Own your compliance data
Your vendors, risks, people, policies, and the policy and evidence documents behind them are yours. Export them from Vanta or Drata (OneTrust in beta) with keel-migrate (an open-source tool you run on your own machine, using each platform's official API), then bring them into Keel. Your credentials never leave your computer.
keel-migrate is one of several things we build in the open. See all of them on our open source page.
Open source · MIT · read-only · runs locally. Vanta and Drata today, OneTrust in beta; more on the roadmap.
Export on your terms, not theirs
keel-migrate is a small, auditable command-line tool. You give it a read-only API key for your current platform; it exports your data to one or more portable bundle files. Nothing runs on our servers, and we never see your source credentials.
Runs on your machine
A command-line tool you run yourself. Your API credentials never leave your computer and are never written to disk or sent to Keel.
Official APIs, read-only
Talks only to the source platform's own documented API, over HTTPS, read-only. It never scrapes the UI and cannot modify anything in your source system.
Open source (MIT)
The whole tool is public and auditable: read exactly what it does before you run it. No black box, no account required.
A neutral, open format
It writes one or more documented bundle files (a large export is split automatically). Import them into Keel, or keep them. The format is open, so your data is not locked to any destination.
# Vanta (read-only OAuth client)
export VANTA_CLIENT_ID=… VANTA_CLIENT_SECRET=…
npx keel-migrate export --source vanta --out ./out
# Drata (read-only API key)
export DRATA_API_KEY=…
npx keel-migrate export --source drata --out ./out
# OneTrust (beta: read-only OAuth client; exports users + risks)
export ONETRUST_HOSTNAME=… ONETRUST_CLIENT_ID=… ONETRUST_CLIENT_SECRET=…
npx keel-migrate export --source onetrust --out ./outYour registers and policies, mapped for you
Vendors
Your third-party register: name, website, criticality, status, and review dates.
Risks
Your risk register with likelihood × impact, residual scoring, treatment, and status.
People
Your personnel directory: names, emails, roles, and active/offboarded status.
Policies
Your policy register: titles, status, approval dates, and versions.
Policy & evidence documents
The actual files, not links: policy and evidence documents are downloaded and inlined (checksum-verified), then stored in your Keel evidence library on import, wherever the source API exposes them for download.
Honest about scope: from Vanta and Drata you get the full registers, policy details, and the policy and evidence files the platform exposes for download; a few items shared only as a UI link (for example Vanta's approved-policy PDFs) still need a manual export. OneTrust is a beta source today (users and risks). Automated integration monitors don't transfer, you reconnect those in Keel, where they feed Keel's own checks.
From export to a working program in minutes
Export
Run keel-migrate locally to produce your bundle file (or a set of files for a large export).
Upload
Drop the bundle into Keel's importer. Nothing contacts your old platform.
Preview
See exactly what will import before anything is written.
Import
Bring it in. Re-runs are idempotent: nothing is duplicated.
Moving your data, honestly
keel-migrate helps you take your own data to a new home. It doesn't end any agreement you have with your current provider. Check your existing contract's terms before you switch. We built the tool to use each platform's official, supported API precisely because your right to your own data shouldn't depend on anyone's permission.
Vanta, Drata, and OneTrust are trademarks of their respective owners. Keel is not affiliated with, sponsored by, or endorsed by them. Product names are used factually to describe the platform you are exporting your own data from. See our trademark notice.