Keel sits in the path of payments, ledgers, and records of truth — so it's built to the standard those systems demand.
Where your data lives, who can touch it, and what gets proven are decisions you make, not ones we make for you.
Regulated teams rarely get to choose "send it to a vendor's cloud." Keel deploys in the boundary you already trust.
Single-tenant inside your cloud account. Isolated compute and storage, your network controls, your keys.
Most regulated teams start hereRun Keel entirely on your own infrastructure, air-gapped if you need it. Nothing leaves your perimeter.
Full controlA managed, US-resident deployment for teams that want speed without standing up infrastructure.
Fastest to valueYour records, actions, and rollback paths are never used to train models — ours or anyone's.
Strong encryption on every connection and stored record, with key management you can own.
Keel requests the narrowest scope it needs — read where it can, write only where you grant it.
Customer data stays within US regions by default, with options to keep it inside your boundary.
Map approvals and access to your identity provider. Who can approve a gated action is your policy.
Every verdict and approval is hash-chained, so the record can't be quietly rewritten later.
Each action records its verdict, its compiled rollback path, the records it touched, and whoever signed off. Entries are linked by hash — altering any one breaks the chain visibly.
— one export · audit-ready
Keel acts through credentials you grant and can revoke. It reads what it needs to compile a rollback and writes only where you've allowed enforcement.
If Keel can't prove an action is reversible, the default is to stop, not wave it through. Safety doesn't depend on the agent behaving.