Built for the perimeter you can't compromise.
Keel is self-hosted, BYO-LLM, and ships with container hardening, API key auth, secrets management, and a clear roadmap to SOC 2 Type II.
Today's security posture
✓ Self-hosted / Air-gapped
Your data never leaves your VPC. Deploy on-prem, in your cloud, or air-gapped. No SaaS dependency for core functionality.
✓ BYO-LLM
Bring your own LLM keys (OpenAI, Anthropic, Ollama local). Keel never proxies through our infrastructure. Your prompts, your models, your data residency.
✓ API Key Authentication
Platform-wide API key auth on every endpoint. No unauthenticated access to any service in the stack.
✓ HashiCorp Vault Integration
Secrets management via Vault. API keys, LLM tokens, database credentials — all stored and rotated outside application code.
✓ Container Security
Non-root containers, read-only filesystems where possible, minimal base images, no unnecessary capabilities.
✓ Prompt-Injection Defense
LLM gateway validates and sanitizes all prompt inputs. Circuit breakers prevent runaway token spend. Kill switch via POST /pause.
Compliance roadmap
Where we are and where we're heading.
Container hardening + API auth
Non-root containers, API key auth, Vault integration, prompt-injection defense.
Multi-tenancy (L2) with RLS + HMAC S2S auth
Tenant-aware request routing, per-tenant data isolation via header-based RLS.
RBAC in OmniView
Role-based access control in the control plane dashboard.
SSO / SCIM via WorkOS
Single sign-on and directory sync for enterprise identity providers.
SOC 2 Type II
Formal SOC 2 Type II audit. Artifacts available to Enterprise customers on request.
ISO 27001
ISO 27001 certification for information security management.
CEF / OCSF audit export
Common Event Format and Open Cybersecurity Schema Framework export for SIEM integration.
Questions about security?
We're happy to discuss our security posture, share architecture diagrams, or walk through our compliance roadmap on a call.
Contact us at hello@keel.dev