MopokeHQ turns the work your team already does on vulnerabilities into dated, hash-chained records. Pick a framework and a period and you get an evidence pack. It supports your assessment. It does not replace your assessor.
The same detection, deadline and deployment records feed all three. If you answer to more than one framework, you do the work once.
Most teams build compliance evidence the week before an audit, from screenshots and exported tickets. MopokeHQ records it as the work happens.
Every stored SBOM is re-checked when a new advisory lands. Each exposure is marked by where it runs, gets a deadline from its priority and the framework preset you choose, and closes only when the fixed version is seen deployed. Each of those steps is an entry in the log.
Choose ISO 27001, SOC 2 or Essential Eight, and a date range. MopokeHQ produces a PDF for people and JSON with the chain hashes for anyone who wants to check the records themselves.
The log is append-only and hash-chained. Each entry carries the hash of the one before it, so a changed or removed entry breaks the chain.
c41f…9e028a3d…17bc77e0…b215f0e9…44a191ce…0a5fGroup projects by client. Each client gets its own evidence pack, its own period and your branding, and every notice you sent them is part of the record.
For agencies and MSPsNo. MopokeHQ produces evidence that supports an assessment. Your ISO 27001 certification body, SOC 2 auditor or Essential Eight assessor makes the decision.
No. ISO 27001 certifies an information security management system against an international standard. SOC 2 is an attestation report from a CPA firm against the AICPA Trust Services Criteria. Both look at how you manage technical vulnerabilities, and MopokeHQ maps the same records to ISO 27001 Annex A 8.8 and SOC 2 CC7.1.
A PDF and a JSON file for one framework and one period. Together they list each match, its priority and deadline, who acknowledged it, any "not affected" decisions and the deployment that closed it. The JSON includes the chain hashes.
Yes. Packs can be produced per client and white-labelled with your agency’s branding.
No. Lilly, the AI, adds a plain-language note to alerts and may suggest "not affected" for P2 and P3. A person confirms or overrides each suggestion, and that click is logged. Lilly never closes an exposure or silences a P1.
In Sydney, Australia, with all other stored data.
The evidence for next year’s assessment starts with this year’s pipelines. One include line, and every match, fix and deployment is on the record.