A security tool sees a map of your weak spots. Here is where that map is kept, who can read it, and what leaves for AI processing.
Everything MopokeHQ stores is in one database in one region. That includes SBOMs, scan results, deploy reports, the evidence log, evidence packs and code review diffs.
Sydney, Australia is the region today. More regions are coming.
The mopoke CLI runs on your own CI runners and pushes results out with a token you control. MopokeHQ never opens a connection into your network, which is why a self-managed GitLab, Gitea or Forgejo behind a firewall works as is.
Fix merge requests come from a scheduled job in your own runner that collects the work queued for it. In the default setup MopokeHQ stores no Git platform credentials at all.
Every organisation's rows carry its organisation, and Postgres row-level security enforces it on every query, not just in application code. Tests in CI check that one organisation cannot read another's data.
Secrets you give MopokeHQ, such as webhook signing secrets, plugin bundles and registry deploy tokens, are sealed with a key unique to your organisation. Sign-in sessions, CI tokens, API keys, proxy keys and invite codes are stored only as hashes.
An alert note gets the public advisory, its exploit signals, and the affected packages, versions and environments. A note on a found secret gets the file, line and variable name, never the value or who committed it. No source code, project names or people's names are sent for either, and nothing Lilly writes closes an exposure or silences a P1.
Lilly can hold a P2 or P3 back from digests when it is confident the finding does not apply, 90% by default, and marks it for a person to confirm. Owners and admins set that threshold or turn Lilly off, and each change is recorded as evidence.
Code review does send diffs, with secrets redacted. It is on by default for internal projects and off for client projects. Turning it on for a client project needs the project owner to confirm the client contract allows it, and that confirmation is recorded.
The evidence log is append-only and hash-chained. Each evidence pack is a PDF plus JSON with the chain hashes, so an auditor can check that nothing was changed after the fact.
Compliance evidenceActive external scans run only after ownership is verified with a DNS TXT record or a file under /.well-known, and only inside a window you set. Each scan runs in its own sandbox that can reach only the target, and every request identifies itself as a MopokeHQ external scan.
MopokeHQ's own dependencies go through the same policy it recommends: a 24 hour release cooldown, exact-pinned versions, and install scripts blocked unless a package is approved. CI images are pinned by digest and at least two weeks old.
Found a vulnerability in MopokeHQ? Email [email protected].
In one region: Sydney, Australia. Everything MopokeHQ stores, including SBOMs, scan results, the evidence log, evidence packs and code review diffs, is in one managed Postgres database there.
Not yet. Sydney is the only region today, and more regions are coming. Tell us where you need your data when you ask for early access.
For Lilly, the AI features, and for email. Lilly reaches its models through OpenRouter with zero data retention enforced on every request. An alert note sends the public advisory and the affected packages, versions and environments. A note on a found secret sends the file, line and variable name, never the value. Code review sends the diff with secrets redacted, and only for projects that have it on. Alerts, digests and invites are emailed through Cloudflare. One switch turns Lilly off for your organisation, and alerts still send without the note.
No. The scan runs on your own runners and pushes results out. Fix merge requests are opened by a scheduled job in your runner too, so MopokeHQ stores no Git platform credentials in the default setup.
Not yet. MopokeHQ is in early access. It produces evidence that supports your own ISO 27001, SOC 2 and Essential Eight work, but it does not hold those certifications itself.
The evidence log is append-only and hash-chained, and every evidence pack includes the chain hashes, so anyone can check the record end to end.
Ask us to close your organisation. You can export evidence packs at any time, and we export the rest on request for 30 days. Then we delete your data and destroy your organisation's encryption key, so the secrets it sealed cannot be recovered.
One job in your CI pipeline. Your first SBOM is matched against every advisory we hold within minutes.