Risk Management (new)
- A new risk register scores each risk on a 5×5 likelihood and impact matrix, tracked separately for inherent, residual, and target exposure, with automatic level bands (low, medium, high, critical) and an over appetite flag.
- Set a single account risk appetite or override it per category, and record a formal acceptance with a rationale and expiry to sign off risks you choose to tolerate.
- Map risks to the controls that treat them and the frameworks they relate to, and link treatment tasks, the incidents a risk realized, and supporting evidence.
- Record review cycles with a full history, receive due and overdue reminders, and read a colour coded heatmap with inherent, residual, and target layers.
- Import an existing register from CSV with a validating dry run, export the register and a Risk Treatment Plan to CSV or PDF, and see a risk summary on the compliance dashboard.
- Draft a risk from a short description with Create with AI, and ask the assistant about risks over appetite, reviews due, acceptance needed, and risks off target.
- The new risk capabilities are also available through the API and MCP tools.
Email and Help Desk Linking
- Open a related activity panel from the email reading pane to see the contacts on a message and the help desk tickets connected to it.
- Link an email to one or more existing tickets, or create a new ticket that is pre-filled from the email with the sender set as the requester.
- See tickets already raised by the same contact, and unlink tickets you no longer want associated.
- Link an email to a ticket from the ticket view too, so the connection is visible from whichever side you start.
Issues and Help Desk Tickets
- On an issue, a Help Desk Tickets section lists the linked tickets, where you can link existing tickets or unlink them, loaded in pages.
- From a ticket, create a new issue that is prefilled from the ticket and linked back to it in one step.
- The link is bi-directional, so the same connection is visible from both the issue and the ticket, and selecting either one opens it.
Contact Communication History
- A contact now shows an Emails section listing the messages where the contact was the sender or a recipient, with sent and received labels, loaded in pages.
- A Help Desk Tickets section lists the tickets where the contact is the requester.
- Create a ticket directly from the contact with the requester already set, and send an email to the contact from the Emails section.
Password Breach Detection
- ISO Mate now checks new passwords against a database of passwords exposed in known data breaches and blocks any that are found. The check runs whenever a password is set: account registration, password reset, invited user setup, and admin user creation.
- Privacy preserving by design: the check never exposes your actual password.
- If a password is rejected during registration or password reset, you now see a clear message explaining why.
- There is no forced password rotation and existing passwords are not affected. The check applies only when a new password is chosen.
Issue Detail Improvements
- The Git Activity section now sits directly below Attachments and above QA Traceability, so linked branches, commits, and pull requests are easier to find without scrolling.
- Issue comments now support rich text formatting such as bold, italics, lists, and links, using the same editor as issue descriptions, and saved comments keep their formatting.
Workflow Email Enhancements
- Placeholders now resolve in workflow emails, so recipients see the real values in both the subject and the body instead of raw placeholder text.
- Workflows triggered by a custom object entry can insert the entry’s fields into emails, notifications, and tickets, and they resolve to the entry’s stored values.
- The workflow email body is now a full rich text editor with headings, bold, italics, lists, links, tables, and alignment.
AI Assistant Reliability
- Every AI assistant surface now recovers automatically when the connection drops, for example after your machine sleeps, a tab is backgrounded, or the network drops briefly. The next question streams a reply with no page refresh.
- A lightweight “Reconnecting” indicator now appears while the connection recovers and hides once it is restored.
- If a response is interrupted midway, the assistant stops the typing indicator, keeps any partial reply, and shows a clear message to try again instead of spinning forever.
- This applies consistently across every AI feature in ISO Mate.
Compliance
- Policies generated when you scaffold a compliance framework (GDPR, ISO 27001, or General Business) now open with a clear notice that the content was generated by AI and must be reviewed and verified by a qualified person before it is approved or published.
- The notice appears in the framework’s language (English, German, or Spanish), and generated policies still stay in draft for your review.
Diagram Builder Improvements
- Orthogonal connectors now always keep their right angles. Routing is corrected automatically when shapes move, and connectors route around shapes instead of doubling back when their connection points face away from each other.
- Connectors can now carry a label, edited from the properties side panel and shown at the midpoint of the line in the editor, the viewer, and exports.
- Routing is fully editable: double-click a line to add a bend, double-click a segment handle to remove one, and drag segments to reposition them, where they snap and merge when aligned with neighbouring segments.
- A new Reset Routing button restores automatic routing in one click.
- Selection and hover feedback were improved throughout, and the help dialog now documents the new connector gestures.
Welcome Email (new)
- New users now receive a branded ISO Mate welcome email across every sign-up path, with quick links to the console, the marketing website, the blog, the knowledge base, and the pricing page.
Account Invitations (new)
- Adding someone who already uses ISO Mate now sends them an invitation instead of granting immediate access. They join your account only after they accept it.
- The invitation email names who invited them and which account, and the link opens a page where they can accept or decline. Nothing about their existing accounts changes until they accept.
- The role, department, and notes you set when inviting are applied when the invitation is accepted, and the seat is only taken at that point.
- A Pending Invitations panel on Account Users lists everyone who has not replied yet, where you can resend or withdraw an invitation. Invitations expire after 14 days.
- You are notified in the app when an invitation is accepted or declined, and every invitation sent, accepted, declined, or withdrawn is recorded in the audit log.
- If you sign in without belonging to any organization, any invitation waiting for you is now shown on the No Account Access screen so you can accept it there.
- Inviting someone who does not have an ISO Mate login yet works as before: they receive an invitation to verify their email and set up their password.
Email Design
- Every ISO Mate email now shares one branded layout, so the header, buttons, notices, and footer look the same across account, billing, help desk, calendar, and feedback messages.
- The invitation and password reset emails no longer use the default framework template, so they now carry ISO Mate branding like the rest.
- Typography is consistent throughout, with one typeface and one set of text sizes, so copy no longer changes size or font between sections or inside highlighted panels.
- Every email now ends with the same sign-off, including our support address and website, in the recipient’s language.
Bug Fixes
- Email sync: we fixed an issue where new emails didn’t always appear on their own and only showed up after a manual refresh. Syncing is now more dependable, keeps working smoothly even with many connected mailboxes, and one problem account no longer holds up the rest, so your inbox stays up to date automatically with no manual refresh needed.
- Issue attachments: the Copy URL action has been removed because it duplicated the existing view and download options. Viewing, previewing, and downloading are unaffected, and opening image and PDF attachments directly in the browser now works reliably.
- Workflows: submitting a custom object entry no longer sends the workflow email twice.
- Billing: a cancelling subscription now keeps full access for the rest of the paid period instead of being locked out during the grace period.
- Account setup: the page opened from an invitation link had an oversized heading and disproportionate spacing. It has been tidied up to match the sign-in and password reset pages.
- No Account Access: the Sign Out button cleared your session but left you on the same screen. It now signs you out and returns you to the sign-in page.
Security
- Removing or deleting a user from an account now requires the administrator to re-confirm their identity, with their password or a Google re-authentication, and the confirmation lasts a short window so a bulk removal only asks once. Every removal is recorded in the audit log with the acting administrator, the affected user, the time, the IP address, and the browser.
- We applied security updates across the platform, keeping the frameworks and third-party components behind ISO Mate up to date to address known vulnerabilities.
- Hardened all CSV exports against formula (CSV) injection so values that begin with a formula character are treated as text when opened in spreadsheet apps like Excel, Numbers, and Google Sheets.
- Hardened how user and company names are handled so they can no longer contain HTML, scripts, or web links. This closes a stored injection vector and stops crafted names from being used for phishing.
- Names are also no longer turned into clickable links inside verification, password reset, invitation, account lockout, and calendar reminder emails. Everyday names, including company names that look like a domain such as Booking.com, keep working as before.
- Changing your account email now requires re-authentication and confirmation from the new address before it takes effect, with the previous address notified, closing an account takeover risk.
- Fixed a security issue where SVG account logos were not sanitized, hardening logo uploads against stored cross-site scripting.
- Fixed a security issue where password reset and other authentication flows could accept look-alike (Unicode homoglyph) email addresses and resolve them to a real account. Email addresses are now validated as ASCII only and normalized consistently across all flows.
- Following an independent security assessment through our vulnerability disclosure program, the admin console now enforces a Content-Security-Policy that restricts scripts to trusted sources, adding a strong layer of defence against cross-site scripting while leaving your content, email previews, and attachment previews working as before.
- The marketing website’s Content-Security-Policy no longer allows inline scripts by default. Inline scripts now run only when they carry a per-request nonce, which meaningfully strengthens protection against cross-site scripting.
- The website language preference cookie is now issued with an explicit SameSite=Lax attribute in addition to its existing Secure and HttpOnly flags.
- The deprecated X-XSS-Protection header is no longer sent by the console, the API, or the marketing website. Modern browsers no longer support it, and Content-Security-Policy is the control we now rely on.
- The admin console now sends Cross-Origin-Opener-Policy and X-Permitted-Cross-Domain-Policies headers for stronger cross-origin isolation.
- Tuned the marketing website’s Content-Security-Policy so analytics continues to report correctly under the stricter policy.
- Changing your account password now signs you out of all your other active sessions, so a password change immediately ends access on other browsers and devices, and you receive an in-app notification, in your own language, confirming it happened.
- You now also receive a security notification email whenever your password is changed, through either the password reset flow or the account settings change-password flow. The email confirms the change, includes the time and originating IP address, and advises you to contact support if you did not make the change.
- Passwords are now capped at a maximum of 128 characters across sign-up, login, password reset, invitation setup, in-app password change, and admin user creation.
- Closed a sign-up loophole where variants of the same Gmail address, such as extra dots or a plus tag, could be used to claim multiple free trials. Equivalent Gmail addresses are now treated as a single account.
- The marketing website login now returns the same generic message for every failed sign-in, so it no longer reveals whether a particular username exists.
- Hardened the marketing website’s background task scheduler so unauthenticated requests can no longer trigger excessive server work, improving availability under load.
- Web links inside submitted feedback are now shown as inert text in the notification emails sent to our team, so they can no longer render as clickable links that could be used for phishing.
- The API no longer reports its exact web-server version in response headers, reducing the information available for reconnaissance.