MeiyamRegister interest
Compliance automation · SOC 2 · ISO 27001

The security team you do not have yet.

Meiyam connects read-only to your cloud, code, identity and collaboration tools, checks them against SOC 2 and ISO 27001, turns each failed check into a finding ranked by severity, and seals the evidence your auditor will ask for.

Register interestFree trial opens at launch

Meiyam is software. It does the checking and the record-keeping; you make the decisions; your auditor issues the report.

See the product

Cloud and edgeAWS, Cloudflare29 rulesCodeGitHub17 rulesIdentityMicrosoft Entra ID, Okta19 rulesCollaborationAtlassian, Slack12 rules
Read-only connections today: Cloud and edge (AWS, Cloudflare), Code (GitHub), Identity (Microsoft Entra ID, Okta), Collaboration (Atlassian, Slack). 77 automated rules check them when a scan runs, and each scan's evidence is sealed.

Where are you today?

Read-only integrations
7
Each lists its access before you connect
Automated checks across your tools
77
Each maps to SOC 2 and ISO 27001
Frameworks supported
SOC 2 and ISO 27001
Scored by the product today
Policy templates
23
Each mapped to both frameworks
Criteria shown as passing without evidence
0
Every criterion starts unproven
The team, mapped

What a security team does, and what Meiyam does today

Meiyam does eight of these jobs and keeps the record for six more. Four stay with you. Select a job to see who does what.

Security team jobs

Meiyam does it 8

  • Meiyam
    77 automated rules check your cloud, code, identity and collaboration settings. Scans run when you start them and once at setup, and a change in your GitHub organization rescans that organization.
    You
    Decide which findings to fix first.
    See where you stand
  • Meiyam
    Checks multi-factor sign-in, how many administrators you have, whether privileged roles are held by named people, and whether deactivated accounts still hold access.
    You
    Remove the access it flags.
    Access checks by Annex A control
  • Meiyam
    Lists every cloud and SaaS resource each scan saw.
    You
    Keep track of laptops and phones yourself for now.
    Not available today
    • In development Device evidence from Microsoft Intune and Microsoft Defender for Endpoint
    Inventory and trend
  • Meiyam
    Checks that dependency alerts, secret scanning and code scanning are switched on in GitHub.
    You
    Act on the alerts those tools raise. Meiyam does not scan for vulnerabilities.
    The GitHub integration
  • Meiyam
    Seals everything a scan reads with SHA-256 as it is stored, and marks documents stale after 90 days by default.
    You
    Attach the records no integration can see, such as board minutes.
    How evidence is sealed
  • Meiyam
    Shows every SOC 2 criterion and ISO 27001 control as live, failing, backed by a document, stale or unproven. Nothing passes by default.
    You
    Set your audit date and choose your auditor.
    SOC 2 with Meiyam
  • Meiyam
    Gives each person their own link to accept the policies that apply to them, and keeps an exportable record.
    You
    Decide who each policy applies to.
    Policies and people
  • Meiyam
    Gives leadership its own home screen, a change digest and your score over time.
    You
    Take the decisions to your board.
    Home screens and change digest

Meiyam keeps the record, you do the work 6

  • Meiyam
    Turns each failed check into a finding you can assign, due in 7, 30 or 90 days by default for critical, high and medium severity, with a suggested fix where the rule has one. Open Jira tickets from it; a passing re-scan resolves it.
    You
    Make the change. Meiyam's scans never change your systems.
    Fix what fails
  • Meiyam
    Starts you from 23 templates mapped to SOC 2 and ISO 27001, keeps every version and records who approved it.
    You
    Edit them to match how you work, and approve them.
    See the policy templates
  • Meiyam
    Imports your people roster from a CSV file or syncs it from Microsoft Entra ID, and shows who has not accepted their policies.
    You
    Remove a leaver's access in each tool.
    Policies and people
  • Meiyam
    Records each accepted risk with a reason and an expiry, and reopens the finding when it lapses.
    You
    Decide which risks to accept.
    Not available today
    • Planned Vendor and risk registers
    Fix what fails
  • Meiyam
    Checks that third-party apps with access to your data are approved, and keeps SBOM and CBOM uploads.
    You
    Review new vendors.
    Not available today
    • Planned Vendor and risk registers
    See the full roadmap
  • Meiyam
    Gives the auditor you choose a read-only role limited to the frameworks and dates in scope, or a checksummed evidence export.
    You
    Agree scope and dates with your auditor. Meiyam does not talk to your auditor.
    Not available today
    • Planned Audit engagement workflow
    • Planned Auditor portal and provenance checks
    Hand it to your auditor

Stays with you 4

  • Meiyam
    Shows the current state of each control and the evidence behind it. Attach approved policies as Word documents, or an evidence export with a SHA-256 checksum.
    You
    Fill in the questionnaire. Meiyam does not fill in questionnaires.
    Not available today
    • Planned Trust centre
    Security at Meiyam
  • Meiyam
    Meiyam does not run reviewer sign-off on access today.
    You
    Run your periodic reviews and keep the sign-off.
  • Meiyam
    Includes an Incident Response Plan template. Meiyam does not detect or respond to incidents.
    You
    Run your response plan.
    See the policy templates
  • Meiyam
    Includes a Security Awareness and Training Policy template.
    You
    Deliver the training.
    See the policy templates
Your first audit

Start your first SOC 2 or ISO 27001 programme without hiring for it.

Every criterion starts unproven, so the gap list is your to-do list. Automated rules check 8 of the 38 SOC 2 criteria and 18 of the 93 Annex A controls on every scan, and 23 policy templates cover the organisational side.

Templates
23 templates map to all 38 SOC 2 criteria and 64 of the 93 Annex A controls.
Who issues the report
An independent CPA firm issues a SOC 2 report, and an accredited certification body certifies ISO 27001. Meiyam issues no opinion.
Documents
A policy or record reads as stale once it is older than 90 days, by default.

8 checked, 0 assumed30 criteria wait for documents

Example first scan
  • Live
  • Failing
  • Unproven

Example first scan: CC6.1 Failing (29 rules), CC6.2 Live (1 rule), CC6.3 Live (12 rules), CC6.6 Failing (13 rules), CC6.7 Live (3 rules), CC7.1 Live (11 rules), CC7.2 Live (2 rules), CC8.1 Live (6 rules). Unproven: 30.

Register interestSOC 2 with MeiyamThe ISO 27001 path
A deal waiting on a security review

Answer a security review with evidence, not assurances.

When a prospect's security questionnaire asks how you control access, encrypt data or review code changes, Meiyam shows the current state of each control and the evidence behind it. Attach your approved policies as Word documents, or an evidence export with a SHA-256 checksum. Meiyam does not fill in questionnaires. A trust centre is planned.

What you can attach today

  • Approved policies, downloaded as Word documents.
  • An evidence export for a framework and period, as JSON, CSV or PDF, with a SHA-256 checksum.
  • A record of who accepted each policy version.
  • Software and cryptography bills of materials.
  • Trust centre Planned
SealedExample

Evidence sealed as it is written

Evidence digest
083cf7…077cs3/demo-customer-uploads
Scan manifest
6911e038…4933c3Covers every digest in the scan
Previous entry
719025…7699Links to the entry before it

Entry before: 719025…7699. This scan: cd0009…341f. Entry after: 157e47…a35b.

Change one value and its digest no longer matches: b4fb2a…ae93 instead of the sealed 083cf7…077c.

See a change get caught
Register interestSecurity at Meiyam
No security team yet

Know what is misconfigured, who should fix it and what to do next.

Meiyam checks access, exposure, encryption, logging and code review across your tools. Each failure becomes a finding ranked by severity that you can assign, with a due date for critical, high and medium findings, and a suggested fix where the rule has one. Meiyam lists the next things that need a person.

What Meiyam checks

  • Access and identity

    29 rules

    Multi-factor sign-in, administrator counts, named holders of privileged roles, guests and deactivated accounts.

  • Exposure

    14 rules

    Public storage, open administrative ports, public repositories and spaces open to outsiders.

  • Encryption and data

    9 rules

    Encryption at rest, key rotation, modern TLS and protection against accidental deletion.

  • Logging and change records

    11 rules

    Audit trails, access and network logs, and a record of configuration changes.

  • Code and suppliers

    14 rules

    Review before merge, dependency alerts, secret and code scanning, and approved third-party apps.

What stays with you

  • Security questionnaires
  • Access reviews
  • Incident response
  • Security awareness training
  • Every decision: what to fix first and which risk to accept.
Register interestSee what needs you next
Read-only access

Read-only, and you can check it

Open any live integration to see the exact access Meiyam holds and what that access cannot do.

Every integration lists what it can read and what it cannot do.
  • AWSCloud infrastructureRead-only25 rules

    Holds

    A cross-account IAM role with a least-privilege read allowlist and an explicit deny on every other API, assumed with an external ID unique to the connection. A CloudFormation template creates it, and you can read the template before you launch it. No access keys change hands.

    Cannot

    Change or delete anything, because every API outside the read allowlist is denied.

    Integration details: AWS
  • GitHubSource controlRead-only17 rules

    Holds

    A GitHub App with seven read-only permissions across organization members, administration, repository metadata and security alerts. It cannot push, merge or change settings.

    Cannot

    Push code, merge pull requests or change organization settings.

    Integration details: GitHub
  • Microsoft Entra IDIdentityRead-only10 rules

    Holds

    Five read-only Microsoft Graph application permissions, granted through your administrator's consent. None of them reaches mailbox, file or message content.

    Cannot

    Change directory objects, or reach mailbox, file or message content.

    Integration details: Microsoft Entra ID
  • AtlassianCollaborationRead-only3 rules

    Holds

    An Atlassian Forge app installed on your site with read-only Jira and Confluence scopes. An optional, read-only organization API key adds users, groups and admin roles; it is stored encrypted and never shown again.

    Cannot

    Create or edit Jira issues, Confluence pages or site settings.

    Integration details: Atlassian
  • SlackCollaborationRead-only9 rules

    Holds

    A workspace app with read-only scopes for users, the workspace, channel lists and user groups. The scope set contains no message-content scope, and Meiyam refuses the connection if one is ever granted, so your conversations stay out of reach.

    Cannot

    Read your conversations: a message-content scope gets the connection refused.

    Integration details: Slack
  • OktaIdentityRead-only9 rules

    Holds

    An API Services application that authenticates with a key pair: you register the public key, and the private key never leaves Meiyam. Seven read-only scopes and the Read-only Administrator role. No password or API token changes hands.

    Cannot

    Change users, policies or applications under its Read-only Administrator role.

    Integration details: Okta
  • CloudflareEdge and networkRead-only4 rules

    Holds

    An account-owned API token you create in the Cloudflare dashboard with seven read permissions and no edit permission. Meiyam asks for nothing else, and stores the token encrypted.

    Cannot

    Edit zones or settings, provided the token holds only the seven listed read permissions.

    Integration details: Cloudflare

18 more are in development or planned.All integrations

Who does what

Meiyam does the checking, chasing and record-keeping

  1. You

    The organisation being audited

    • Decide the scope
    • Operate the controls
    • Write and approve policies
    • Choose an auditor

  2. Meiyam

    The checking, chasing and record-keeping

    • Connect read-only
    • Check configuration
    • Seal evidence
    • Track documents and acceptance
    • Export for your auditor

  3. Auditor

    An independent auditor or certification body

    • Test the controls
    • Issue the report or certificate
Who does what in an audit. Meiyam organises the evidence. Your auditor tests the controls and issues the report or certificate.

See what is available today and what is planned

Be first in when Meiyam launches.

Security overview
Register interestFree trial opens at launch