# Roadmap: live, in development and planned · Meiyam > What Meiyam does today and what is planned, including single sign-on, an audit engagement workflow, a trust centre and more integrations. Canonical: https://meiyam.com/roadmap Roadmap ## What is live, what is in development, what is next. Everything Meiyam does today and everything on the way, from new integrations to the enterprise capabilities larger teams need. Every item carries a label. [Register interest](https://meiyam.com/register) Hear first when an item moves to live. **Supported** A framework Meiyam scores today. **Live** Available in the product today. **In development** Built or being built, not yet available. **Planned** Scoped, not yet started. ### Available today Live These are in the product today. - [Read-only integrations with AWS, GitHub, Microsoft Entra ID, Atlassian, Slack, Okta and Cloudflare](https://meiyam.com/integrations) - [SOC 2](https://meiyam.com/frameworks/soc-2) Supported - [ISO 27001:2022](https://meiyam.com/frameworks/iso-27001) Supported - [Scans for one account or many, and on GitHub changes](https://meiyam.com/product#connect) - [Findings, risk acceptance and Jira tickets](https://meiyam.com/product#fix) - [Policies, acceptance and the people roster](https://meiyam.com/product#policies-and-people) - [Auditor access and checksummed evidence exports](https://meiyam.com/product#auditor) - [Roles, sign-in, webhooks, digest and exports](https://meiyam.com/product#also-included) ### In development In development Built or being built, not yet available. - #### Microsoft Intune Device compliance evidence from the fleet Intune already manages: disk encryption, patch currency and screen lock. - #### Microsoft Defender for Endpoint Endpoint protection and threat posture as compliance evidence, alongside the device compliance evidence from Intune. ### Monitoring and evidence Planned How Meiyam collects, checks and keeps the evidence behind every control. - #### Scheduled scans Scans that run automatically on the cadence you set, so evidence stays current without anyone starting a scan. ### Policies, people and access Planned - #### Sign in with Google, Microsoft, GitHub or Apple Sign in to Meiyam with an existing Google, Microsoft, GitHub or Apple account. ### Integrations Planned Every scanning integration is read-only, and each one lists the exact access it needs. - #### Google Workspace Identity evidence for companies on Google Workspace: 2-Step Verification enforcement, admin roles, external sharing defaults and third-party OAuth grants. - #### Google Cloud Project and IAM posture, public exposure, audit logging and KMS posture, checked with the same rule families as AWS so both clouds score on one basis. - #### Microsoft Azure Subscription posture: RBAC and privileged roles, storage public exposure, logging and Defender configuration. - #### GitLab™ The GitHub checks, for GitLab: two-factor enforcement, protected branches and approval rules, token and deploy-key hygiene. GITLAB is a trademark of GitLab Inc. in the United States and other countries and regions. - #### Bitbucket Workspace security settings, branch permissions, app passwords and access-key hygiene for Bitbucket Cloud. - #### Azure DevOps Organization, project and branch policies, service connections and personal access token hygiene, for teams whose code and pipelines run in Azure DevOps. - #### Jamf Pro Device evidence for Apple fleets in Jamf Pro: device inventory, FileVault, screen lock and OS currency, feeding the same device-control rules as Intune. - #### Iru (formerly Kandji) Device evidence for Apple fleets on Iru, formerly Kandji: device inventory and configuration posture, feeding the same device rules as Intune and Jamf Pro. - #### Rippling HR roster evidence from Rippling: people, departments and employment dates, with joiner and leaver changes feeding offboarding evidence. - #### BambooHR HR roster evidence from BambooHR: people, departments and employment fields. - #### Personio HR roster evidence from Personio: people, departments and employment fields. - #### Checkr Background-check completion per person, joined to the roster, so pre-hire screening is evidenced rather than attested. Check results stay out of scope. - #### 1Password Credential-management evidence: account-level 2FA policy, vault access model and sharing posture. - #### Vercel Deploy-platform posture: team member roles, deployment protection and environment configuration hygiene. - #### Datadog Monitoring evidence: monitors exist, are not muted, and have fired and been handled, plus user and API-key hygiene, scanned instead of self-reported. - #### Linear Remediation tickets in Linear: open an issue from a finding and follow it on the finding. Closing the issue never resolves the finding by itself. Linear is not a scanned provider. ### Frameworks Planned - #### HIPAA The HIPAA Security Rule, scored from controls Meiyam already checks. - #### FIPS 140-3 FIPS 140-3 evidence in the product. A standalone FIPS assessment CLI exists today and runs entirely in your own environment. ### Enterprise features on the roadmap Planned Enterprise These are planned and not available today. - #### Single sign-on with your identity provider Sign in through your own identity provider over SAML 2.0 or OIDC, routed by verified domain, with SSO required per workspace if you choose. - #### Audit engagement workflow Import your auditor's request list, pre-answer it from sealed evidence and export the answered list with a package checkable with standard checksum tools. - #### Auditor portal and provenance checks A scoped space where your auditor reviews evidence, accepts or flags each request and checks each artifact's origin, with every view and download logged. - #### Trust centre A public security page that publishes only what you choose: selected policies, a live control summary, sub-processors and NDA-gated document requests. - #### Custom frameworks Map your own control framework onto the controls Meiyam already checks and score it from the same results. - #### Vendor and risk registers A vendor register with risk assessments and review dates, and a risk register whose residual scores reflect open findings. Planned items describe scope, not dates. Third-party names identify the services Meiyam connects to and are trademarks of their respective owners; Meiyam is not affiliated with, sponsored by or endorsed by them. [Trademark notices](https://meiyam.com/legal/trademarks) ### Tell us what you need next Select the integrations and frameworks you need when you register, and we will email you as each one goes live. [Register interest](https://meiyam.com/register)