Compliance workspace

Audit-ready, without the spreadsheet maze.

Controls, evidence and policies in one register.

Controlkeep gives a small team one register for security controls: who owns each one, its status, when it's next reviewed, the evidence behind it and the policies people have acknowledged. Export it all when your auditor asks.

Start freeAbout the starter templates

Starter templates are original, written in our own words. Using them is not a certification or an audit opinion.

  • Free plan, no card
  • SOC 2-style and ISO 27001-style starters
  • CSV + JSON audit export

Why it works

One register instead of five spreadsheets.

Most audit prep is chasing owners, evidence and signatures. Keep them next to the control they belong to, and the register stays current between audits.

Control register

Starter control sets organised SOC 2-style and ISO 27001-style, or your own. Owners, status, “not applicable” with justification, review cycles.

Evidence locker

Upload files (PDF, images, text, CSV, Word, Excel), add links or notes, set expiry dates and map one piece of evidence to many controls.

Policies people read

Versioned policies in Markdown, approved by an owner or admin, with a record of who acknowledged which version.

Reminders

Weekly emails for overdue reviews and evidence that expires within 30 days. Members who haven’t acknowledged a policy get a nudge after 7 days.

Audit exports

A control matrix CSV and a JSON audit bundle with evidence hashes, policy versions, acknowledgements and the audit log.

AI policy drafts (optional)

Get a first draft of a policy using your own AI provider key. It’s labelled “AI draft, needs review” until someone approves it.

Evidence

Upload once. Map it everywhere.

One access review can support several controls. Attach it once, tick the controls it backs up, and set an expiry date if it goes stale.

  • PDF, images, text, CSV, Word and Excel up to 10 MB
  • File contents are checked, not just the extension
  • Reminded 30 days before evidence expires
How evidence works

Audit export

Hand your auditor one file.

Owners and admins can download a JSON bundle of the whole register. Every evidence file is listed with its SHA-256 hash, so it's clear what was provided.

  • Control matrix CSV, one row per control
  • Policies with every version and acknowledgement
  • The workspace audit log, included
// audit-bundle.json (excerpt)
{
  "readiness": [{
    "framework": "SOC 2-style…",
    "pct": 62
  }],
  "evidence": [{
    "title": "Q3 access review",
    "file": { "sha256": "9f2c…" }
  }],
  "policies": [ … ],
  "audit_log": [ … ]
}

How it works

From blank page to audit-ready.

Pick a starter

Add a starter framework (or write your own controls) and assign owners.

Attach evidence

Upload or link evidence and map it to the controls it supports.

Publish policies

Write or import policies, approve them and collect acknowledgements.

Stay ready

Watch readiness rise, act on reminders, and export for your auditor.

Pricing

Start free. Upgrade when the team grows.

Free

$0 /month

  • 50 controls
  • 100 MB evidence storage
  • 3 team members
  • Starter framework templates
  • Policy versions + acknowledgements
  • CSV + JSON audit export
Start free
Most popular

Pro

$199 /month

  • 1,000 controls
  • 5 GB evidence storage
  • 25 team members
  • Review + expiry reminder emails
  • AI policy drafts with your own key (200/mo)
  • Everything in Free
Start free, upgrade anytime

FAQ

Questions, answered.

Is this an audit or a certification?
Starter templates are original, simplified control objectives written by Controlkeep to help you organise your work. They are not the official text of any standard, do not cover every requirement, and using them (or this product) is not a certification or an audit opinion. Always check against the official standard and work with a qualified auditor.
What does the readiness percentage mean?
Implemented controls divided by applicable controls, per framework. It measures what your team has marked as implemented, not an assessment.
Can I write my own controls?
Yes. Use a starter, your own controls, or both. Marking a control “not applicable” needs a written reason.
Can I get everything out, or delete it?
Yes. Download all workspace data as JSON, or delete the workspace, including every stored evidence file, permanently.

Your controls, owned and evidenced.

Start with a starter set, assign owners, and keep the evidence where your auditor can find it.

Start freeRead the guide