Changelog

Register an app in the developer console, connect it with the authorization code flow with PKCE, and call the API and the MCP server with an access token instead of a pasted key. An organisation admin approves exactly the scopes shown on the consent screen, in plain words; access tokens last an hour and refresh tokens are replaced on every use. A free developer sandbox serves sample data, so an app can be built and tested without a paid plan, and an app appears in the marketplace catalogue only after a Vouli IQ reviewer approves it.

Before an app connects, an admin sees its name, who publishes it, each permission it asks for in plain words with the ones that change data marked, and which organisation it would act on. Only an admin can approve; anyone can decline. An app that has not been reviewed yet says so, and only the organisation that built it can connect it.

Settings → Connected apps lists every app an admin approved, what it may do, who approved it and when it was last used. Disconnecting one revokes its tokens at once; uninstalling an app from the marketplace now revokes its connected-app tokens too.

Upload a CSV or Excel file, match its columns to the register (suggested from the headings), and see the first rows checked before anything is saved. Every row is validated first; if any row has a problem nothing is imported, and each problem is named by row and column. Rows already in the register are skipped rather than added twice. Cells that start with =, +, - or @ are stored as plain text and never run as formulas. Each register has a template with the exact headings, and every import is recorded in the audit log.

The standby and drill rows on the reliability page are now computed from what has actually been recorded, rather than being fixed text. An owner can record a restore or failover drill with the measured recovery time and data-loss window; a drill cannot be recorded as passed unless both were measured, and a drill nobody described is refused. An automated probe is never presented as a recovery — it evidences that the standby answers, and the page says so in those words.

Record how long a class of record must be kept and the obligation it comes from, and the erasure evaluation consults it. The wording is deliberate about what a floor is not: an erasure inside one is refused until a lawful basis is documented, and the floor stops applying once the workspace is older than it. To stop an erasure outright you place a litigation hold.

Each person can turn off the categories they do not want, and the dispatcher now honours that choice instead of ignoring it. Security and billing stay on for everyone — an access or payment change is not a courtesy notification. No email or push switch is offered, because the product does not send them.

Place and release a hold over a scope of records, with the reason recorded. A hold is the hard blocker the erasure engine checks before destroying anything — unlike a retention floor, no lawful basis overrides it.

Compose a role from the permission catalogue, edit it, and retire it, on the plans that include custom roles. The permissions are grouped by what they govern, and a role that would grant more than the person creating it holds is called out before it is saved.

Produce an individual’s data bundle for an access or portability request, and carry out an erasure, from the request itself. Rectification and restriction are stated as handled by a person, rather than implied to be automatic.

Moving a request through verification, response and closure is now part of the console, so the statutory clock reflects what was actually done rather than staying open on a request that was answered days ago.

The storage purge ran against two locations that hold nothing and skipped the ones holding customer documents and generated reports. It now walks every location an organisation’s files actually occupy, reports what it found against what it removed, and does not claim completion when the two disagree.

Two tables held a subject’s email address that neither the export nor the erasure knew about, and a person’s name remained readable on meeting attendance and agenda records after they had been erased. Both are closed, and the export now states which places were not searched rather than implying it searched everywhere.

The checks that prove one organisation cannot read another’s data, and that every tenant table ships with a row-level-security policy, were each blind to a set of tables because of how they parsed the schema. Both now see the full set; the coverage lists may only shrink.

Record-level sharing, which the schema has carried since an earlier release, now has a surface. The register records what a grant can actually admit rather than every level the schema allows, so a share that would grant nothing is not offered.

The per-record check consulted the built-in role rather than the customer’s own resolved permissions, so a custom role could be refused something it had been granted. Every record decision now runs through one permission path.

A colour-contrast check that browsers can run but the test environment cannot was added and immediately found seven places where text or a control fell below the accessibility standard. All seven are fixed, and the check now runs on every change.

A director signing in for the first time in months now has a single surface: the next meeting and its date, the obligations assigned to them by name or role, and what is waiting to be read. Nothing on it is generated, so opening it twice shows the same thing twice; an undated pack is never presented as imminent, and an empty board is stated as empty rather than filled with suggestions.

Issue a decision paper from a board pack: the options, the case AGAINST the recommended one, the facts that would change the conclusion, and resolution text a secretary lifts verbatim into the minute. Once issued it cannot be edited — a correction supersedes it and both remain. Every obligation the decision creates carries an accountable owner; "the organisation" is refused.

Each paper states which of its figures trace to a stored record and which are the pack’s own restatement, in words rather than a badge — so a board knows which numbers have been checked before any of them are minuted.

Resolving a thread now records the person and the time, so a document can answer "is anything still open on this?" before a decision is taken over an open question. Re-opening is allowed and audited. A thread whose first comment is missing from the page is promoted rather than dropped, so an open question never disappears from the count.

Access, erasure, rectification, portability and restriction requests are tracked from the date the SUBJECT asked — not the date the request was opened in the product — with the deadline computed under a named rule (GDPR Article 12(3), India DPDP, CCPA) and stored. Identity must be verified before release, a refusal must carry a lawful reason, and the handling is kept in an append-only trail.

Every key-encryption-key operation is now recorded with its outcome and latency, identified by a digest prefix rather than the key id. Re-encryption runs carry a cursor and checkpoint after every batch, so an interrupted rotation resumes instead of restarting; a row that cannot be re-encrypted is reported with its identifier and keeps its previous value.

Browser reports are aggregated into a durable, queryable store instead of a log line that ages out, so the decision to move the policy from report-only to enforcing rests on a record of what has actually been refused.

On board-tier modules a council of three independent models is convened and its disagreement is shown to every reader of the insight, not only to administrators. A council never merges outputs — the primary generation stands and the council annotates it. Which providers may see tenant data is a recorded decision; a model with an unattested training posture may sit on the bench for redacted evaluation but is refused a live seat.

A severity downgrade must now be evidenced. Only completed treatments earn a reduction, and a residual severity nothing supports is labelled as unevidenced. Each risk records what it was before anything was done about it, so an improvement can be shown rather than asserted.

The portfolio is measured against the limits the board actually set — at the residual AND at the untreated baseline, reporting both when they disagree. Indicators track a measurement over time and are direction-aware, so a risk can be shown deteriorating before anybody changes its severity; a trend is never quoted from too few readings.

Recommendations from the scorecard synthesis, course corrections, innovation moves and security controls now all become owned, time-boxed records rather than prose a director reads once. Where a candidate cannot be dated or owned it is skipped rather than given an invented date.

An administrator can require a second factor for everyone in the organisation. The check fails closed — an identity provider that cannot answer is not a reason to admit — with an audited break-glass path so enabling the policy cannot lock an organisation out.

Right-to-erasure now works at the granularity Article 17 actually has: a named individual can be erased while the organisation around them continues.

A member can update their own name and job title and change the persona that selects their whole dashboard, without an administrator.

Mitigations gain an owner, a date and a status instead of being a text field nobody chases, and overdue ones surface rather than sitting quietly.

The platform health endpoint missed one dependency entirely. It now reports every critical subsystem, so an outage is visible where operators look for it.

A detached database call made the rate limiter fail closed, which refused AI generation, checkout, invitations and member changes for two days. Fixed at the root, with a repo-wide check that forbids the pattern and a test that reproduces it.

Thirteen module pages advertised the wrong tier, the assessment allowance the pricing page describes was not enforced, and the checkout funnel recorded intents nobody had formed. All three are corrected, and every priced module is now mounted, navigable and gated at the tier that sells it.

One message catalogue drives navigation, billing and legal surfaces, with a check that no translation can drop or invent a figure the English does not state.

Continuous integration now builds a real Postgres from the migration tree and runs a two-tenant leakage proof against it, alongside a gate that fails the build if any tenant table ships without a row-level-security policy.

Compare your fiscal year against the last — maturity trajectory, risk flow, follow-through and recorded value — with cross-period pattern detection (recurring risks, score streaks, follow-through debt). Every figure is deterministic arithmetic over your own records; the platform never simulates a past. Pro and above; fiscal year configurable (April–March default).

Freeze a completed fiscal year into an immutable, hash-verifiable snapshot — the year-end record your auditor can verify after export, and that can never be rewritten. Max and Enterprise, admin-only.

Every AI recommendation is now a persisted, owned, priced, time-boxed record with a full lifecycle — regeneration supersedes instead of duplicating, dismissal requires a written reason, and overdue advice escalates automatically to the board-oversight register.

A live, deterministic price on inaction — open risks, stalled initiatives and unactioned recommendations aggregated into one drillable monthly band on the Board Cockpit. No AI computes this number.

The C-suite league table: per executive role, open items, overdue count, oldest age, share of the Cost of Standing Still, and trailing-90-day completion rate.

Every board pack now includes a server-computed follow-through section — issued, actioned, dismissed-with-reason, and ignored recommendations listed verbatim with owner and monthly cost.

What your subscription delivered this cycle — usage, quotas, and consulting-equivalent value with every assumption visible. Available on every tier.

Charters & SLAs, talent ramp, transfer-of-work and value receipts composed into an HQ scorecard, plus the Charter Defence board pack generated at board tier with register figures rendered verbatim.

NRR, GRR and logo churn computed from your own customer book — the same cohort math as the founder cockpit, customer identifiers hashed at rest.

CRO, CMO, Chief Sustainability Officer and General Counsel personas, and the persona lens now covers every module surface.

Vendor, talent and ESG surfaces consolidated behind single front doors with cross-links; governance surfaces renamed to remove duplicate-sounding entries. Every previous URL keeps working.

Secrets can no longer be stored unencrypted under any configuration; connector credentials gain a rotation endpoint, age tracking and KMS envelope encryption.

A stdlib-only Python client at full parity with the TypeScript SDK, kept in lock-step with the API by a CI contract check.

Token-based light/dark/system theming across the app, with a per-user toggle in the dashboard header.

Report definitions, funnel calculations and signed embed tokens behind the API. Corrected 2026-09-24: this entry first described a tool for building your own reports; no screen for it has shipped, and pushing data to your own warehouse is not switched on.

The service layer for comments and @mention notifications on artefacts. Corrected 2026-09-24: this entry first described simultaneous editing with presence, which was never shipped. Discussion threads on board decision papers are what customers can use.

Answers over your data now use hybrid retrieval with cross-encoder re-ranking and pass a grounding threshold before display.

Internal usage meters alongside subscription tiers. Corrected 2026-09-24: this entry first described billing for usage; no usage is invoiced. Every plan carries a monthly AI allowance with no overage charges.

Prompt-injection defence upgraded from a fixed corpus to a continuous, multi-layer red-team programme.

OAuth app framework with scoped install/revoke, plus signed, retried outbound webhook delivery.