What is Meiyam?

Meiyam is compliance automation software for SOC 2 and ISO 27001, built by AM DevOps Limited, that connects read-only to a company’s cloud, code, identity and collaboration tools, checks their configuration automatically and keeps the evidence tamper-evident for auditors. It is built for B2B software companies preparing for their first audit, usually because an enterprise customer will not sign without a SOC 2 report.

Connect

Meiyam integrates with AWS, GitHub, Microsoft Entra ID, Okta, Slack, Atlassian and Cloudflare. Every scanning integration is read-only, and each one publishes the exact permissions it needs on its integration page before you grant them. You run a scan for any connected account whenever you need current evidence, and changes to your GitHub organization trigger a fresh scan on their own.

Check

Automated rules check the configuration each scan reads. Meiyam supports SOC 2 across Security, Availability and Confidentiality, and ISO/IEC 27001:2022, and shows for every criterion and control whether it is evidenced by an automated rule, by a document, or not yet. One failing check is one finding, counted against both frameworks.

A control nothing has checked reads as unproven. It does not read as passing, and connecting more tools does not change that. A document goes stale once it is older than your freshness threshold, 90 days by default.

Fix and prove

Failing checks become findings, ranked by severity, with an owner, a due date set by severity and a timeline of everything that happened to them. You can open Jira tickets from findings. Closing a ticket never resolves a finding by itself: a re-scan that passes the check resolves it, or a named person marks it resolved. Risk acceptance requires a reason and an expiry date.

The organisational side lives in the same place: policy templates you edit, version and approve, per-person acceptance links, and documents attached to the controls no integration can evidence. When your auditor asks, you export the evidence for a framework and period with a SHA-256 checksum over the data, and give them a read-only role limited to the frameworks in scope.

What comes next

The roadmap lists everything in development and planned, including device evidence from Microsoft Intune and Microsoft Defender for Endpoint, more cloud and identity integrations, scheduled scans, single sign-on with your own identity provider, an audit engagement workflow and an auditor portal.

What Meiyam is not

Meiyam does not issue audit opinions, attestations or certifications. SOC 2 reports are issued by independent CPA firms, and ISO 27001 certificates by accredited certification bodies. Meiyam gives you the evidence and the record; your auditor gives you the report.