You build and run apps for clients. MopokeHQ tracks every CVE across every client project, puts the fixes in order, and tells each client what you did, from your own domain.
Each client’s projects sit under that client. The Now screen groups work by fix, not by CVE, so one upgrade that closes twelve CVEs across five client projects is one line, not twelve tickets.
The order is deterministic: priority, then SLA, then confidence. You can explain to any client why their fix came first or second.
booking-apia repo, SBOMs attach hereEvery stored SBOM is re-checked when a new advisory lands, and every exposure shows how sure MopokeHQ is that it matters. A CVE in an app you shipped for a client last year is matched today, with no rescan.
How matching worksThe rules are published and the same inputs always give the same result, so the SLA in your maintenance agreement can point at them.
| Priority | What lands here | Default SLA | Your team hears |
|---|---|---|---|
| P1 | Known exploited, malicious package, critical and confirmed live, or a runtime security release | 48 hours | Email straight away |
| P2 | Critical or high severity, or EPSS of 0.1 or more | 14 days | Daily digest |
| P3 | Everything else | 30 days | Weekly digest |
An unacknowledged P1 escalates to your whole organisation after 4 hours. An exposure closes on its own only when the fixed version is seen deployed.
When an issue is fixed and confirmed live, Lilly, MopokeHQ’s AI, drafts a plain-language notice for that client. Someone on your team reads it, edits it if needed, and sends it. Nothing Lilly writes sends itself.
Client reporting in your brandA vulnerability is not a breach. A compromise might be. If there are signs of actual compromise, MopokeHQ stops the normal notice flow and flags a possible incident, so nobody sends an “all fixed” email by mistake.
Breach rules depend on where you and your client operate. Under the GDPR (Article 33), a processor must tell the controller without undue delay, and the controller notifies the supervisory authority within 72 hours where feasible.
In Australia, under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act (generally those with annual turnover over $3 million, plus every private health service provider regardless of size) must take all reasonable steps to assess a suspected eligible data breach within 30 calendar days, and must notify affected individuals and the OAIC when serious harm is likely.
When you host or maintain an app for a client, you may both hold the same personal information. Agree in writing which of you assesses a breach and which one notifies.
General information, not legal advice.
A hash-chained log and one-click evidence packs for ISO 27001, SOC 2 and Essential Eight, white-labelled for the client.
Compliance evidencePorts, TLS, vulnerability templates and a ZAP baseline against client sites, after ownership is verified. Published scanner IPs for their firewall team.
External scanningStored data lives in Sydney, Australia, with more regions coming. Code review, which sends diffs to an AI provider, is off by default for client projects and switching it on is logged.
Security and dataPriced by band of active projects, not seats. When a client leaves, archive their projects: archived projects are free and keep their evidence.
How pricing worksIt suits MSPs and agencies that build or run applications for clients. It tracks vulnerabilities in each client’s app dependencies, containers and deployments, and handles the client communication. It is not an endpoint or network patching tool.
Yes. Notices and monthly digests go out from your own domain, signed with DKIM. The client portal carries your branding, and evidence packs can be white-labelled for a client.
No. Alerts go to your team. Clients get a notice when an issue is fixed and confirmed live, and only after someone on your team approves it. A client can be set to hear at discovery instead if their contract requires it.
It depends on the law that applies. Under the GDPR, a processor tells the controller without undue delay, and the controller notifies the regulator. In Australia, the OAIC says an eligible data breach at one entity holding the information is also one for the others, and only one needs to take the required steps. Either way, agree in writing which of you assesses and notifies. MopokeHQ flags signs of actual compromise so that assessment can start; it does not decide whether a breach is notifiable. This is general information, not legal advice.
No. The mopoke CLI runs on your own runners and uploads results out. Fix merge requests are opened from your runner too. Active external scans only run against targets whose ownership has been verified.
Composer-managed PHP apps such as Laravel are covered through the SBOM built in CI, along with PHP runtime security releases. WordPress plugins installed outside Composer are not a focus today, so talk to us about your setup first.
By band of active projects, meaning projects with an upload in the last 30 days. Users are unlimited, including client portal viewers. Archived projects are free and keep their evidence.
One job in your CI pipeline. Your first SBOM is matched against every advisory we hold within minutes.