Where your data lives
Everything MopokeHQ stores is stored in one region. That includes SBOMs, scan results, deploy reports, the evidence log and every message sent to your clients.
Sydney, Australia is the region today. More regions are coming.
Your data, and who can read it
A security tool sees a map of your weak spots. Here is where that map is kept, who can read it, and what leaves for AI processing.
- Region
- Sydney, Australia. More coming
- Database
- Managed Postgres, Sydney
- Files
- Object storage in Sydney, encrypted per organisation
- AI processing
- AI provider, minimal facts only, one switch turns it off
Push only. We never connect in.
The mopoke CLI runs on your own CI runners and pushes results out with a token you control. MopokeHQ never opens a connection into your network, which is why a self-managed GitLab, Gitea or Forgejo behind a firewall works as is.
Fix merge requests come from a scheduled job in your own runner that collects the work queued for it. In the default setup MopokeHQ stores no Git platform credentials at all.
- CI auth
- A group upload token in a masked CI/CD variable
- Inbound access
- None
- Git credentials
- None stored in runner mode
- Pipeline impact
- If MopokeHQ is unreachable, the job warns and carries on
One organisation cannot see another
Every row in the database carries its organisation, and Postgres row-level security enforces it on every query, not just in application code. A cross-tenant leak test suite runs in CI.
- Isolation
- Postgres row-level security on every table
- Encryption
- A separate key per organisation for stored files
- Leaving
- The key is destroyed, so stored files cannot be read
- Sign-in
- BooAuth, BOO Soft's identity service
What Lilly sees, and what it does not
Alert notes need the package, the version, the installed extensions and the public advisory. That is all they get. No source code is sent for alert triage, and nothing Lilly writes closes an exposure, silences a P1 or reaches a client without a person.
Code review is a separate add-on that does send diffs to an AI provider. It is off by default for client projects, and turning it on is a logged decision by the project owner.
- Sent for alerts
- Package, version, extensions, public advisory
- Never sent for alerts
- Source code, secrets, client details
- AI off switch
- AI off, alerts still send
- Off switch
- Per organisation
Evidence you can verify
The evidence log is append-only and hash-chained. Each evidence pack is a PDF plus JSON with the chain hashes, so an auditor can check that nothing was changed after the fact.
Compliance evidence- Log
- Append-only, hash-chained
- Evidence pack
- PDF for people, JSON with chain hashes
- Client messages
- Every sent message is stored as evidence
Scanning that asks first
Active external scans run only after ownership is verified with a DNS TXT record or a file under /.well-known, and only inside a window you set. Scanner IP addresses are published.
- Unverified target
- Passive TLS and header checks only
- Active scans
- Opt-in, inside your window
- Scanner IPs
- Published
We run what we sell
MopokeHQ's own dependencies go through the same policy it recommends: a 24 hour release cooldown, an exact-pinned lockfile, and an allowlist for packages that run install scripts. Container base images must be at least two weeks old at build time.
Found a vulnerability in MopokeHQ? Email [email protected].
- Certifications
- None yet. MopokeHQ is in early access.
- Built by
- BOO Soft, Australia
Questions
Where is MopokeHQ hosted?
In one region: Sydney, Australia. All stored data, including SBOMs, scan results, evidence logs and client messages, is stored there.
Can I keep my data in another region?
Not yet. Sydney is the only region today, and more regions are coming. Tell us where you need your data when you ask for early access.
Does any data leave that region?
Only for AI features. Alert notes send minimal facts to an AI provider: the package name, version, extensions and public advisory text. No source code is sent for alert triage. One switch turns AI features off for your organisation, so no data leaves the Sydney region, and alerts still send without the note.
Does MopokeHQ need access to my Git platform or my network?
No. The scan runs on your own runners and pushes results out. Fix merge requests are opened by a scheduled job in your runner too, so MopokeHQ stores no Git platform credentials in the default setup.
Is MopokeHQ SOC 2 or ISO 27001 certified?
Not yet. MopokeHQ is in early access. It produces evidence that supports your own ISO 27001, SOC 2 and Essential Eight work, but it does not hold those certifications itself.
How do I know evidence has not been changed?
The evidence log is append-only and hash-chained, and every evidence pack includes the chain hashes, so anyone can check the record end to end.
What happens to our data if we leave?
Stored files are encrypted with a key unique to your organisation. When you leave, that key is destroyed, which makes the stored files unreadable.
Put a mopoke on night watch
One job in your CI pipeline. Your first SBOM is matched against every advisory we hold within minutes.