# Security, read-only access and EU hosting · Meiyam

> How Meiyam reads your systems without changing them, seals the evidence it collects, isolates your workspace and keeps your data in the EU.

Canonical: https://meiyam.com/security

Security

## Read-only by construction. Sealed as it is written.

Meiyam reads the configuration of the systems you connect and never changes it. Evidence is sealed with SHA-256 as it is stored, Meiyam runs on AWS in the EU (Ireland), and every user signs in with multi-factor authentication. Here is how each mechanism works.

-   Read-only access
-   Evidence sealed on write
-   Runs in the EU (Ireland)
-   Multi-factor sign-in

### Access to your systems

Every scanning integration is read-only and lists the exact access it needs before you grant it. Meiyam reads configuration and metadata: it does not read the contents of your storage buckets, your email or your messages.

Every integration lists what it can read and what it cannot do.

#### For example, an AWS account

Meiyam assumes a cross-account IAM role in your AWS account, with an external ID unique to the connection. An AWS CloudFormation template creates it, and you can read the template before you launch it. Meiyam reads configuration from Amazon Simple Storage Service (Amazon S3), AWS Identity and Access Management (IAM), Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Block Store (Amazon EBS), Amazon Virtual Private Cloud (Amazon VPC), Amazon Relational Database Service (Amazon RDS), AWS Key Management Service (AWS KMS), AWS CloudTrail, AWS Config and AWS Lambda. It cannot change or delete anything, because every API outside the read allowlist is denied.

| Integration | Access Meiyam holds | Cannot |
| --- | --- | --- |
| [AWS](https://meiyam.com/integrations/amazon-web-services) | A cross-account IAM role with a least-privilege read allowlist and an explicit deny on every other API, assumed with an external ID unique to the connection. A CloudFormation template creates it, and you can read the template before you launch it. No access keys change hands. | Change or delete anything, because every API outside the read allowlist is denied. |
| [GitHub](https://meiyam.com/integrations/github) | A GitHub App with seven read-only permissions across organization members, administration, repository metadata and security alerts. It cannot push, merge or change settings. | Push code, merge pull requests or change organization settings. |
| [Microsoft Entra ID](https://meiyam.com/integrations/microsoft-entra-id) | Five read-only Microsoft Graph application permissions, granted through your administrator's consent. None of them reaches mailbox, file or message content. | Change directory objects, or reach mailbox, file or message content. |
| [Atlassian](https://meiyam.com/integrations/atlassian) | An Atlassian Forge app installed on your site with read-only Jira and Confluence scopes. An optional, read-only organization API key adds users, groups and admin roles; it is stored encrypted and never shown again. | Create or edit Jira issues, Confluence pages or site settings. |
| [Slack](https://meiyam.com/integrations/slack) | A workspace app with read-only scopes for users, the workspace, channel lists and user groups. The scope set contains no message-content scope, and Meiyam refuses the connection if one is ever granted, so your conversations stay out of reach. | Read your conversations: a message-content scope gets the connection refused. |
| [Okta](https://meiyam.com/integrations/okta) | An API Services application that authenticates with a key pair: you register the public key, and the private key never leaves Meiyam. Seven read-only scopes and the Read-only Administrator role. No password or API token changes hands. | Change users, policies or applications under its Read-only Administrator role. |
| [Cloudflare](https://meiyam.com/integrations/cloudflare) | An account-owned API token you create in the Cloudflare dashboard with seven read permissions and no edit permission. Meiyam asks for nothing else, and stores the token encrypted. | Edit zones or settings, provided the token holds only the seven listed read permissions. |

One permitted AWS action, generating the IAM credential report, is recorded by CloudTrail as a write. It changes no configuration.

Jira remediation tickets are a separate, optional app with its own consent. It can create, comment on and transition Jira issues for your findings, and nothing else. The read-only Atlassian integration works without it.

For Cloudflare, the API token you create sets the scope: Meiyam stays read-only while that token holds no edit permission.

### Credentials

-   For AWS, Meiyam holds no access keys: it assumes the role you create, with an external ID unique to each connection.
    
-   Tokens and keys you give Meiyam, such as a Cloudflare API token or an Atlassian organization key, are encrypted with AES-256-GCM before they are stored, under a key held in AWS Secrets Manager, and are never shown again.
    
-   For Okta, Meiyam generates the key pair and you register only the public key.
    

### Evidence integrity

1.  #### Sealed on write
    
    A SHA-256 digest for every evidence object.
    
2.  #### Manifest per scan
    
    Each scan records a manifest of everything it wrote.
    
3.  #### Hash-chained log
    
    Each entry carries the hash of the one before it.
    
4.  #### Checksummed exports
    
    A SHA-256 checksum over the exported data.
    

Every evidence object is sealed with a SHA-256 digest when it is written. Each scan then records a manifest of everything it wrote in an append-only audit log, where every entry carries the hash of the entry before it, so a change to any past entry breaks the chain.

Database permissions prevent the application from updating or deleting audit log entries, and the service refuses to start if its database role could. Every change to a finding, from assignment to resolution, is written to the same log and shown on the finding's timeline. Evidence exports carry a SHA-256 checksum over the exported data.

Evidence sealed as it is written Example

1.  Example.
2.  SHA-256 per object: s3/demo-customer-uploads, 083cf7…077c.
3.  SHA-256 per object: iam/demo-account, 9395df…8411.
4.  SHA-256 per object: cloudtrail/demo-trail, 46a3b2…7262.
5.  Scan manifest: object\_count 3, manifest\_sha256 6911e038…4933c3.
6.  Audit log chain: evidence.sealed, prev\_sha256 000000…0000, row\_sha256 719025…7699.
7.  Audit log chain: evidence.sealed, prev\_sha256 719025…7699, row\_sha256 cd0009…341f.
8.  Audit log chain: evidence.sealed, prev\_sha256 cd0009…341f, row\_sha256 157e47…a35b.

What each change breaks

| Change | First check that fails | Recorded | Recomputed |
| --- | --- | --- | --- |
| Nothing changed | Verified. Every object matches its digest, the manifest matches the audit entry, and each entry matches the hash the next one carries. | `083cf7…077c` | `083cf7…077c` |
| Edit one evidence object | Fails at step 1. The changed object no longer matches the digest it was sealed with. | `083cf7…077c` | `b4fb2a…ae93` |
| Edit it and rewrite its digest | Fails at step 2. The scan manifest no longer matches the one recorded in the audit log. | `6911e038…4933c3` | `cc98e64c…10f357` |
| Also rewrite the audit entry | Fails at step 3. The rewritten entry's hash no longer matches the one the next entry carries. | `cd0009…341f` | `5c5bac…0778` |

The application cannot make this change. Its database role cannot update or delete audit entries, and the service refuses to start if it could.

Tamper-evident means a later change is detectable, not impossible: rewriting the audit chain from the changed entry onward needs database rights the application does not hold. Example data; nothing here comes from an account.

Each evidence object gets a SHA-256 digest, and each scan's manifest becomes a link in a hash-chained audit log.

How evidence is sealed

1.  Read
    
    A scan reads one resource's configuration as JSON.
    
2.  Digest
    
    Meiyam computes the SHA-256 of the exact bytes it stores.
    
    `sha256(bytes)`
    
3.  Store
    
    The object is written under your workspace and scan, with its digest in the object metadata.
    
    `{workspace}/scans/{scan}/{service}/{resource}.json`
    
4.  Manifest
    
    When the scan ends, one SHA-256 is taken over every object key and digest, sorted.
    
    `sha256(sorted "key digest" lines)`
    
5.  Audit entry
    
    The manifest digest, object count and scan are appended to the audit log.
    
    `evidence.sealed`
    
6.  Chain
    
    Each entry's hash covers its contents and the previous entry's hash; the first links to 64 zeros.
    
    `prev_sha256`
    

From one resource's configuration to a link in your workspace's audit chain.

### Your data

-   Meiyam runs on AWS in the EU (Ireland) region. Scan results, findings and evidence are stored and processed there.
    
-   Each workspace is isolated by row-level security on every workspace table, and evidence objects are stored under a path unique to your workspace.
    
-   Evidence is encrypted at rest under a dedicated AWS KMS key with automatic rotation, and the database is encrypted at rest with AWS KMS.
    
-   The workspace owner can export the whole workspace at any time as a versioned bundle with per-table and per-object digests.
    

### Signing in

Sign-in requires multi-factor authentication. Workspace admins can restrict membership to their own email domains. Six roles with fixed permissions control who can connect integrations, triage findings or manage the team, and auditors get read-only access limited to the frameworks and dates in scope. Sign-ins are recorded in the audit log.

-   Owner
-   Admin
-   Senior remediator
-   Remediator
-   Viewer
-   Auditor read-only

### Certifications

AM DevOps does not hold a SOC 2 report or an ISO 27001 certification for Meiyam today.

Meiyam does not issue audit opinions, attestations or certifications; SOC 2 reports are issued by independent CPA firms.

### Responsible disclosure

Report a suspected vulnerability to [security@meiyam.com](mailto:security@meiyam.com). We will not take action against good-faith research. We publish the same contact in [security.txt](https://meiyam.com/.well-known/security.txt).

### Be first in when Meiyam launches.

[See every integration and the access it needs](https://meiyam.com/integrations)

[Register interest](https://meiyam.com/register)