KeelOps

How we handle your access, secrets and data

How we get into your systems, how we handle secrets, what we log, how offboarding works, and which certifications we do not hold yet.

Free AWS bill check See pricing

Why this page exists

You would be giving a company you found online access to the systems your business runs on. That deserves a straight answer about how we work, including the parts that are still missing.

How we access your systems

Read-only first. The free review uses a read-only role that you create in your own account with one template. We can read billing, settings, backup status and security settings. We cannot change anything, open your stored files or database records, or create logins or keys.
Change access only after you hire us, and only for the systems your plan covers. Where your platform supports it, change access is time-limited to approved change windows.
The access lives in your account. You can see it, narrow it and delete it whenever you like. Deleting it ends our access at once, with no penalty and no notice period.
No shared root logins. We do not ask for your main account owner login, and we ask you not to send it.

Secrets: passwords, keys and tokens

We never ask for passwords or keys by email, chat or form. If you send one by mistake, we tell you and ask you to replace it.
Where we need a credential to do a job, we use access you grant through your own platform (roles, scoped tokens or a shared password manager you control), so you can see and revoke it.
If we find exposed keys in your code or documents during a review, we report where they are. We do not copy or test them.

Your data

Your data stays in your accounts. We work inside your cloud and servers. We do not copy your customer data or database records out.
What we keep: the review report, notes on how your setup works, and the log of our actions. These hold settings and findings, not customer records.
Billing stays yours. We are not a reseller and never become your billing contact.

Before you sign, we tell you in writing where our reports and logs are stored and how long we keep them.

Logging

Every action we take is logged with who or what did it, when, on which system and under which approval. You get the log.
Actions in your cloud account also appear in your provider's own activity log (on AWS, CloudTrail), which lives in your account and which we cannot edit.
Every change comes with a written note first: what, why, and how to undo it. Nothing changes until you approve it.

example entries, not a real customer

People and software

Software does the repetitive checking. Every finding is reviewed by a senior engineer before you see it, and every change is reviewed before it is made. No automated tool changes your systems on its own.

Offboarding

When you stop, at any point:

You delete the role or tokens you gave us. One action ends our access.
We send you the documentation of your setup and the final action log.
We confirm in writing that our access is gone.
On request, we delete the review report and notes we hold about your setup.

There is no exit fee, and everything we set up lives in your accounts.

Certifications we do not hold yet

We do not hold SOC 2 or ISO 27001 certification today, and we will not imply otherwise. If your customers or auditors require a certified vendor, tell us early. We will answer your security questionnaire honestly, and if a certification is a hard requirement, we are not the right fit for that work yet.

Questions we expect from your security team

Can we review the exact permissions first? Yes. The read-only template is short and readable. Read it, or have your own team check it, before you run it.
Can we restrict access to one account or project? Yes. Start with the one that matters most.
Can we watch what you do? Yes. The action log and your provider's activity log both show it.

How we work with your systems

You stay in control

Read-only access first
The free bill check needs read access and nothing else. Nothing in your systems changes.
You approve every change
Each change comes as a short written note first: what, why, and how to undo it.
Your data and billing stay yours
Everything stays in your own account. We never become your billing contact.
Every action logged
Every action we take is logged, and the log is visible to you.
One-click access removal
Delete the access role and our access ends at once, with no penalty.
Month to month
There is no minimum term and no exit fee. Stop at the end of any month.