Read only. Walled off. On the record.
Keel reads your receivables to guide collections. It never writes to your systems, and every step leaves a trace.
- 0
- writes to your systemsEvery connector only reads
- AES 256
- encryption on stored credentialsNever sent to a browser
- SSO
- sign in through Google Workspace or Microsoft onlyNo Keel passwords
- 0
- card numbers stored or seenStripe access is read only
Standards
Where Keel stands today. Nothing is claimed ahead of time.
| Standard | Status | What it means |
|---|---|---|
| SSO | In place | Google Workspace and Microsoft sign in. No Keel passwords. Okta and other SAML providers are not available yet. |
| MFA | Through your identity provider | Keel has no passwords. MFA follows your Google or Microsoft policy. |
| PCI DSS | Out of scope | Keel never receives, stores or sees card numbers. Stripe connects through a read only restricted key. |
| SOC 2 | Planned | We answer your security questionnaire before any data moves. |
| Encryption | In place | Stored credentials sealed with AES 256 GCM. Every connection uses TLS. |
| Data location | In place | Hosted on Google Cloud in the United States (us-central1). |
What you can count on
Four assurances built into the product. Not a screen setting.
Read only, always
Keel reads your books. It never writes back.
Start from a CSV export, or connect read only. Disconnect any time and the credentials are deleted.
Your data stays yours
Your records are walled off from every other customer.
Keel never trains AI models on your records.
Every action traced and guarded
Nothing happens off the record.
Every action leaves a decision trace, and rules agents cannot override hold every time.
You stay in control
Your people decide. Keel proposes and records.
Sign in through your own Google or Microsoft account. No one approves their own request.
Rules agents cannot override
A person or an agent may propose anything. Only what passes the rules happens.
The rules
- Renewal protectionNo collection contact inside the renewal window until the account owner agrees.
- Hardship approvalNo reminders to a customer in hardship. Any payment plan needs the Controller.
- Credit hold approvalNo credit hold or limit cut without the Controller's approval.
What enforces them
- Checked every timeEvery proposed action is checked against the rules before it happens.
- No rule, no actionAn action that breaks a rule does not happen, whoever proposed it.
- Rules change by policy onlyOnly the CFO changes them. Every change is kept on record.
How access works
One way in, read only. A record at the end of every step.
- 1Your systemsCRM and billing
- Salesforce
- HubSpot
- QuickBooks
- Stripe
- CSV export
- 2Read only accessOne way in
- Reads, never writes
- Disconnect any time
- 3KeelYour walled space
- Invited people only
- Guardrails checked every time
- 4Decision traceOn the record
- Who, why and which policy
- No one can edit it
- Exports to CSV
No arrow points back. Keel has no way to write to your systems.
What Keel never does
- Edit or delete a decision trace.
- Let an agent move a guardrail.
- Send a reminder during an open dispute.
- Act on a holdout account.
- Train AI models on your records.
Talk to us about security
Write to security@heykeel.ai. Your IT lead is welcome on every call.
Bring your security team
Thirty minutes with the founder. Your IT lead can check every line on this page.