Workspace settings

Open Settings from the gear in the top bar. Every settings page carries the same side menu, grouped into Company (Workspace, Billing, Notifications, API & webhooks, AI credits, Data), Access (Team & roles, Access & security) and Your account (Your preferences).

Company and Access pages apply to the whole workspace, and only an owner or admin can change them. Your preferences applies to you alone, and everyone can set it. Data is where an owner or admin downloads a copy of everything in the workspace; see Export your data.

Workspace

Organization name and slug

The name is what your team sees across Keel. The slug is the short identifier used in links. It must be unique, 3 to 40 characters long, and use only lowercase letters, numbers and hyphens. The same section shows the plan the workspace is on, including a trial or a plan provided by a partner.

Your trust center has its own public slug, set on the Trust Center page.

Hiding features the workspace does not own

Features that are not included on your plan appear dimmed in the menu. Click Hide features this workspace doesn’t own to remove them from the menu entirely. They come back on their own as soon as the workspace has what they need, and Show all features in the menu brings them back at any time.

Vendor discovery

Keel can read what your company’s domain says publicly and propose the vendors it names. The Vendor discovery section shows when it last ran, whether that run was partial because a lookup failed, and how many candidates are waiting for a decision.

You can run it again whenever you like. A re-run proposes only vendors that are new, and anything you already accepted or dismissed stays settled. See Discover vendors from a domain.

Plan entitlements

This list shows what the current plan includes: additional frameworks, vendors, seats, evidence storage, monthly AI credits, directory auto-sync, integrations and API access, and whether the trust center is Keel-branded or white-labeled. During a trial it shows the plan you are trialing. Plans, limits & billing explains each limit.

Teammates and roles are managed on the Team page. See Team & roles.

Company profile

Settings > Company profile holds the facts about your company that policies, questionnaires and auditors ask for. Owners and admins can change it; everyone else sees it read-only.

Company details

Legal name, website, where the company is incorporated, mailing address and main phone number. Every field is optional.

Designated officers

Pick the workspace member who holds each role: security officer, privacy officer, HIPAA security official, HIPAA privacy official and data protection officer. Only current members of the workspace can be picked. A role nobody holds shows as “Not assigned”, and a person who later leaves the workspace shows as “Former member” until you pick someone else. Every change is recorded in the activity log.

Access & security

Domain access

By default, a colleague who signs up with your company email lands in a separate workspace of their own. Domain access lets anyone who signs up with your company email domain join this workspace automatically instead.

Turn it on only if everyone at that domain should see this workspace’s compliance data. It is off by default.

1. On Access & security, click Enable auto-join for my email domain. Keel claims the domain of the email you signed in with. Personal domains such as gmail.com are not eligible, and a domain can belong to only one workspace.
2. Each claimed domain is listed with Turn off / Turn on and Remove. Removing it releases the domain.

Sessions

Idle sign-out signs a member out after a set time with no activity in Keel: 15 or 30 minutes, or 1, 2, 4 or 8 hours. Activity in any open tab counts, so working in one tab keeps the others signed in. The default is Never, which keeps the normal session length. An owner or admin picks the window and clicks Save; it applies to every member of the workspace.

Security contacts

List up to 5 email addresses under Security contacts, separated by commas or new lines, and click Save. Each address gets an email as soon as anyone declares an incident in the workspace, with the title, the severity and a link to the incident. A contact does not need a Keel account, and members cannot turn this email off.

Single sign-on

Single sign-on is included on Enterprise and the MSP / Partner plan. Your team signs in through your identity provider: Okta, Microsoft Entra ID, Google Workspace, OneLogin, or another SAML or OIDC provider.

The Keel team configures SSO for each workspace, so you request it rather than switch it on:

1. Under Single sign-on, enter your Identity provider and the Email domain your team signs in with.
2. Add anything the team should know under Notes, such as enforcement, group mappings or timing.
3. Click Request SSO setup.

The Keel team then verifies that you own the domain, sets up the SAML or OIDC connection, and confirms it with you.

SCIM provisioning is not available. To keep Keel’s employee roster current from your directory, use directory sync.

Activity log

Activity log shows who changed what in the workspace, and when, newest first. Owners, admins and auditors can open it, and it is read-only for every role. Auditors use it to test change management and access review. Filter it by record type or by a start date.

Audit log export

On Enterprise and the MSP / Partner plan, an owner or admin can download a complete, timestamped record of every change in the workspace as CSV or JSON. Use it for auditors, incident review or your own records.

Your preferences

Weekly digest

The weekly digest is a short email about the workspace: readiness, gaps, open risks and tasks, vendors due for review, and outstanding training. It is off by default. It is per person, so clicking Email me a weekly digest sends it only to you, at the email on your account. Click Turn off weekly digest to stop it.

Cookie preferences

Keel uses essential cookies to sign you in and remember your workspace. The app runs no analytics tool, so the optional analytics category loads nothing today. It exists so that anything added later cannot load before you accept it.

Click Manage cookie preferences to set or change your answer at any time. The choice is stored per browser, so it applies to the browser and device you set it on. The Cookie Policy and Privacy Policy have the detail.

SLAs

Settings > SLAs sets how long the workspace allows to fix things. Owners and admins can change it. Leave a field blank for no deadline.

• Exposure findings: days to fix an open finding of each severity (critical, high, medium, low), counted from the day it was first seen. Exposure monitoring shows “fix by” on each open finding and marks it overdue once that day has passed.
• Automated checks: days to fix a failing check, counted from the first failing run in the current streak. The Checks page shows the date under the status.
• Business days only: skip Saturdays and Sundays when counting. Holidays still count.

Every change is recorded in the activity log.

Alert hours

Alert hours sets when check failure alerts are emailed. Turn on Only send during alert hours, pick From and Until (local hours; Until is the first hour outside the window, and a window may cross midnight), choose the Timezone, and leave Weekdays only on to hold alerts over the weekend. Click Save.

An alert raised outside the window is held and sent when the window next opens. Keel checks for held alerts every hour, so one can arrive up to an hour after the window opens. With alert hours off, an alert goes out as soon as the check fails. Only an owner or admin can change this.

Compliance

Default owners picks who is assigned to an item when it is created:

• New policies: a policy created from a template, imported from a file, drafted with AI, or created through the API.
• Uploaded evidence: a file uploaded on the Evidence page. Evidence that a connector or an automated check collects is not affected.

Pick a member, or No default, and click Save. Auditors are not offered, since an auditor owns nothing in a workspace. An item that already has an owner keeps it, and the owner can be changed on the item afterward. When the default owner leaves the workspace, new items are left unowned until you pick someone else. Only an owner or admin can change this.

Tags

Tags group risks, vendors, policies and controls across frameworks, for example by system, team or project.

• Add a tag: type a name of up to 40 characters and click Add tag. Names are unique in a workspace, ignoring case.
• Rename or Delete a tag from the list. Deleting a tag takes it off every record that carries it.

Only an owner or admin can change the tag list. To tag a record, open the risk, vendor, policy or control, open Edit tags in the Tags card, tick the tags and click Save tags. Anyone but an auditor can tag a record, and a record can carry up to 20 tags.

Custom fields

Custom fields add your own fields to risks, vendors, policies and controls, for example a cost center on vendors or a review board on policies.

• Add a field: pick the record type, type a label of up to 60 characters, and pick a type: Text, Number, Date or Pick list. A pick list needs its choices, one per line, up to 30. Click Add field. A record type can have up to 25 fields.
• Edit a field to change its label or, for a pick list, its choices. A record whose value is no longer a choice is cleared.
• Delete a field to remove it and its value from every record.

Only an owner or admin can change the field list. To fill in a field, open the record, open Edit fields in the Fields card, enter the values and click Save fields. Anyone but an auditor can fill in fields. The card appears only once the record type has at least one field.

Roles

Custom roles narrow the Member role, area by area, at Settings › Custom roles. A custom role starts from Member and sets each area to one of three levels:

• Edit: what a Member can do today.
• View only: the area’s pages open, and its saves are refused. A View only badge shows in the header on those pages.
• Hidden: the area leaves the sidebar and search, and its pages answer “not found”.

The ten areas are risks, vendors, policies, controls, evidence (including evidence requests), tasks, incidents, access reviews, information assets and the Trust Center.

• Add a role: type a name of up to 40 characters, pick a level for each area and click Add role. A workspace can have up to 20 custom roles.
• Save role after changing a role’s name or levels. The change applies on the member’s next page load.
• Delete a role from Delete a role. Its members go back to plain Member.
• Members: pick a role beside a person and click Save. Only a person with the Member role can have a custom role. Changing a person to Owner, Admin or Auditor on the Team page removes their custom role.

A custom role never grants anything a Member lacks, so team, billing, API key and settings changes stay with owners and admins. Only an owner or admin can manage roles.

A role governs each area’s own pages and saves, including tags and custom fields on its records, tasks made from a risk or control, and evidence attached from a risk. Ask Keel does not read an area the role hides. Images in a policy are stored as evidence files, so hiding evidence also hides them.

A hidden area stays hidden on pages outside it too. The dashboard leaves out its records and counts, the RACI matrix drops its tab, and request lists and the auditor request desk follow the evidence level. Pages and downloads that are only accurate with every area in them answer “not found” instead of printing a partial picture: the board pack and readiness report, the Statement of Applicability, the coverage page, the framework bridge and its export, and checks.

Risk

Risk categories lists the categories the risk register offers when you add or edit a risk, one per line, up to 30. Edit the list and click Save. Use Keel’s default list puts back People, Process, Technology, Third-party / vendor, Physical, Availability, Legal / compliance and Other. Changing the list never changes the category an existing risk already has. Only an owner or admin can change it.

Vendors

Review cadence by tier sets how many months pass between reviews for a vendor of each tier: Critical, High, Medium and Low, from 1 to 60. A blank tier keeps Keel’s default, which the field shows. Click Save.

A new vendor starts with its tier’s cadence, and so does a vendor reviewed for the first time with no cadence of its own. A cadence already set on a vendor stays as it is, so changing this setting never moves an existing review date. Only an owner or admin can change it.

Trust Center

Gated document access controls the emailed link a visitor gets when they request a gated document on your Trust Center.

• Access link works for sets how long the link works: 1, 3, 7, 14 or 30 days. The default is 7 days.
• Blocked email domains lists domains, one per line, that never get a link. Subdomains are blocked too, so rival.com also covers eu.rival.com. A blocked visitor sees the usual confirmation, so the block is not revealed. Up to 50 domains.

Click Save. The settings apply to new requests; a link already sent keeps its date. Only an owner or admin can change them.

Your notifications

Settings > Your notifications chooses which emails this workspace sends you. It is per person and per workspace, and anyone can change their own. Each group has an Email me box:

• Assigned to you: a risk, task or audit request assigned to you, or a mention in an audit thread.
• Due dates: reviews, access reviews, expiring evidence, expiring competence records and audit requests coming due.
• Monitoring: failed checks, control status changes and new scan findings.
• Workspace activity: changes other people make in the workspace.

Invitations, sign-in, security and billing emails always send. The weekly digest has its own switch under Your preferences. Slack, Teams and shared email channels set up under Notifications are not affected.

AI credits

The AI credits tab is where you ask for more credits, set a monthly spend cap, redeem promo codes and turn AI on or off for the workspace. See AI credits and AI tools and credits.