Vulkro Cloud

Enterprise security for code and Salesforce. Vulkro Cloud is the hosted Vulkro workspace for teams. You connect your code repositories and your Salesforce orgs, Vulkro Cloud scans them on a schedule with the same engine as the vulkro and vulkro-sf scanners, and your team works one shared list of issues.

Scan on your machine, or in Vulkro Cloud. The CLI, the VS Code extension and the local console keep scanning on your own machine, and your code stays there. Vulkro Cloud is the hosted option: it scans each connected repository or org in its own isolated container. Nothing reaches Vulkro Cloud unless you connect it.

Getting a workspace

Ask for a workspace on the set-up page: choose Starter or Business, for Core, Salesforce, or both, and tell us what you want to connect. Our team sets up your workspace within two business days, and every plan starts with a 14-day trial. Plans, what each includes and prices are on the pricing page. For Enterprise (above the Business size, hourly schedules, an SLA and a DPA, invoicing, or Vulkro Cloud on your own servers), write to license@vulkro.com.

Every member of a workspace is a paid seat, and every member also gets Pro on their own machine for the workspace's products. People who only need to read results get scheduled report emails instead of a seat. See Roles and home views.

Each company gets its own workspace at https://<name>.vulkro.com, with its own database, storage and encryption key. See Data handling.

Two apps, one workspace

Switch between the apps from the app launcher (the nine-dot menu). A workspace holds the apps its plan includes: Core, Salesforce, or both.

• Salesforce: org posture, access, attack paths and Apex code. Connect production orgs and sandboxes read-only; Vulkro Cloud never changes an org. See Connect Salesforce orgs.
• Core: code repositories, branches and quality gates. Connect GitHub, GitLab, Bitbucket or another git host with an access token. See Connect repositories.

What a code repository shows

Each connected repository has these areas, built from its latest scan:

Area	What it shows
API & Access	Endpoints, API Spec (which endpoints your OpenAPI specification documents, and which it misses), Access Matrix, Protocols
Data Flow	Data Flow, Data Lineage
Database	Tables, Columns and a Relationships diagram, read from your ORM models and migrations (see Database schema)
Code Map	Structure Map, Imports, Impact, Files
Secrets	Secrets in the code and in the git history
Dependencies	Dependencies, Vulnerabilities, Licences
Code Health	Hotspots, Test Coverage, Rules
Attack Paths	Paths from an entry point to a flaw, with the kind of flaw named

Every area is on every Vulkro Cloud plan that includes Core.

The workspace layer

These work across both apps:

• Issues. One list per org or repository, kept across scans. Each issue has a key, a status, an assignee, an owner and a fix deadline. A scan that no longer finds an issue closes it; if it comes back, it is reopened.
• Combined Risks. One issue for each entry point where several weaknesses combine into a bigger risk.
• Triage with approval. Anyone with the right can mark an issue in progress or fixed. A false positive or an accepted risk waits for an approver.
• Ownership. Owners come from CODEOWNERS for code and from the last person who changed a component in Salesforce. Teams, and auto-assign rules by repository, path, risk or severity.
• Live dependency checks. Dependencies are checked against newly published advisories at every scan and once a day between scans, without a rescan. See Data handling for what that sends.
• Dependency search. Find where you use a package, a version range, an advisory or a licence across every repository.
• Home views per role. Executive, Security, Engineering and Compliance. See Roles and home views.
• Notifications and Jira. See Notifications and Jira.
• Reports and evidence. See Reports and evidence.
• API. See API and tokens.
• Sign-in controls. Require multi-factor authentication, allowed email domains, session timeouts and an IP allowlist, with an activity log of every change. Single sign-on is on the Business plan and up and is set up by our team.

Cloud scans on Pro

An individual Pro subscription includes Cloud scans in the customer portal: the Vulkro Cloud app for one person, with no team features. Pro includes one Cloud scan a month, with paid upgrades for daily, frequent or continuous scans. Each Pro account can connect one Salesforce production org and one sandbox, and three repositories with one branch each; scans and their results are deleted after 14 days. See the pricing page.

From the terminal and your AI coding agent

Connect vulkro-sf to your workspace once, approving it in the browser:

vulkro-sf cloud connect https://<name>.vulkro.com

Then list what to fix, triage, fix and verify from the terminal, or let your AI coding agent do it through the sf_cloud_* MCP tools. See vulkro-sf cloud and vulkro-sf mcp serve. For scripts and CI, use a workspace API token: see API and tokens.

Run it on your own servers

Vulkro Cloud can also run on your own infrastructure. Talk to us: see On your own servers.