Built to be trusted with real money.
Keel runs capital calls, distributions, reconciliation and tax for live funds. Here's exactly how that data is protected — every control below is in the product today, not a roadmap promise.
Encrypted in transit and at rest.
Encrypted in transit
Every connection is served over TLS / HTTPS — no plaintext over the wire.
Sensitive PII encrypted at rest
SSNs / EINs, tax IDs and bank account, routing, IBAN & SWIFT details are encrypted at the application layer with AES-256-GCM — on top of the database's own at-rest encryption.
7-year audit trail
Every administrator and operator action is recorded — who changed what, when — across every fund, investor and transaction. Financial records are never hard-deleted.
Data residency
A dedicated database / data-residency option for funds that require their data isolated to its own store (Multi-Fund and Enterprise plans).
Strong authentication, least privilege.
Mandatory two-factor (MFA)
Two-factor authentication is required for all administrator access, with recovery codes — and step-up re-authentication for the platform operator console.
Role-based access
Edit vs. view-only administrators, and separate scoped portals for investors, prospects, accountants and counsel — each sees only what its role allows.
Per-tenant isolation
Every firm's data is scoped to its tenant. Host-scoped login means one firm's credentials never work on another firm's site — or on the operator console.
SSO / SAML
Single sign-on with your identity provider on the Enterprise plan.
Hardened against the common attacks.
Brute-force & bot defense
Failed-login lockout, modern password hashing (bcrypt), and a CAPTCHA challenge on sign-in, sign-up and password reset.
Bounded sessions
Sessions expire on a fixed schedule, and a revoked or downgraded user loses access within minutes — not whenever a token happens to expire.
Default-deny gateway
A single edge gate sits in front of the entire admin surface — every request and action is authenticated before it reaches a page.
Reconciled to the penny
Capital calls, distributions, NAV and cost basis reconcile to the bank and are continuously re-checked — integrity is a security property here, not just an accounting one.
We tell you exactly what we have.
Everything on this page is implemented and verifiable. We do not claim certifications we haven't earned: Keel is not yet SOC 2 or ISO 27001 certified, and we'll say so plainly until that changes. If your diligence needs a specific control documented, email security@keelpro.xyz and we'll walk you through it.