Fieldwork is shorter when the evidence is already true
Much of an assessment is not judgement. It is reconciling a folder of screenshots against a spreadsheet of controls, then working out whether any of it is still current. Keel is built so that part is largely done before you arrive — and so a client cannot show you less than the whole standard without it being stated on the framework’s own public page.
Ask any client on Keel for a seat. It is free on every plan, it is read-only, and it does not use up one of theirs.
What the seat gives you
Your seat costs the client nothing
An auditor seat is free on every plan, including the free one, and does not count against the workspace seat limit. Nobody has to weigh giving you access against their headcount.
Read-only, by construction
The auditor role cannot edit controls, upload or unlink evidence, change checks, or run AI actions. It is enforced in the application, not in a policy document, so independence does not rest on anyone being careful.
Evidence attached where it belongs
Evidence is linked to the control it satisfies, and a control maps to every framework requirement it covers. You follow one thread from requirement to artifact instead of reconciling a folder against a spreadsheet.
Stale evidence has already withdrawn itself
Automated checks re-run on a schedule and file dated evidence when they pass. When one fails, errors, or is paused, its evidence is withdrawn and the readiness number falls. What you are shown is current, or it is not counted.
Why the numbers mean something
A readiness percentage is only as honest as its denominator. Three things make Keel’s checkable rather than merely assertable.
Complete, or it says so
Every framework declares itself complete or partial, and a test fails the build if the authored requirement count drifts from the leaf count Keel declares for that standard. Each framework page states that declared scope, names the authority it was checked against, and — where Keel models less than the whole standard — states what is missing. Today that is EU AI Act and PCI DSS. What no client can hand you is a subset that is silent about being one.
Scope is stated, not implied
Where a regulation contains provisions a company cannot itself implement — duties addressed to supervisory authorities, for instance — they are cited but excluded from scoring, and every exclusion is listed by number. The denominator is auditable.
Paraphrase, never reproduced text
Keel cites clause and control numbers and titles with original descriptions. Copyrighted standard text is not reproduced, so nothing in a client workspace becomes a licensing problem in your file.
The questions you are going to ask, already asked
Keel ships an auditor question bank of 204 questions across 8 control domains, each mapped to the controls it interrogates. Clients work through them before you arrive, so your first pass is a review rather than a discovery exercise.
Governance & Risk
71 questions
Access Control
9 questions
Data Protection & Privacy
38 questions
Infrastructure & Operations
25 questions
Resilience & Continuity
9 questions
Third-party Risk
10 questions
People & Culture
27 questions
Physical & Environmental
15 questions
Partnering with Keel
If your firm assesses against SOC 2, ISO 27001, NIST SP 800-171, HIPAA, PCI DSS or ISO 9001, there is a simple version of this: your clients run their programs in Keel, you take a free seat in each, and the evidence arrives in a shape you can test.
We are a small team and would rather have a real conversation than run a partner portal. Tell us what you assess and how you like evidence delivered.
Talk to us See a live workspace
Keel is a readiness and evidence platform. It is not an assessor, does not perform audits, and does not issue certifications or attestations — that is your work, and Keel is not a substitute for it.