# What is Meiyam? SOC 2 and ISO 27001 compliance automation

> Meiyam is compliance automation for SOC 2 and ISO 27001: what it checks today, how it keeps evidence, what is planned and what it leaves to your auditor.

Canonical: https://meiyam.com/notes/what-meiyam-is

Product 29 Aug 2026 2 min

## What is Meiyam?

Meiyam is compliance automation for SOC 2 and ISO 27001: what it checks today, how it keeps evidence, what is planned and what it leaves to your auditor.

Meiyam Engineering Product and engineering

Meiyam is compliance automation software for SOC 2 and ISO 27001, built by AM DevOps Limited, that connects read-only to a company’s cloud, code, identity and collaboration tools, checks their configuration automatically and keeps the evidence tamper-evident for auditors. It is built for B2B software companies preparing for their first audit, usually because an enterprise customer will not sign without a SOC 2 report.

### Connect

Meiyam integrates with AWS, GitHub, Microsoft Entra ID, Okta, Slack, Atlassian and Cloudflare. Every scanning integration is read-only, and each one publishes the exact permissions it needs on its [integration page](https://meiyam.com/integrations) before you grant them. You run a scan for any connected account whenever you need current evidence, and changes to your GitHub organization trigger a fresh scan on their own.

### Check

Automated rules check the configuration each scan reads. Meiyam supports SOC 2 across Security, Availability and Confidentiality, and ISO/IEC 27001:2022, and shows for every criterion and control whether it is evidenced by an automated rule, by a document, or not yet. One failing check is one finding, counted against both frameworks.

A control nothing has checked reads as unproven. It does not read as passing, and connecting more tools does not change that. A document goes stale once it is older than your freshness threshold, 90 days by default.

### Fix and prove

Failing checks become findings, ranked by severity, with an owner, a due date set by severity and a timeline of everything that happened to them. You can open Jira tickets from findings. Closing a ticket never resolves a finding by itself: a re-scan that passes the check resolves it, or a named person marks it resolved. Risk acceptance requires a reason and an expiry date.

The organisational side lives in the same place: policy templates you edit, version and approve, per-person acceptance links, and documents attached to the controls no integration can evidence. When your auditor asks, you export the evidence for a framework and period with a SHA-256 checksum over the data, and give them a read-only role limited to the frameworks in scope.

### What comes next

The [roadmap](https://meiyam.com/roadmap) lists everything in development and planned, including device evidence from Microsoft Intune and Microsoft Defender for Endpoint, more cloud and identity integrations, scheduled scans, single sign-on with your own identity provider, an audit engagement workflow and an auditor portal.

### What Meiyam is not

Meiyam does not issue audit opinions, attestations or certifications. SOC 2 reports are issued by independent CPA firms, and ISO 27001 certificates by accredited certification bodies. Meiyam gives you the evidence and the record; your auditor gives you the report.

### Hear first when Meiyam opens

[Register interest](https://meiyam.com/register) [More notes](https://meiyam.com/notes)