What we’re building next

Turn questionnaire assist into an auditable engine: reuse the answers you’ve already approved, retrieve from your own policies, controls, and evidence, and draft each answer only from cited snippets, flagging anything it can’t support for review instead of guessing. Upload a PDF/Excel/Word questionnaire and get your file back filled in; every answer you accept is saved and reused, so accuracy compounds and repeat questionnaires get faster and cheaper.

A Zapier app (in private beta — request access) so you can connect Keel to thousands of tools with no code: trigger automations when a control, evidence item, task, or risk changes, and create tasks, log evidence, or open risks from wherever your team already works.

Serve your public trust center from your own domain (e.g. trust.yourcompany.com) with your branding and an automatically provisioned certificate, instead of a Keel-hosted URL. The in-app flow (add host, verify by TXT, provision certificate) is built; finishing platform enablement.

Live: export your vendors, risks, people, policies, and the actual policy and evidence document files from Vanta or Drata with the open-source keel-migrate tool, then import them into Keel (large exports are split across files automatically). A OneTrust source is in beta. Coming next: more source platforms and direct-to-storage streaming for very large libraries.

A companion app for the on-the-go moments: approve access reviews and policies, complete assigned training, clear task reminders, and check readiness, with push notifications.

Auto-collect evidence from cloud and SaaS tools (AWS, GitHub, Google Workspace, and more) so controls stay current without manual uploads.

When a framework publishes a new revision, see a clause-level diff of what was added, changed, merged, or retired, and a report of the delta work to re-certify. Built for migrations like ISO 27001:2013 → 2022 and CIS Controls v8.0 → v8.1.

Authored coverage for the EU NIS2 Directive (Directive (EU) 2022/2555) and the Digital Operational Resilience Act (Regulation (EU) 2022/2554), crosswalked to the ISO 27001 and SOC 2 controls you already run so most of the evidence carries over. Listed in the framework catalog now; content is being authored and IP-reviewed.

Export your program as NIST OSCAL — a System Security Plan (SSP) and a Plan of Action & Milestones (POA&M) — generated from the controls, evidence, and gaps you already track in Keel, so teams working toward FedRAMP or federal frameworks can hand assessors machine-readable artifacts instead of rebuilding them by hand. Builds on the OSCAL catalog and crosswalk export Keel already produces.

Route review reminders, control changes, and readiness digests to your team’s chat.

An AI agent that can actually operate Keel and your connected tools on your behalf, gather evidence, draft controls and policies, chase down gaps, and prep an audit package, working through tasks step by step while you stay in control and approve the results. Early idea: vote if you’d want it.

Rearrange your program dashboard and show or hide widgets, pin the charts and posture cards that matter most to your team, saved per user.

Two-way sync so a control gap in Keel becomes a ticket in the tracker your team already lives in, and closing it there marks the control remediated here.

Layer a FAIR-style quantitative model onto the risk register so you can express exposure as a probable financial range, not just a heat-map color, the language executives and boards fund against.

Let prospects and customers subscribe to be notified when your trust center posts a new update or your posture changes.

Beyond SSO: auto-provision and deprovision Keel users from your identity provider (Okta, Entra, Google) via SCIM, so joiners and leavers flow through without manual seat management.

Publish sensitive reports (e.g. a SOC 2) as request- or invite-only: visitors see it exists and ask for access, which the publisher approves, instead of a public link.

Upload files for download on the trust center (policies, certificates, reports) instead of only linking out to them.

Bring your own framework or add custom controls and crosswalk them alongside the built-in catalog.

A curated directory of independent auditors and assessors who already know Keel: request quotes and share a read-only audit workspace, so getting from “ready” to “certified” is one less scramble.

Show vendor and subprocessor logos on the trust center, pulled automatically via AI vendor enrichment or added by hand.

Expand the credential-free monitors beyond TLS, security headers, SPF, and DMARC (think DNSSEC, CAA, and certificate-expiry), each recorded as living evidence.

Save and reuse your own policy templates alongside Keel’s 50+ library, so your team can standardize on its house wording and structure.

Beyond today’s free read-only auditor seat, give your auditor a place to leave evidence requests and track fieldwork in-app.

One-click reports that list every unaddressed requirement and index all evidence by control.