Terms of Service

1. Introduction

(a) These Terms of Service (“Terms”) govern your access to and use of MopokeHQ, including the web application at app.mopokehq.com, the marketing website at mopokehq.com, the mopoke command-line tool (“CLI”), the application programming interfaces, the supply chain registry proxy, integrations (including GitLab, GitHub, outgoing webhooks, plugins and MCP access), Lilly, documentation and related services (together, the “Services”).

(b) These Terms form a binding agreement between you and BOO Studio Pty Ltd (ACN 624 302 469 / ABN 13 624 302 469), trading as BOO Soft (“BOO Soft”, “we”, “us”, “our”), unless a different BOO Group entity is expressly identified in an order form, proposal or other written agreement. BOO Soft is the software arm of the BOO Group of companies. MopokeHQ is a BOO Soft product and sits under BOO Group legal governance.

(c) By creating an account, accessing or using the Services, or installing or running the CLI, you agree to these Terms. If you use the Services on behalf of a company or other organisation, you represent that you have authority to bind that organisation, and “you” and “Customer” include that organisation.

(d) If you have a separate written agreement with BOO Soft (for example, an order form, enterprise agreement or data processing agreement), that agreement prevails over these Terms to the extent of any inconsistency.

2. Definitions

In these Terms:

• “Authorised User” means an individual who is a member of your Organisation, including your staff and contractors.
• “Organisation” means the MopokeHQ tenant created for you, within which your Projects, Customer Data and Authorised Users sit.
• “Project” means a software project or repository registered in your Organisation.
• “Customer Data” means all data submitted to or generated in the Services by or for you, including software bills of materials (“SBOMs”), scan results, findings, triage decisions, deployment records, runtime check-ins, external scan results, registry proxy download logs, evidence log entries, evidence packs, configuration, and (where you enable code review) merge request diffs and review comments.
• “Advisory Data” means third-party vulnerability and exploitation data ingested by the Services, including from OSV, the GitHub Advisory Database, the PHP project, the CISA Known Exploited Vulnerabilities catalogue and FIRST EPSS.
• “Lilly” means the AI-assisted features of the Services described in clause 8.
• “Evidence Log” means the append-only, hash-chained record of findings, decisions and deployments maintained by the Services for your Organisation.
• “Early Access” means any period during which BOO Soft designates the Services, or a feature, as early access, beta, preview or similar.

3. Eligibility and Authority

You may only use the Services if:

(a) you are at least 18 years old and can form a legally binding agreement;

(b) you are not prohibited from using the Services under applicable law (including sanctions and export control laws); and

(c) if acting for an organisation, you are authorised to do so.

The Services are designed for business use by software teams, agencies and managed service providers. They are not intended for personal, domestic or household use.

4. The Services

(a) MopokeHQ is a vulnerability exposure and SBOM management platform. The Services:

(i) accept SBOMs uploaded from your CI pipelines by the CLI;

(ii) match stored SBOMs against Advisory Data, and re-check previously stored builds when new advisories are published;

(iii) rank findings by severity, known exploitation and where the affected software is deployed;

(iv) group findings into upgrade actions and, where you configure it, open fix merge requests through a job running on your own CI runners;

(v) record deployments from GitLab deployment events, a mopoke deploy CI step or runtime check-ins, and close an exposure only when a fixed version is observed deployed;

(vi) where you verify ownership of a host, run external scans of it inside a window you set;

(vii) where you enable it, run a registry proxy for npm, Composer and container images that applies your Organisation’s install policy;

(viii) maintain the Evidence Log and export evidence packs in PDF and JSON; and

(ix) provide Lilly as described in clause 8.

(b) We may update, improve, replace or discontinue features from time to time. If you are on a paid plan and a change materially reduces core functionality, we will act reasonably and in accordance with any applicable written commercial agreement.

(c) Supported ecosystems and integrations. The ecosystems, package managers, container formats and Git platforms supported by the Services are those listed in our documentation from time to time. Statements on our website about integrations or features that are “coming” or planned are indicative only and do not form part of these Terms.

5. Accounts, Organisations and Authorised Users

(a) Authentication for the Services is provided by BooAuth (booauth.com), BOO Soft’s identity service. Your use of BooAuth is also subject to the BooAuth Terms of Service.

(b) You are responsible for:

(i) providing accurate account and Organisation information and keeping it current;

(ii) keeping login credentials, CI upload tokens, API keys, registry proxy keys and webhook secrets confidential and stored securely (for example, as masked CI/CD variables);

(iii) all activity that occurs under your Organisation and by your Authorised Users, except to the extent caused by our breach of these Terms;

(iv) ensuring each Authorised User complies with these Terms; and

(v) promptly notifying us at the contact details in clause 28 of any suspected unauthorised access, compromised token or security incident.

(c) Owners and admins of an Organisation can invite people by email and choose their role. An invitation is accepted through BooAuth.

6. CLI, CI/CD Integrations and Your Environment

(a) The CLI runs on your own CI runners and infrastructure and pushes results outward to the Services using a token you control. The Services do not initiate inbound connections into your network.

(b) You are solely responsible for:

(i) your CI/CD environment, runners, repositories and Git platform accounts;

(ii) the scope and permissions of any tokens or credentials you configure, including any Git platform credentials used by fix or review jobs on your runners;

(iii) reviewing, testing and merging any fix merge request opened by a job running on your runners. BOO Soft does not merge code into your repositories;

(iv) the endpoints you configure for outgoing webhooks, the plugins you install, and the AI clients you connect through MCP access, each of which receives or acts on Customer Data at your direction; and

(v) ensuring that uploading SBOMs, deployment data and (if enabled) merge request diffs to the Services does not breach any obligation you owe to a third party.

(c) We grant you a limited, non-exclusive, non-transferable licence to install and run the CLI and any Services-provided container images solely for use with the Services during your subscription.

(d) If the Services are unreachable, the CLI is designed to warn and allow your pipeline to continue. A failed or skipped upload means the affected build is not assessed until a later successful upload.

7. Customer Data

(a) You retain ownership of your Customer Data. You grant BOO Soft a non-exclusive, worldwide, royalty-free, limited licence to host, copy, transmit, process, analyse and display Customer Data only as reasonably necessary to:

(i) provide, maintain and secure the Services;

(ii) match Customer Data against Advisory Data and generate findings, upgrade actions and evidence;

(iii) prevent abuse and comply with law; and

(iv) enforce these Terms.

(b) Data residency. Customer Data is stored in a managed PostgreSQL database in DigitalOcean’s Sydney, Australia region, encrypted at rest. Secrets you store in the Services (webhook signing secrets, plugin bundles and registry deploy tokens) are additionally sealed with a data key unique to your Organisation. We will not move your Organisation’s storage region without your agreement, other than as required by law.

(c) Evidence Log integrity. The Evidence Log is append-only and hash-chained by design. Individual entries cannot be edited or selectively deleted without breaking the chain, so erasure requests relating to the Evidence Log are met by deleting the affected Organisation’s data as a whole, as described in clause 17 and the Privacy Policy.

(d) Aggregated data. We may generate and use de-identified, aggregated statistics derived from use of the Services (for example, how widespread a CVE is across all Organisations) to operate and improve the Services, provided such data does not identify you, your Authorised Users, your clients or your Projects.

(e) Your responsibilities. You are responsible for having all rights, consents and permissions needed for Customer Data, including any personal information in it (for example, the name and email address of a commit author recorded with a secret finding, or the client name on an evidence pack).

8. Lilly

(a) Lilly writes a short note explaining what an advisory means for your software, gives a probability that a match applies, answers questions about your Organisation’s open work, and (where you enable code review) proposes review comments on merge requests. Where Lilly judges a P2 or P3 finding likely not to apply, at or above a threshold your owners and admins set (90% by default), it holds that finding back from digests marked “suggests not affected” for a person to confirm. The finding stays visible in the Services. Lilly does not change a priority, close an exposure, hold back a P1 finding, or block a merge.

(b) Data sent to AI providers. For a note, Lilly sends the advisory, its exploitation signals, and the affected package names and versions with the environment or branch they were found in. For a note on a found secret, Lilly sends the scanner rule, file path, line, variable name, the files that read it and the repository’s visibility, never the secret’s value or who committed it. For a question, Lilly sends finding titles, advisory identifiers, priorities and due dates. None of these sends source code or the names of your Projects, components or people. For code review, Lilly sends the merge request diff with detected secrets redacted, and never repository or customer names.

(c) Your controls. Owners and admins may turn Lilly off for your whole Organisation, or change the hold-back threshold, at any time, and each change is recorded in the Evidence Log. When Lilly is off, nothing is sent to an AI provider, and findings, priorities and alerts continue without the note.

(d) No training; zero data retention. Lilly’s requests are routed through OpenRouter to model providers operating under zero data retention terms. We do not permit our AI providers to retain your Customer Data beyond returning a response or to use it to train their models. Our AI providers are listed in the BOO Group Sub-processor list (see clause 26).

(e) AI output. AI output may be incomplete or incorrect. It is a recommendation for a person to weigh. You remain responsible for all security decisions made in reliance on the Services.

9. Advisory Data and Security Tool Disclaimer

(a) The Services rely on Advisory Data published by third parties. We do not control, verify or guarantee the accuracy, completeness or timeliness of Advisory Data, and advisory feeds may be delayed, incomplete, withdrawn or in error.

(b) Important. The Services are a tool to help you identify, prioritise and evidence vulnerability remediation. They are not a substitute for your own security program, penetration testing, code review, patch management or professional security advice. We do not warrant that the Services will identify every vulnerability, every affected component or every exploitable exposure in your software, or that software marked “not affected” or “closed” is free of vulnerabilities.

(c) Compliance frameworks. The Services may help you gather evidence relevant to frameworks such as ISO/IEC 27001, SOC 2 or the ACSC Essential Eight. Use of the Services does not of itself make you compliant with, or certified against, any framework. MopokeHQ does not itself hold ISO/IEC 27001 or SOC 2 certification during Early Access, and we make no representation that it will obtain certification by any particular date.

(d) Evidence packs. Evidence packs reflect the data held in your Organisation at the time of export. We do not warrant that an evidence pack will be accepted by any auditor, regulator, insurer or client.

10. Acceptable Use

You must not, and must not permit any Authorised User to:

(a) use the Services unlawfully or in breach of another person’s rights;

(b) upload or transmit malicious code or harmful material, other than SBOM, dependency, diff and plugin data submitted in good faith;

(c) interfere with the security, integrity, performance or operation of the Services, or circumvent tenancy isolation, rate limits or plugin sandbox limits;

(d) attempt to gain unauthorised access to any Organisation, account, system or data, including another tenant’s data;

(e) reverse engineer, decompile or attempt to extract source code of the Services (other than the CLI to the extent the law permits);

(f) use the Services, Advisory Data as presented in the Services, or Lilly’s output to build a competing product through scraping, harvesting or systematic extraction;

(g) upload SBOMs, deployment data or diffs for software you do not own or are not authorised to assess, or register for external scanning a host you are not authorised to scan;

(h) misrepresent findings or evidence generated by the Services as audited, certified or independently verified; or

(i) resell the Services without our prior written agreement. Preparing evidence packs for your own clients in the ordinary course of your agency or MSP business is permitted.

We may suspend access where reasonably necessary to investigate misuse, protect the Services or other tenants, or comply with law. Where practicable, we will give notice before or promptly after any suspension and explain the reason.

11. Privacy

(a) Our handling of personal information is described in the MopokeHQ Privacy Policy and the BOO Group Privacy Policy (see clause 26). In respect of personal information contained in Customer Data, BOO Soft acts as your processor (or service provider) and you act as controller.

(b) For information about cookies, see the MopokeHQ Cookies Policy.

(c) You are responsible for providing any notices to, and obtaining any consents from, your personnel, clients and other individuals whose personal information you submit to the Services.

(d) A Data Processing Agreement incorporating Standard Contractual Clauses (where required for EU/UK data subjects) is available on request.

12. Integrations and Third-Party Services

(a) The Services interoperate with third-party products and services, including your Git platform, CI/CD system, container registries, package registries and Advisory Data sources. Your use of those third-party services is governed by their own terms and privacy policies.

(b) BOO Soft is not responsible for third-party products or services that it does not operate, including their availability, API changes, security or data handling practices, except to the extent liability cannot lawfully be excluded.

(c) Where a third party changes or withdraws an API on which an integration depends, we will use reasonable endeavours to adapt the integration but do not guarantee continued compatibility.

13. Plans, Fees and Payment

(a) Early Access. During Early Access, the Services are provided without charge unless we agree fees with you in writing.

(b) Paid plans. When paid plans are introduced, the fees, the plan limits and what happens if you exceed them will be set out in your order form or on the pricing page at the time of purchase, and we will give existing customers reasonable notice before any fees apply to them.

(c) Payment. If you purchase paid Services, you agree to pay the fees, charges and taxes set out in your order form or invoice. Unless otherwise agreed in writing:

(i) fees are stated in Australian dollars (AUD) and exclude GST, which will be added where applicable under the A New Tax System (Goods and Services Tax) Act 1999 (Cth);

(ii) fees are payable in advance for the subscription period;

(iii) fees are non-refundable except as required by law (including the Australian Consumer Law) or expressly stated otherwise;

(iv) overdue amounts may be subject to interest at the Reserve Bank of Australia cash rate plus 5% per annum, calculated daily, and to suspension after notice; and

(v) we may change pricing for renewal periods by giving at least 30 days’ prior notice.

14. Early Access, Beta and Preview Features

(a) MopokeHQ is currently offered as Early Access. Early Access and any beta or preview features may be incomplete, change materially or be withdrawn at any time, and may not be subject to the same support, availability or security commitments as generally available features.

(b) To the extent permitted by law, Early Access, beta and preview features are provided “as is” without service commitments, warranties or guaranteed support. Clause 19 (Australian Consumer Law) continues to apply.

(c) We may ask Early Access customers for feedback and may contact you about your use of the Services for that purpose.

15. Intellectual Property

(a) BOO Soft and its licensors own all rights, title and interest in the Services, including software, the CLI, the models and prompts used by Lilly, user interfaces, documentation, branding (including “MopokeHQ”, “Mopoke”, “Lilly” and related logos), know-how and related intellectual property, other than Customer Data and third-party Advisory Data.

(b) Subject to these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the Services during the applicable term for your internal business purposes and for providing services to your own clients.

(c) You must not remove proprietary notices or represent BOO Soft materials as your own. Evidence packs may carry MopokeHQ attribution, and may name the client they were prepared for.

(d) Advisory Data remains subject to the licence terms of its respective publishers.

16. Feedback

If you provide suggestions, ideas or feedback about the Services, BOO Soft may use that feedback without restriction or compensation, provided we do not identify you publicly without permission.

17. Term, Suspension, Termination and Data Export

(a) These Terms apply from the date you first access the Services and continue until terminated.

(b) We may suspend or terminate access to all or part of the Services if:

(i) you materially breach these Terms and (where capable of remedy) fail to remedy within 14 days of notice;

(ii) fees remain overdue more than 14 days after notice;

(iii) your use creates a security, legal or operational risk to the Services or other tenants; or

(iv) we are required to do so by law.

(c) You may stop using the Services at any time, and close your Organisation by writing to us at the contact details in clause 28. If you are on a paid plan, termination rights, notice periods and refunds may also be governed by your order form.

(d) Data export. You can export evidence packs (PDF and JSON, including the Evidence Log’s chain hashes) at any time while your Organisation is active. For 30 days after you ask us to close your Organisation, or after we terminate access, we will provide an export of your Customer Data on request. You are responsible for exporting any evidence you need to keep for your own compliance purposes before the end of that period.

(e) Deletion. After the export period, we will delete your Customer Data and destroy your Organisation’s data key, so that secrets sealed with it cannot be read, including in backups. Database backups that still hold deleted data expire in the ordinary course. Deletion is irreversible.

(f) Provisions that by their nature should survive termination will continue, including provisions on payment, intellectual property, confidentiality, liability, indemnity and dispute resolution.

18. Service Availability, Support and Security

(a) We will use reasonable care and skill in providing the Services. We do not promise that the Services will be uninterrupted, error-free or available at all times. Maintenance, upgrades, security events, Advisory Data feed outages, third-party failures and other factors may affect availability.

(b) Any service levels, support commitments or uptime commitments only apply if expressly set out in a separate written agreement.

(c) Security. We maintain technical and organisational measures appropriate to the nature of the Services, including hosting in DigitalOcean’s Sydney region, row-level security on every tenant table in the database, a per-Organisation data key for stored secrets, encryption in transit and access controls. Details are published at mopokehq.com/security and may change as the Services mature.

(d) Security incident notification. If we become aware of a security incident involving unauthorised access to your Customer Data, we will notify you without undue delay and provide information reasonably available to us to help you meet your own notification obligations (including under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth) or the GDPR where applicable).

(e) Responsible disclosure. If you discover a vulnerability in the Services, please report it to [email protected]. Do not access other tenants’ data or disrupt the Services while testing.

19. Australian Consumer Law and Non-Excludable Rights

(a) Nothing in these Terms excludes, restricts or modifies any consumer guarantee, statutory guarantee, non-excludable right or remedy you may have under the Australian Consumer Law (Schedule 2 of the Competition and Consumer Act 2010 (Cth)) (“ACL”) or any other applicable law.

(b) Where the ACL implies a guarantee into these Terms and that law permits us to limit our remedy, our liability for breach of that non-excludable guarantee is limited, at our option, to supplying the Services again or paying the cost of having the Services supplied again, but only to the extent that limitation is lawful.

20. Warranties Disclaimer

(a) Except as expressly set out in these Terms, a written agreement, or as required by law, the Services are provided “as is” and “as available”.

(b) To the maximum extent permitted by law, we disclaim all implied warranties, representations and conditions, including merchantability, fitness for a particular purpose, title and non-infringement.

(c) Without limiting clause 9, we do not warrant that:

(i) the Services will detect, prioritise or remediate every vulnerability or exposure;

(ii) Advisory Data or Lilly’s output will be accurate, complete or current;

(iii) fix merge requests will be correct, complete or free of regressions;

(iv) the Services will be uninterrupted or error-free;

(v) all data loss, corruption or security incidents can be prevented; or

(vi) third-party integrations will remain available or compatible.

21. Limitation of Liability

(a) To the maximum extent permitted by law:

(i) neither party is liable for any indirect, incidental, special, consequential or punitive loss, or for loss of profit, revenue, goodwill, business opportunity, anticipated savings or data;

(ii) BOO Soft is not liable for any loss arising from a vulnerability, exploit, breach or security incident affecting your software or systems, whether or not the relevant vulnerability was or could have been identified by the Services; and

(iii) BOO Soft’s aggregate liability arising out of or in connection with the Services or these Terms is limited to the fees paid by you for the affected Services during the 12 months before the event giving rise to the claim or, if you paid no fees in that period, AUD $500.

(b) The limitations above do not apply to:

(i) liability that cannot lawfully be limited or excluded (including under the ACL);

(ii) your payment obligations;

(iii) your misuse of the Services or infringement of our intellectual property rights; or

(iv) either party’s fraud or wilful misconduct.

22. Indemnity

(a) You indemnify BOO Soft, its related bodies corporate, affiliates, employees, agents and licensors against losses, claims, damages, liabilities and costs (including legal fees on a reasonable basis) arising from:

(i) your breach of these Terms;

(ii) your unlawful use of the Services;

(iii) Customer Data or materials you submit that infringe rights or break the law;

(iv) external scans of a host you registered, and plugins you install; and

(v) any claim by your client relating to the services you provide to them.

(b) This clause applies only to the extent the loss was caused by you or those you authorise.

23. Confidentiality

(a) Each party must protect the other party’s confidential information using at least reasonable care and may use it only as needed to perform under these Terms, exercise rights, or comply with law. Customer Data is your confidential information. The non-public features, pricing and roadmap of the Services are our confidential information.

(b) Confidential information does not include information that is public through no breach, already lawfully known, independently developed, or lawfully received from a third party without duty of confidence.

(c) We will not disclose which organisations use the Services without your permission, other than to our sub-processors as needed to provide the Services.

24. Force Majeure

(a) Neither party is liable for any delay or failure to perform its obligations under these Terms to the extent caused by a Force Majeure Event.

(b) “Force Majeure Event” means any event beyond a party’s reasonable control that could not have been prevented or mitigated by reasonable diligence, including forces of nature, natural disasters, acts of terrorism, epidemic, pandemic, cyberattacks, infrastructure or Advisory Data provider outages, telecommunications failures, industrial action, and action or inaction by a government agency.

(c) The affected party must promptly notify the other party and use reasonable endeavours to mitigate. If a Force Majeure Event continues for more than 90 days, either party may terminate these Terms (to the extent affected) by written notice.

25. Dispute Resolution

(a) Compulsory. If a dispute arises out of or relates to these Terms, neither party may commence tribunal or court proceedings unless this clause has been complied with, except where urgent interlocutory relief is sought.

(b) Notice. A party claiming a dispute (“Dispute”) has arisen must give written notice to the other party setting out the nature of the Dispute, the desired outcome and the action required to settle it.

(c) Resolution. On receipt of that notice, the parties must:

(i) within 14 days, endeavour in good faith to resolve the Dispute by negotiation or other mutually agreed means;

(ii) if not resolved within 14 days, agree on a mediator or, failing agreement, request that the President of the Law Society of New South Wales (or their nominee) appoint a mediator;

(iii) share equally the mediator’s fees and the venue cost, each paying their own legal costs; and

(iv) hold the mediation in Sydney, Australia, or by video conference if both parties agree.

(d) Confidential. All communications in negotiations and mediation under this clause are confidential and, to the extent possible, “without prejudice”.

(e) Termination of mediation. If 30 days have elapsed after the start of mediation without resolution, either party may ask the mediator to terminate the mediation, and the mediator must do so.

26. Changes to the Services or Terms; Related Documents

(a) We may update these Terms from time to time. If we make a material change, we will give at least 30 days’ notice by posting the updated Terms in the Services, on mopokehq.com, or by email to your Organisation’s owners. If you continue using the Services after the updated Terms take effect, you agree to the revised Terms. If you do not agree, you may terminate under clause 17(c).

(b) These Terms should be read with:

Document	URL
MopokeHQ Privacy Policy	https://mopokehq.com/privacy
MopokeHQ Cookies Policy	https://mopokehq.com/cookies
MopokeHQ Security and Data	https://mopokehq.com/security
BOO Group Privacy Policy	https://boogroup.com.au/legal-center/privacy-policy
BOO Group Sub-processors of Customer Data	https://boogroup.com.au/legal-center/sub-processors
BOO Group Terms & Conditions	https://boogroup.com.au/legal-center/terms
BooAuth Terms of Service	https://booauth.com/terms

(c) Order of precedence. A signed order form or enterprise agreement prevails over these Terms; these Terms prevail over the BOO Group Terms & Conditions in respect of the Services; the MopokeHQ Privacy Policy prevails over the BOO Group Privacy Policy to the extent it is more specific.

27. Governing Law, Jurisdiction and General

(a) These Terms are governed by the laws of New South Wales, Australia, without reference to conflict of law principles. Subject to clause 25 and applicable law, the parties submit to the non-exclusive jurisdiction of the courts of New South Wales, the Federal Court of Australia and courts competent to hear appeals from them.

(b) Cross-border. The Services are operated from Australia and made available globally. Nothing in these Terms limits non-excludable rights you have under the mandatory consumer or data protection laws of your country of residence, including the GDPR, UK GDPR or CCPA/CPRA where they apply.

(c) Export control. You must not use the Services in breach of Australian, US, EU or UK sanctions or export control laws, and you warrant you are not located in, or a national of, a comprehensively sanctioned jurisdiction.

(d) These Terms do not create a partnership, agency, employment or fiduciary relationship. If any provision is unenforceable, the remaining provisions continue. A failure to enforce a right is not a waiver.

(e) You may not assign these Terms without our prior written consent, except as part of a permitted business transfer. We may assign these Terms to a related body corporate or in connection with a merger, acquisition, restructure or sale of assets.

(f) Notices must be in writing and sent to the contact details in clause 28 (for us) or to the email address of an owner of your Organisation (for you). Email notices are deemed received on the next business day after transmission.

(g) These Terms, together with any order form, the Privacy Policy, Cookies Policy and any Data Processing Agreement, form the entire agreement between the parties about the Services.

28. Contact

BOO Studio Pty Ltd (trading as BOO Soft) - MopokeHQ ACN 624 302 469 | ABN 13 624 302 469 Email, support and security: [email protected] Web: mopokehq.com | boosoft.com.au | boogroup.com.au