# How a compliance scan works · Meiyam

> From a read-only connection to a sealed finding: what happens when Meiyam scans your environment, and what a scan never does.

Canonical: https://meiyam.com/notes/how-scanning-works

Engineering 29 Aug 2026 2 min

## How a compliance scan works

From a read-only connection to a sealed finding: what happens when Meiyam scans your environment, and what a scan never does.

Meiyam Engineering Product and engineering

Every number in Meiyam traces back to a scan, so it is worth being precise about what a scan is.

### A read-only connection

A connection is read-only access to one account: a cross-account IAM role in AWS, created by a CloudFormation template you can read before you launch it; a GitHub App with read-only permissions; read-only Microsoft Graph permissions granted by your Entra ID administrator; a read-only Forge app on your Atlassian site; a Slack workspace app with no message-content scope; an Okta API Services application with read-only scopes; an account-owned Cloudflare token with read permissions only.

The AWS role pairs a least-privilege read allowlist with an explicit deny on every other API. Even a permission granted by mistake elsewhere could not be used to change your configuration.

### When scans run

You start a scan for a connected account whenever you need current evidence, and the setup flow runs the first one for you. Changes to members, teams, repositories and branch protection in a GitHub organization trigger a fresh scan automatically.

### What a scan collects

Each scan is split by service: S3, IAM, EC2, RDS, CloudTrail and others for AWS; organization settings, members and repositories for GitHub; users, groups, role assignments and conditional-access policies for Entra ID. Each part collects the configuration of the resources it covers. If one part fails, the rest still complete, and the failure is recorded rather than dropped.

### Rules check the configuration

Rules then check what was collected. A rule is a single, declarative check: S3 bucket default encryption enabled, CloudTrail enabled in every region, root account MFA enabled. When a rule fails against a resource, Meiyam raises a finding with a severity, the resource it concerns and the control it maps to.

A finding resolves when a later scan finds the check passing, and the timeline records that the scan resolved it. A team member can also mark a finding resolved; the timeline then names who did it and when. Either way, the record shows how the finding was closed.

### Sealed evidence

Every evidence object a scan writes is sealed with a SHA-256 digest at the moment it is written. The scan then records a manifest of everything it wrote in an append-only audit log in which each entry carries the hash of the one before it. Changing a past entry would break the chain, and database permissions stop the application from updating or deleting entries in the first place.

### What a scan never does

A scan never changes configuration in your environment. It never marks a control as passing without a check behind it. Those two properties are the contract, and the architecture is built so that keeping them is the default rather than a discipline.

### Hear first when Meiyam opens

[Register interest](https://meiyam.com/register) [More notes](https://meiyam.com/notes)