Integrations

Integrations is where Keel connects to the systems around it. Each concern has its own tab:

Tab	What it is for
Evidence	Read-only connections that check a system and file the result as control evidence. Covered on this page.
Directory	Your employee roster, from a CSV or a synced directory. See Directory sync.
API & webhooks	API keys, the interactive API reference and the webhook subscriptions other tools have created. See the REST API reference.
Notifications	Slack and Microsoft Teams channels that receive workspace events. See Chat notifications.
Catalog	Every integration Keel has, with whether each one is available, in preview or planned.
Zapier	Setup for the Keel Zapier app. See Zapier integration.
Import	Upload a bundle written by the open-source keel-migrate tool to bring registers and policies over from another GRC platform.

Evidence connections

An evidence connection signs in to one of your systems with read-only access, runs a fixed set of checks, and records each result against the controls it maps to. Microsoft 365 security checks are available now. The other sources are in preview, and the app labels them that way.

The Integrations page lists every source on one row: its status, a one-line summary of the latest results, and buttons for View findings and Settings, or Connect if it is not connected yet. Each source has its own page with two tabs. Findings shows every check’s latest result. Settings is where you connect, change what is checked, and disconnect.

The sources available today:

Source	What Keel checks	Access Keel asks for
GitHub	The organization requires two-factor authentication; repository branches are protected; secret scanning is on; no open critical or high Dependabot alerts	Read-only: Metadata, Contents, Dependabot alerts and organization Members. The GitHub App also asks for Administration and Organization administration, both read-only.
Microsoft Entra ID	MFA registration coverage, how many accounts hold Global Administrator, and whether Conditional Access policies exist	Microsoft Graph application permissions Reports.Read.All, Directory.Read.All, RoleManagement.Read.Directory and Policy.Read.All
Okta	Authenticator enrollment policies, the Super Administrator footprint, and the password policy’s minimum length	An API token created by an admin who holds only the Read-Only Administrator role
Google Workspace	2-Step Verification enrollment coverage and the super administrator footprint	The Admin SDK scope admin.directory.user.readonly, granted to a service account through domain-wide delegation
AWS	Root user MFA, root user access keys, the password policy’s minimum length, MFA on IAM users who have a console password, and the age of the access key Keel holds	An IAM user with no console access whose policy allows only iam:GetAccountSummary, iam:GetAccountPasswordPolicy, iam:GenerateCredentialReport and iam:GetCredentialReport
Cloudflare	Every account member who has accepted an invitation has two-factor authentication on. The member list also feeds system access reviews.	An API token with Account Settings: Read
Neon	Every organization member has MFA on, or the organization requires it. The member list, plus collaborators on projects you name, also feeds system access reviews.	An organization API key. Neon has no read-only key, so this key can make changes; Keel sends only read requests with it.

GitHub’s member list also feeds system access reviews, and its merged pull requests can be filed as change evidence. See Access reviews for the extra permissions that needs.

Microsoft 365 security checks run the open-source Maester test suite and work differently: see Microsoft 365 security checks.

The Catalog tab lists every integration with its current status, including any that are planned rather than available.

How collection works

• Keel collects from every connected source once a day.
• A passing check is filed as evidence on the controls it maps to. A failing check withdraws that evidence, so a control does not keep credit for a setting someone has since switched off.
• The Findings tab shows the latest result for every check, the controls it maps to, a short history of recent runs, and a marker on any check whose result changed since the run before.
• After you fix something, click Collect now on the Findings tab to re-check straight away instead of waiting for the next daily run. Microsoft 365 has no Collect now; it runs on the daily schedule.
• If a run returns no results, the Findings tab says so and keeps showing the earlier results with the date they came from.

A check that changes status can also post to Slack or Teams. See Chat notifications.

Connecting a source

Only an owner or admin can connect, collect or disconnect. There are two ways in.

One-click connect. For GitHub and Microsoft Entra ID, the Settings tab can show Connect with GitHub or Connect with Microsoft. You approve Keel’s app on GitHub’s or Microsoft’s own consent screen. The info icon beside the button lists the read-only permissions it will ask for.

• On GitHub, install the app on an organization, not a personal account, and you must be an organization owner. If someone else has to approve the install, GitHub sends them the request; once they approve it, click Connect with GitHub again to finish.
• On Microsoft, a Global Administrator or Privileged Role Administrator has to consent, because only those roles can grant Microsoft Graph application permissions. If Microsoft has not finished applying the consent, wait a minute and click Connect with Microsoft again.

Pasted credentials. Every source can also be connected through the form on its Settings tab. For GitHub that is an organization login and a fine-grained access token. For Entra ID it is your own app registration: the directory (tenant) ID, which must be the tenant GUID from the Overview page of the Microsoft Entra admin center rather than a domain name, plus the application ID and a client secret. Cloudflare takes the account ID and an API token. Neon takes the organization ID, an organization API key and, optionally, the projects whose collaborators to list. Okta, Google Workspace and AWS use the details listed in the table above, and each field on the form explains what it needs.

For GitHub you can also name the repositories to check, as repo or repo:branch. Leave it blank to check every active repository on its default branch. To change the list later, reconnect.

How credentials are stored

Credentials are encrypted per workspace with AES-256-GCM. After you save one, Keel never shows it again, to you or anyone else. Disconnect, on the Settings tab, destroys the stored credential.

A source can be connected to only one Keel workspace at a time: one GitHub organization, Entra tenant, Okta org, Google Workspace domain, AWS account, Cloudflare account or Neon organization. If it is already connected to another workspace, Keel refuses the second connection and saves nothing. This applies to pasted credentials as well as one-click connect.

Import from another GRC platform

The Import tab takes a bundle written by the open-source keel-migrate tool. Run keel-migrate on your own machine with read-only credentials for the platform you are leaving. Keel never contacts that platform; it only reads the file you upload, and it imports into the workspace you are signed in to.

• Upload migration-bundle.json, or for a large export the single keel-migration-bundle.zip. The upload field shows the size limit for each.
• The archive imports every part together, in order. Keel checks that it holds the complete set first and refuses an incomplete one instead of importing part of an export.
• The individual migration-bundle*.json files from a large export can also be uploaded one at a time.
• Re-running an import is safe. Records already imported, matched by their source id, are skipped.

Next steps

• Collect and manage evidence: where connector evidence sits next to the evidence you upload.
• Directory sync: bring your staff roster in for access reviews and offboarding.
• API and MCP server: automate Keel from your own tools.