Read-only, and you can check it
Every permission Meiyam holds, integration by integration, and how to inspect each one before you grant it.
A compliance tool asks for read access to the most sensitive configuration you own. Meiyam’s side of that arrangement is built to be as inspectable as yours: every scanning integration is read-only, and you can see exactly what it holds before you grant it.
AWS
The onboarding template is plain CloudFormation you can read before launching. The role it creates has a least-privilege allowlist of read actions and an explicit deny on every API outside that allowlist, a statement that overrides any permission that might be attached later. Meiyam assumes the role with an external ID unique to the connection, so no access keys change hands. One permitted action, generating the IAM credential report, is recorded by CloudTrail as a write; it changes no configuration.
GitHub and Microsoft Entra ID
The GitHub App asks for seven read-only permissions: organization members and administration, repository metadata and administration, and secret scanning, Dependabot and code scanning alerts. It cannot push, merge or change settings. For Entra ID, your administrator consents to five read-only Microsoft Graph application permissions, none of which reaches mailbox, file or message content.
Slack
The Slack integration asks for read-only scopes covering users, the workspace, channel lists and user groups. Its scope set contains no message-content scope, and if a workspace grants one anyway, Meiyam refuses the connection. You can check the scope list on the installation screen and in your workspace’s app settings afterwards.
Okta, Cloudflare and Atlassian
For Okta, Meiyam generates a key pair, you register the public key, and the application holds seven read-only scopes with the Read-only Administrator role. For Cloudflare, you create an account-owned token with seven read permissions and no edit permission. For Atlassian, a Forge app holds read-only Jira and Confluence scopes. Tokens and keys you give Meiyam are encrypted with AES-256-GCM before they are stored and are never shown again.
The one integration that writes
Jira remediation tickets are a separate, optional app with its own consent. It can create, comment on and transition Jira issues for your findings, and nothing else. The read-only Atlassian integration works without it.
The record holds us to it too
A hash-chained, append-only audit log is usually described as protection against tampering by an attacker or by a team under audit pressure. It cuts the other way as well: the application cannot update or delete entries, and a change to any past entry breaks the chain.
The FIPS assessment CLI
Meiyam’s standalone FIPS 140-3 assessment CLI runs on your own machine and sends nothing to Meiyam: no telemetry, no version checks, no error reporting. It is plain Python you can read before you run it, and each release ships SHA256SUMS so you can check the files you downloaded.