Secrets, keys, certificates and signing, governed across the vaults you already run.
KeelKey is the cryptographic authority of the platform: secrets, keys, certificates and signing, with governed access to cloud vaults across AWS, Azure, Google Cloud and Oracle Cloud.
Why KeelKey
Enterprises do not want another vault. KeelKey governs the vaults they have, adds quorum approval and tamper-evident audit to sensitive operations, and issues short-lived credentials so no agent holds a long-lived secret.
- Who it's for
- Security engineering, platform teams and PKI owners in multi-cloud enterprises. Every Keel customer uses it, because KeelAuth signing keys and agent credentials live here.
- Build phase
- Phase 1 · Foundation. See the roadmap
- First release scope
- First connectors: AWS and Azure. Google Cloud and Oracle Cloud follow, then certificate lifecycle, artifact signing and secret scanning.
What changes with Keel
| Problem | Today | With Keel |
|---|---|---|
| Vault sprawl | Secrets spread across several cloud vaults and on-prem tools, each with its own policy model. | One policy and audit plane over all of them. |
| Long-lived agent secrets | API keys pasted into config and never rotated. | Short-lived, scoped credentials issued on demand. |
| One person controls critical keys | A single admin can export or rotate a root key. | Quorum approval (M of N) for sensitive operations. |
| Audit gaps | Each vault logs differently, and admins can alter logs. | A normalized, tamper-evident log across vaults. |
| Certificate outages | Expiring certificates break services without warning. | Inventory, expiry alerts and automated renewal. |
| Unverifiable agent actions | No proof a given agent produced an output or call. | Per-agent signing keys for requests and artifacts. |
Vault sprawl
Today · Secrets spread across several cloud vaults and on-prem tools, each with its own policy model.
With Keel · One policy and audit plane over all of them.
Long-lived agent secrets
Today · API keys pasted into config and never rotated.
With Keel · Short-lived, scoped credentials issued on demand.
One person controls critical keys
Today · A single admin can export or rotate a root key.
With Keel · Quorum approval (M of N) for sensitive operations.
Audit gaps
Today · Each vault logs differently, and admins can alter logs.
With Keel · A normalized, tamper-evident log across vaults.
Certificate outages
Today · Expiring certificates break services without warning.
With Keel · Inventory, expiry alerts and automated renewal.
Unverifiable agent actions
Today · No proof a given agent produced an output or call.
With Keel · Per-agent signing keys for requests and artifacts.
What KeelKey does
Vault governance
- Connectors for AWS Secrets Manager and KMS, Azure Key Vault, Google Secret Manager and Cloud KMS, OCI Vault
- One policy model mapped onto each vault's native permissions
- Quorum approvals (M of N) for key export, rotation, deletion and break-glass access
- Immutable, normalized audit log across all vaults
Secrets and credentials
- Dynamic, short-lived credentials for agents and workloads, issued against a KeelAuth identity
- Automated rotation with dependency awareness
- Secret scanning for keys leaked into code and config
Keys, certificates and signing
- Key lifecycle: generate, rotate, retire, with HSM-backed options through cloud KMS
- Certificate inventory, expiry alerts and automated renewal (ACME)
- Signing service: per-agent signing keys and signing keys for KeelAuth tokens
Enterprise
- Customer-managed and bring-your-own keys
- Deploys in your cloud account; the Keel control plane never holds plaintext secrets
How it works with the rest of Keel
Each Keel product feeds the others. The delegation chain and the audit trail only work when the same system issues the identity, makes the decision and records the result.
Built on standards you can evaluate
Nothing proprietary to adopt. These are the specifications the design is based on.
Put your first agent under control.
Join the design partner program: 90 days from federating your identity provider to a governed agent in production planning, with a named Keel engineer.