework-mapped policy templates you fill in, approve, and export as branded PDFs, or draft from scratch with AI on any paid plan. A register tracks owners, review dates, and coverage gaps.

One control library, crosswalked across every framework, so you collect evidence once and comply everywhere.

Inventory your information and associated assets with an owner, a classification, and a CIA rating, the ISO 27001 Annex A 5.9 and 5.12 register your whole ISMS is built on.

Log a nonconformity, find its root cause, correct it, and verify the fix worked before you close it, the ISO 27001 / 9001 Clause 10 loop.

Plan an internal audit, work a clause-by-clause checklist generated from the framework, record findings, and export an auditor-ready report, the ISO 27001 / 9001 Clause 9.2 requirement.

Report, triage, contain, and learn from security incidents, the ISO 27001 Annex A 5.24–5.28 workflow, and the record a SOC 2 auditor expects.

Run the ISO 27001 / 9001 Clause 9.3 management review with the agenda pre-filled from your program (audit results, nonconformities, incidents, and readiness), plus minutes, decisions, and a branded PDF.

Track the legal, statutory, regulatory, and contractual obligations that apply to you, the ISO 27001 Annex A 5.31 register, each with an owner and a compliance status.

A business impact analysis and continuity register, the ISO 27001 Annex A 5.29 and 5.30 requirement, with RTO, RPO, recovery strategy, and continuity-test tracking on every critical process.

Set measurable information security objectives and track them to target, the ISO 27001 Clause 6.2 requirement, with a metric, a baseline, a target, and a live status on each.

Show the people doing security work are competent for it, the ISO 27001 Clause 7.2 requirement, with a per-person competence matrix, evidence, and expiry tracking.

The controlled master list of every document your ISMS depends on, the ISO 27001 Clause 7.5 requirement, with owners, versions, classification, review cadence, and retention.

Control nonconforming product and outputs, the ISO 9001 Clause 8.7 requirement, with disposition, quarantine, and a one-click bridge to CAPA. Part of Keel Quality, an add-on bought per workspace.

Plan and maintain your internal-audit programme, the ISO 27001 / 9001 Clause 9.2.2 requirement, on a cadence, with a calendar that shows what’s due.

Your whole quality-management system on one surface: nonconforming outputs, CAPA, audits, objectives, competence, and document control, with a live “needs attention” roll-up. The dashboard and nonconforming outputs are part of Keel Quality, an add-on bought per workspace; CAPA, audits, objectives, competence and document control ship on every plan.

Capture, investigate, and resolve customer complaints, the ISO 9001 Clause 9.1.2 / 10.2 requirement, and escalate systemic ones to a root-cause CAPA. Part of Keel Quality, an add-on bought per workspace.

Plan and control changes to processes, products, documents, and systems, the ISO 9001 Clause 6.3 / 8.5.6 requirement, through impact assessment, approval, and verification. Part of Keel Quality, an add-on bought per workspace.

A living risk register with a real likelihood × impact heat map, not a spreadsheet that goes stale.

Track CISA’s Known Exploited Vulnerabilities against your program, synced from the live federal feed.

Track third parties by criticality, send security questionnaires, and draft a vendor profile from its name and URL with AI on any paid plan.

Answer inbound security questionnaires with AI grounded in your own controls (included on every paid plan), and send auto-scored ones to your vendors.

Control your externally provided products and services, the ISO 9001 Clause 8.4 requirement, with an approved-supplier list, quality scores, and supplier corrective actions (SCARs). Part of Keel Quality, an add-on bought per workspace.

Grades any domain's TLS, security headers and mail authentication from outside, on every plan. On a domain you have verified it can also check for open ports, and a pass files partial evidence against a network security control.

Sync your directory, certify access with keep / revoke / modify, and record the whole review as audit evidence.

Assign framework-mapped courses, track completion, and collect certificates as audit evidence. Training is on every plan, with the full course library.

Attach evidence to a control once and reuse it across every framework that control satisfies.

A branded, public proof page (posture, policies, and documents) that helps you close deals without a security call.

Branded, auditor-ready readiness reports and a posture digest you can email yourself in a click.

Generate the mandatory ISO 27001 Statement of Applicability (SoA) from your program: every Annex A control, its applicability, justification, and status, exported as a branded PDF.

AI built into most modules, plus Ask Keel for questions about your workspace, included on every paid plan: draft policies and risks, profile vendors, answer questionnaires, and summarize evidence.

One rundown of your whole compliance program: readiness gaps, policy and vendor issues, stale evidence, and where to focus next, each with a link to act.

Directory sync, a REST API, and webhooks (REST Hooks) connect Keel to the tools you already run, available on Pro, Enterprise and the MSP / Partner plan, with CSV import on every plan.

Turn gaps and findings into tracked work items: created in-app on any plan, from a failing control with AI on any paid plan, or pushed in over the REST API and webhooks on Pro, Enterprise and the MSP / Partner plan.

A public roadmap you can vote on and a changelog of what shipped, so you can see the product is moving and shape where it goes.

Make ownership explicit across your program with a Responsible / Accountable / Consulted / Informed matrix.