# Compliance automation for SOC 2 and ISO 27001 · Meiyam > Meiyam connects read-only to your cloud, code and identity tools, checks them against SOC 2 and ISO 27001, and keeps tamper-evident evidence for auditors. Canonical: https://meiyam.com/ Compliance automation · SOC 2 · ISO 27001 ## The security team you do not have yet. Meiyam connects read-only to your cloud, code, identity and collaboration tools, checks them against SOC 2 and ISO 27001, turns each failed check into a finding ranked by severity, and seals the evidence your auditor will ask for. [Register interest](https://meiyam.com/register) Free trial opens at launch Meiyam is software. It does the checking and the record-keeping; you make the decisions; your auditor issues the report. [See the product](https://meiyam.com/product) [Cloud and edge AWS, Cloudflare 29 rules](https://meiyam.com/integrations#cloud) [Code GitHub 17 rules](https://meiyam.com/integrations#code) [Identity Microsoft Entra ID, Okta 19 rules](https://meiyam.com/integrations#identity) [Collaboration Atlassian, Slack 12 rules](https://meiyam.com/integrations#collaboration) Read-only connections today: Cloud and edge (AWS, Cloudflare), Code (GitHub), Identity (Microsoft Entra ID, Okta), Collaboration (Atlassian, Slack). 77 automated rules check them when a scan runs, and each scan's evidence is sealed. Where are you today? - Our first SOC 2 or ISO 27001 audit Start from a gap list, not a blank page. - A security review is holding up a deal Show the evidence behind your answers. - Nobody here owns security full-time See what is wrong, who fixes it and what comes next. **Read-only integrations** 7 Each lists its access before you connect **Automated checks across your tools** 77 Each maps to SOC 2 and ISO 27001 **Frameworks supported** SOC 2 and ISO 27001 Scored by the product today **Policy templates** 23 Each mapped to both frameworks **Criteria shown as passing without evidence** 0 Every criterion starts unproven The team, mapped ### What a security team does, and what Meiyam does today Meiyam does eight of these jobs and keeps the record for six more. Four stay with you. Select a job to see who does what. Security team jobs Meiyam does it 8 - Configuration checks **Meiyam** 77 automated rules check your cloud, code, identity and collaboration settings. Scans run when you start them and once at setup, and a change in your GitHub organization rescans that organization. **You** Decide which findings to fix first. [See where you stand](https://meiyam.com/product#where-you-stand) - Access hygiene **Meiyam** Checks multi-factor sign-in, how many administrators you have, whether privileged roles are held by named people, and whether deactivated accounts still hold access. **You** Remove the access it flags. [Access checks by Annex A control](https://meiyam.com/frameworks/iso-27001#annex-a-coverage) - Asset inventory **Meiyam** Lists every cloud and SaaS resource each scan saw. **You** Keep track of laptops and phones yourself for now. **Not available today** - In development Device evidence from Microsoft Intune and Microsoft Defender for Endpoint [Inventory and trend](https://meiyam.com/product#also-included) - Code security settings **Meiyam** Checks that dependency alerts, secret scanning and code scanning are switched on in GitHub. **You** Act on the alerts those tools raise. Meiyam does not scan for vulnerabilities. [The GitHub integration](https://meiyam.com/integrations/github) - Evidence collection **Meiyam** Seals everything a scan reads with SHA-256 as it is stored, and marks documents stale after 90 days by default. **You** Attach the records no integration can see, such as board minutes. [How evidence is sealed](https://meiyam.com/security#evidence-integrity) - Audit preparation **Meiyam** Shows every SOC 2 criterion and ISO 27001 control as live, failing, backed by a document, stale or unproven. Nothing passes by default. **You** Set your audit date and choose your auditor. [SOC 2 with Meiyam](https://meiyam.com/frameworks/soc-2) - Policy acceptance **Meiyam** Gives each person their own link to accept the policies that apply to them, and keeps an exportable record. **You** Decide who each policy applies to. [Policies and people](https://meiyam.com/product#policies-and-people) - Reporting to leadership **Meiyam** Gives leadership its own home screen, a change digest and your score over time. **You** Take the decisions to your board. [Home screens and change digest](https://meiyam.com/product#also-included) Meiyam keeps the record, you do the work 6 - Fixing what fails **Meiyam** Turns each failed check into a finding you can assign, due in 7, 30 or 90 days by default for critical, high and medium severity, with a suggested fix where the rule has one. Open Jira tickets from it; a passing re-scan resolves it. **You** Make the change. Meiyam's scans never change your systems. [Fix what fails](https://meiyam.com/product#fix) - Writing policies **Meiyam** Starts you from 23 templates mapped to SOC 2 and ISO 27001, keeps every version and records who approved it. **You** Edit them to match how you work, and approve them. [See the policy templates](https://meiyam.com/policies) - Joiners and leavers **Meiyam** Imports your people roster from a CSV file or syncs it from Microsoft Entra ID, and shows who has not accepted their policies. **You** Remove a leaver's access in each tool. [Policies and people](https://meiyam.com/product#policies-and-people) - Risk decisions **Meiyam** Records each accepted risk with a reason and an expiry, and reopens the finding when it lapses. **You** Decide which risks to accept. **Not available today** - Planned Vendor and risk registers [Fix what fails](https://meiyam.com/product#fix) - Third-party apps **Meiyam** Checks that third-party apps with access to your data are approved, and keeps SBOM and CBOM uploads. **You** Review new vendors. **Not available today** - Planned Vendor and risk registers [See the full roadmap](https://meiyam.com/roadmap) - Working with your auditor **Meiyam** Gives the auditor you choose a read-only role limited to the frameworks and dates in scope, or a checksummed evidence export. **You** Agree scope and dates with your auditor. Meiyam does not talk to your auditor. **Not available today** - Planned Audit engagement workflow - Planned Auditor portal and provenance checks [Hand it to your auditor](https://meiyam.com/product#auditor) Stays with you 4 - Security questionnaires **Meiyam** Shows the current state of each control and the evidence behind it. Attach approved policies as Word documents, or an evidence export with a SHA-256 checksum. **You** Fill in the questionnaire. Meiyam does not fill in questionnaires. **Not available today** - Planned Trust centre [Security at Meiyam](https://meiyam.com/security) - Access reviews **Meiyam** Meiyam does not run reviewer sign-off on access today. **You** Run your periodic reviews and keep the sign-off. - Incident response **Meiyam** Includes an Incident Response Plan template. Meiyam does not detect or respond to incidents. **You** Run your response plan. [See the policy templates](https://meiyam.com/policies) - Security awareness training **Meiyam** Includes a Security Awareness and Training Policy template. **You** Deliver the training. [See the policy templates](https://meiyam.com/policies) Your first audit ### Start your first SOC 2 or ISO 27001 programme without hiring for it. Every criterion starts unproven, so the gap list is your to-do list. Automated rules check 8 of the 38 SOC 2 criteria and 18 of the 93 Annex A controls on every scan, and 23 policy templates cover the organisational side. **Templates** 23 templates map to all 38 SOC 2 criteria and 64 of the 93 Annex A controls. **Who issues the report** An independent CPA firm issues a SOC 2 report, and an accredited certification body certifies ISO 27001. Meiyam issues no opinion. **Documents** A policy or record reads as stale once it is older than 90 days, by default. 8 checked, 0 assumed 30 criteria wait for documents Example first scan - Live - Failing - Unproven Example first scan: CC6.1 Failing (29 rules), CC6.2 Live (1 rule), CC6.3 Live (12 rules), CC6.6 Failing (13 rules), CC6.7 Live (3 rules), CC7.1 Live (11 rules), CC7.2 Live (2 rules), CC8.1 Live (6 rules). Unproven: 30. [Register interest](https://meiyam.com/register) [SOC 2 with Meiyam](https://meiyam.com/frameworks/soc-2) [The ISO 27001 path](https://meiyam.com/frameworks/iso-27001) A deal waiting on a security review ### Answer a security review with evidence, not assurances. When a prospect's security questionnaire asks how you control access, encrypt data or review code changes, Meiyam shows the current state of each control and the evidence behind it. Attach your approved policies as Word documents, or an evidence export with a SHA-256 checksum. Meiyam does not fill in questionnaires. A trust centre is planned. What you can attach today - Approved policies, downloaded as Word documents. - An evidence export for a framework and period, as JSON, CSV or PDF, with a SHA-256 checksum. - A record of who accepted each policy version. - Software and cryptography bills of materials. - Trust centre Planned Sealed Example Evidence sealed as it is written **Evidence digest** `083cf7…077c` s3/demo-customer-uploads **Scan manifest** `6911e038…4933c3` Covers every digest in the scan **Previous entry** `719025…7699` Links to the entry before it Entry before: 719025…7699. This scan: cd0009…341f. Entry after: 157e47…a35b. Change one value and its digest no longer matches: `b4fb2a…ae93` instead of the sealed `083cf7…077c`. [See a change get caught](https://meiyam.com/security#evidence-integrity) [Register interest](https://meiyam.com/register) [Security at Meiyam](https://meiyam.com/security) No security team yet ### Know what is misconfigured, who should fix it and what to do next. Meiyam checks access, exposure, encryption, logging and code review across your tools. Each failure becomes a finding ranked by severity that you can assign, with a due date for critical, high and medium findings, and a suggested fix where the rule has one. Meiyam lists the next things that need a person. What Meiyam checks - #### Access and identity 29 rules Multi-factor sign-in, administrator counts, named holders of privileged roles, guests and deactivated accounts. - #### Exposure 14 rules Public storage, open administrative ports, public repositories and spaces open to outsiders. - #### Encryption and data 9 rules Encryption at rest, key rotation, modern TLS and protection against accidental deletion. - #### Logging and change records 11 rules Audit trails, access and network logs, and a record of configuration changes. - #### Code and suppliers 14 rules Review before merge, dependency alerts, secret and code scanning, and approved third-party apps. What stays with you - Security questionnaires - Access reviews - Incident response - Security awareness training - Every decision: what to fix first and which risk to accept. [Register interest](https://meiyam.com/register) [See what needs you next](https://meiyam.com/product#fix) Read-only access ### Read-only, and you can check it Open any live integration to see the exact access Meiyam holds and what that access cannot do. Every integration lists what it can read and what it cannot do. - AWS Cloud infrastructure Read-only 25 rules Holds A cross-account IAM role with a least-privilege read allowlist and an explicit deny on every other API, assumed with an external ID unique to the connection. A CloudFormation template creates it, and you can read the template before you launch it. No access keys change hands. Cannot Change or delete anything, because every API outside the read allowlist is denied. [Integration details: AWS](https://meiyam.com/integrations/amazon-web-services) - GitHub Source control Read-only 17 rules Holds A GitHub App with seven read-only permissions across organization members, administration, repository metadata and security alerts. It cannot push, merge or change settings. Cannot Push code, merge pull requests or change organization settings. [Integration details: GitHub](https://meiyam.com/integrations/github) - Microsoft Entra ID Identity Read-only 10 rules Holds Five read-only Microsoft Graph application permissions, granted through your administrator's consent. None of them reaches mailbox, file or message content. Cannot Change directory objects, or reach mailbox, file or message content. [Integration details: Microsoft Entra ID](https://meiyam.com/integrations/microsoft-entra-id) - Atlassian Collaboration Read-only 3 rules Holds An Atlassian Forge app installed on your site with read-only Jira and Confluence scopes. An optional, read-only organization API key adds users, groups and admin roles; it is stored encrypted and never shown again. Cannot Create or edit Jira issues, Confluence pages or site settings. [Integration details: Atlassian](https://meiyam.com/integrations/atlassian) - Slack Collaboration Read-only 9 rules Holds A workspace app with read-only scopes for users, the workspace, channel lists and user groups. The scope set contains no message-content scope, and Meiyam refuses the connection if one is ever granted, so your conversations stay out of reach. Cannot Read your conversations: a message-content scope gets the connection refused. [Integration details: Slack](https://meiyam.com/integrations/slack) - Okta Identity Read-only 9 rules Holds An API Services application that authenticates with a key pair: you register the public key, and the private key never leaves Meiyam. Seven read-only scopes and the Read-only Administrator role. No password or API token changes hands. Cannot Change users, policies or applications under its Read-only Administrator role. [Integration details: Okta](https://meiyam.com/integrations/okta) - Cloudflare Edge and network Read-only 4 rules Holds An account-owned API token you create in the Cloudflare dashboard with seven read permissions and no edit permission. Meiyam asks for nothing else, and stores the token encrypted. Cannot Edit zones or settings, provided the token holds only the seven listed read permissions. [Integration details: Cloudflare](https://meiyam.com/integrations/cloudflare) 18 more are in development or planned. [All integrations](https://meiyam.com/integrations) Who does what ### Meiyam does the checking, chasing and record-keeping 1. You The organisation being audited - Decide the scope - Operate the controls - Write and approve policies - Choose an auditor 2. Meiyam The checking, chasing and record-keeping - Connect read-only - Check configuration - Seal evidence - Track documents and acceptance - Export for your auditor 3. Auditor An independent auditor or certification body - Test the controls - Issue the report or certificate **Who does what in an audit.** Meiyam organises the evidence. Your auditor tests the controls and issues the report or certificate. [See what is available today and what is planned](https://meiyam.com/roadmap) ### Be first in when Meiyam launches. [Security overview](https://meiyam.com/security) [Register interest](https://meiyam.com/register) Free trial opens at launch