MeiyamRegister interest
Security

Read-only by construction. Sealed as it is written.

Meiyam reads the configuration of the systems you connect and never changes it. Evidence is sealed with SHA-256 as it is stored, Meiyam runs on AWS in the EU (Ireland), and every user signs in with multi-factor authentication. Here is how each mechanism works.

Access to your systems

Every scanning integration is read-only and lists the exact access it needs before you grant it. Meiyam reads configuration and metadata: it does not read the contents of your storage buckets, your email or your messages.

Every integration lists what it can read and what it cannot do.

For example, an AWS account

Meiyam assumes a cross-account IAM role in your AWS account, with an external ID unique to the connection. An AWS CloudFormation template creates it, and you can read the template before you launch it. Meiyam reads configuration from Amazon Simple Storage Service (Amazon S3), AWS Identity and Access Management (IAM), Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Block Store (Amazon EBS), Amazon Virtual Private Cloud (Amazon VPC), Amazon Relational Database Service (Amazon RDS), AWS Key Management Service (AWS KMS), AWS CloudTrail, AWS Config and AWS Lambda. It cannot change or delete anything, because every API outside the read allowlist is denied.
IntegrationAccess Meiyam holdsCannot
AWSA cross-account IAM role with a least-privilege read allowlist and an explicit deny on every other API, assumed with an external ID unique to the connection. A CloudFormation template creates it, and you can read the template before you launch it. No access keys change hands.Change or delete anything, because every API outside the read allowlist is denied.
GitHubA GitHub App with seven read-only permissions across organization members, administration, repository metadata and security alerts. It cannot push, merge or change settings.Push code, merge pull requests or change organization settings.
Microsoft Entra IDFive read-only Microsoft Graph application permissions, granted through your administrator's consent. None of them reaches mailbox, file or message content.Change directory objects, or reach mailbox, file or message content.
AtlassianAn Atlassian Forge app installed on your site with read-only Jira and Confluence scopes. An optional, read-only organization API key adds users, groups and admin roles; it is stored encrypted and never shown again.Create or edit Jira issues, Confluence pages or site settings.
SlackA workspace app with read-only scopes for users, the workspace, channel lists and user groups. The scope set contains no message-content scope, and Meiyam refuses the connection if one is ever granted, so your conversations stay out of reach.Read your conversations: a message-content scope gets the connection refused.
OktaAn API Services application that authenticates with a key pair: you register the public key, and the private key never leaves Meiyam. Seven read-only scopes and the Read-only Administrator role. No password or API token changes hands.Change users, policies or applications under its Read-only Administrator role.
CloudflareAn account-owned API token you create in the Cloudflare dashboard with seven read permissions and no edit permission. Meiyam asks for nothing else, and stores the token encrypted.Edit zones or settings, provided the token holds only the seven listed read permissions.

One permitted AWS action, generating the IAM credential report, is recorded by CloudTrail as a write. It changes no configuration.

Jira remediation tickets are a separate, optional app with its own consent. It can create, comment on and transition Jira issues for your findings, and nothing else. The read-only Atlassian integration works without it.

For Cloudflare, the API token you create sets the scope: Meiyam stays read-only while that token holds no edit permission.

Credentials

  • For AWS, Meiyam holds no access keys: it assumes the role you create, with an external ID unique to each connection.

  • Tokens and keys you give Meiyam, such as a Cloudflare API token or an Atlassian organization key, are encrypted with AES-256-GCM before they are stored, under a key held in AWS Secrets Manager, and are never shown again.

  • For Okta, Meiyam generates the key pair and you register only the public key.

Evidence integrity

  1. Sealed on write

    A SHA-256 digest for every evidence object.

  2. Manifest per scan

    Each scan records a manifest of everything it wrote.

  3. Hash-chained log

    Each entry carries the hash of the one before it.

  4. Checksummed exports

    A SHA-256 checksum over the exported data.

Every evidence object is sealed with a SHA-256 digest when it is written. Each scan then records a manifest of everything it wrote in an append-only audit log, where every entry carries the hash of the entry before it, so a change to any past entry breaks the chain.

Database permissions prevent the application from updating or deleting audit log entries, and the service refuses to start if its database role could. Every change to a finding, from assignment to resolution, is written to the same log and shown on the finding's timeline. Evidence exports carry a SHA-256 checksum over the exported data.

Evidence sealed as it is writtenExample
  1. Example.
  2. SHA-256 per object: s3/demo-customer-uploads, 083cf7…077c.
  3. SHA-256 per object: iam/demo-account, 9395df…8411.
  4. SHA-256 per object: cloudtrail/demo-trail, 46a3b2…7262.
  5. Scan manifest: object_count 3, manifest_sha256 6911e038…4933c3.
  6. Audit log chain: evidence.sealed, prev_sha256 000000…0000, row_sha256 719025…7699.
  7. Audit log chain: evidence.sealed, prev_sha256 719025…7699, row_sha256 cd0009…341f.
  8. Audit log chain: evidence.sealed, prev_sha256 cd0009…341f, row_sha256 157e47…a35b.
What each change breaks
ChangeFirst check that failsRecordedRecomputed
Nothing changedVerified. Every object matches its digest, the manifest matches the audit entry, and each entry matches the hash the next one carries.083cf7…077c083cf7…077c
Edit one evidence objectFails at step 1. The changed object no longer matches the digest it was sealed with.083cf7…077cb4fb2a…ae93
Edit it and rewrite its digestFails at step 2. The scan manifest no longer matches the one recorded in the audit log.6911e038…4933c3cc98e64c…10f357
Also rewrite the audit entryFails at step 3. The rewritten entry's hash no longer matches the one the next entry carries.cd0009…341f5c5bac…0778

The application cannot make this change. Its database role cannot update or delete audit entries, and the service refuses to start if it could.

Tamper-evident means a later change is detectable, not impossible: rewriting the audit chain from the changed entry onward needs database rights the application does not hold. Example data; nothing here comes from an account.

Each evidence object gets a SHA-256 digest, and each scan's manifest becomes a link in a hash-chained audit log.

How evidence is sealed

  1. Read

    A scan reads one resource's configuration as JSON.

  2. Digest

    Meiyam computes the SHA-256 of the exact bytes it stores.

    sha256(bytes)

  3. Store

    The object is written under your workspace and scan, with its digest in the object metadata.

    {workspace}/scans/{scan}/{service}/{resource}.json

  4. Manifest

    When the scan ends, one SHA-256 is taken over every object key and digest, sorted.

    sha256(sorted "key digest" lines)

  5. Audit entry

    The manifest digest, object count and scan are appended to the audit log.

    evidence.sealed

  6. Chain

    Each entry's hash covers its contents and the previous entry's hash; the first links to 64 zeros.

    prev_sha256

From one resource's configuration to a link in your workspace's audit chain.

Your data

  • Meiyam runs on AWS in the EU (Ireland) region. Scan results, findings and evidence are stored and processed there.

  • Each workspace is isolated by row-level security on every workspace table, and evidence objects are stored under a path unique to your workspace.

  • Evidence is encrypted at rest under a dedicated AWS KMS key with automatic rotation, and the database is encrypted at rest with AWS KMS.

  • The workspace owner can export the whole workspace at any time as a versioned bundle with per-table and per-object digests.

Signing in

Sign-in requires multi-factor authentication. Workspace admins can restrict membership to their own email domains. Six roles with fixed permissions control who can connect integrations, triage findings or manage the team, and auditors get read-only access limited to the frameworks and dates in scope. Sign-ins are recorded in the audit log.

  • Owner
  • Admin
  • Senior remediator
  • Remediator
  • Viewer
  • Auditor read-only

Certifications

AM DevOps does not hold a SOC 2 report or an ISO 27001 certification for Meiyam today.

Meiyam does not issue audit opinions, attestations or certifications; SOC 2 reports are issued by independent CPA firms.

Responsible disclosure

Report a suspected vulnerability to security@meiyam.com. We will not take action against good-faith research. We publish the same contact in security.txt.

Be first in when Meiyam launches.

See every integration and the access it needs
Register interest