What we ship, every week.

New

• An audit progress timeline from Planning through Completed, with stage changes for admins and owners
• Preview Word documents directly in Screenata
• Risk tests can reuse an audit cycle's sampling population and preserve the risk assessment facts reviewed at the time

Improved

• Audit overview cards link directly to the relevant controls, tests, requests, and audit settings
• Audit evidence coverage shows monthly gaps in a compact calendar, with an as-of date for Type I audits

Fixed

• Evidence coverage counts agree between the company audit overview and the auditor view
• Control approvals remain separate from automated monitoring results
• Microsoft 365 offboarding checks verify departed employees against their current Entra account state
• Synced risks resolve owners from matching people and roles, while historical assessment evidence preserves its original facts

New

• Record a document review against its saved version, including participants, notes, and supporting files, with history available to auditors
• Document review reminders arrive when a linked test is due for renewal
• Vendor onboarding and periodic vendor reviews have separate tests and evidence requirements
• Select and delete people across multiple directory pages, with confirmation before removal

Improved

• Vera reviews test evidence in the context of the selected audit cycle
• Questionnaire drafts draw on approved evidence versions and preserve your review edits
• Risk assessments publish as complete evidence packages, with a generated risk treatment register available as evidence
• Device anti-malware reports appear in recommended evidence

Fixed

• Test readiness uses the same progress calculation across the app
• Removing all evidence archives retained artifacts so they no longer appear as current evidence
• Asset sync respects the selected accounts and inventory scope
• Trust Center access approval asks you to confirm an externally signed NDA
• The Needs work filter reflects current automated check results

New

• Ask Vera to draft a board report with readiness trends and risk heat maps, then review and save revisions in Vault
• Auditors can use MCP-compatible assistants to read their assigned audit data with their own auditor access
• Partners have a client oversight dashboard for reviewing the organizations they manage
• Assess an individual risk through a guided wizard and revisit its assessment history
• Policy requirement reviews support explicit exceptions, alternative safeguards, and linked remediation tasks

Improved

• Vera reviews evidence against the claims in your approved policies and refreshes the review when those requirements change
• Vera can hand a remediation task to your coding agent with setup instructions
• Asking Vera about selected text includes the highlighted quote
• Calendar pickers offer a grid for choosing months and years

Fixed

• Bulk policy approval applies only to the visible policies you selected
• Access review evidence is signed, with revisions preserving earlier submitted versions
• Full-page screenshots retain the complete captured evidence
• Employee policy acknowledgments remain tied to approved policy versions
• The Home switch between Chat and Dashboard is available from both views

New

• An organization chart built from your People roster, with editable reporting lines, a read-only view in Employee Center, and a PDF you can generate from Key Documents for audit evidence
• Add links and procedures to Employee Center from Portal Settings, so employees can start the actions your organization makes available
• Assign owners and approvers to several controls at once
• Auditors can browse read-only risk and asset registers, including risk treatments and the tests, assets, and vendors linked to each risk
• Auditors have an Audits home listing their assigned audits across workspaces, with workspace and lifecycle filters
• Endpoint anti-malware coverage checks for Microsoft Intune, JumpCloud, and Kandji

Improved

• Home brings Chat and Dashboard together, with charts for readiness, control approvals, risks, audit cycles, and task workloads
• The Baseline questionnaire asks fewer questions, focusing on values your organization needs to supply, such as review frequency and what your device policy allows
• Preview detected cloud service usage before applying it, and save service scope changes as you make them
• Asset inventory opens on in-scope assets, with bulk actions to include or exclude assets from an audit
• Auditors can see each connected account's service scope and inspect device screen-lock posture
• A person's assets and access are grouped into category tabs

Fixed

• Automated checks more accurately recognize configurations that meet the requirement across cloud, identity, HR, and development integrations, including policy thresholds and onboarding grace periods
• Checks for optional products that are not in use are marked not applicable, and incomplete results no longer count as a pass
• Access reviews require final approval, and unsigned application evidence can be reopened while preserving unaffected review decisions
• Personnel sync matches alternative email addresses instead of creating duplicate people
• Products in scope can be edited in Program settings, and saved scope changes appear without a stale settings view
• Date fields can be cleared consistently

New

• Vera's risk assessment proposes an editable remediation plan and lets you create a linked task from the proposal, with several mitigating tests linked to a risk when relevant
• Link tasks to risks from either the task or the risk
• Generate a test's built-in evidence report directly from its test page
• Record device wipes and destruction, then generate a disposal log that flags retired or reassigned devices with missing wipe records
• Generate environment separation evidence from your cloud inventory, using account environment declarations and tag mappings
• Key Documents includes an upload-only penetration test report
• Trust Center subprocessors link to their own trust centers

Improved

• Controls explain why they matter and what usually proves them, and group their tests by evidence type
• Recommended evidence shows whether a document needs to be generated, finished, approved, or prepared, with a direct action to open it
• Move between tests in the Controls side pane without returning to the list, and follow the control code back to its place in the tree
• Key Documents can be filtered by preparation state, status, and framework
• Browser screenshot capture asks which page to start on and remembers your choice
• The Audit API provides paginated automated-check history across the full audit period

Fixed

• Employee policy acknowledgment requests and counts include only approved, in-scope policies
• Key Documents shows documents already accepted as test evidence instead of an empty preparation state
• Remove all evidence clears linked documents as well as uploaded files
• Published risk assessments attach to the risk assessment test
• System Description uses workspace details for its fixed fields and tells you where to edit them
• Microsoft 365 collects the Entra enterprise application SSO inventory
• Deleting a test from the Controls side pane closes the pane without taking you away from Controls

New

• Dark mode across the whole app, switched on from Theme in the account menu
• Vera reviews a test's evidence automatically whenever files or linked documents are added or removed, and scores each submission once
• A review score that changes now says why it moved: the evidence changed, the requirement changed, or Vera re-assessed the same evidence
• Onboarding and Program settings ask the open scope questions, such as whether your product uses AI or you have a board, as yes/no answers, and each answer turns the related tests on or off
• Download Markdown evidence, including generated reports, as a PDF from the test page or any evidence preview
• Auditors can review by requirement as well as by control, and they only see tests inside the audit's framework and criteria
• A read-only Vendors page in the auditor view, with the review details for each vendor in the audit
• The auditor Controls export maps every requirement to the controls and tests that answer it

Improved

• New programs start on Baseline without a depth question in onboarding, and Enterprise is still available in Program settings
• Re-running a review on unchanged evidence returns the same score, with an option to re-assess anyway
• Evidence actions sit as buttons above the evidence list, and attaching files and linking documents share one dialog
• Vendor assessments show trust center links for vendors discovered under another name, such as Amazon Web Services for AWS
• Screenshot capture stamps carry your organization's name

Fixed

• A check with no in-scope resources no longer shows as passing, and check results agree across health, history, and auditor views
• Auditors see only approved policies for the audit's framework, and a control no longer looks reviewed when only some of its tests are
• GitHub connections recover from expired tokens, and removing a repository removes only that repository
• Microsoft 365 connections keep the permissions they were granted when they refresh
• Reactivating a deferred test sticks
• The Controls tree respects your active filters, and control details show the control code
• Submitting or cancelling a recording takes you back to Controls
• The Controls page loads quickly again on large workspaces

New

• Controls is one tree of categories, controls, and tests, and a test opens in a side pane next to it, so you can work through a control without losing your place
• A Key Documents tab lists the documents your frameworks require or recommend with the status of each, and one Submit for review sends a document to every test it supports
• Documents keep a version history, and a version used in an audit is frozen, so the file your auditor reviewed cannot be changed or deleted
• Fix failing tests from your coding agent with the Screenata CLI, which shows why a test fails, runs a fix only after you approve its exact plan, and re-runs the test to prove it passes
• Answer policy questions and draft a policy from the terminal
• Every automated check has its own run history and live results
• Include or exclude specific resources for one check, leaving every other check's scope as it was
• Manage connected AWS, Azure, and Google Cloud accounts from one settings dialog, and change an AWS region without re-entering keys
• Auditors can open past automated check runs, with the resources each run covered and its downloads
• An unread-only filter in the inbox

Improved

• A broken integration shows at the top of the daily briefing, runs that error out no longer open findings, and one failed sign-in no longer takes a connection offline
• GitHub and Microsoft 365 show Approval needed when their permissions change, and a check that cannot run says why instead of failing
• An auditor's approval is tied to the exact evidence version they reviewed, with a review history for each version and the signed evidence manifest alongside it
• Count chips filter Controls by status, test rows show who owns each test, and search shows which tests matched
• Overdue task reminders and SLA breach alerts arrive as batched digests
• GitHub connections are listed by repository, and Intune is switched on or off from the Microsoft 365 Services tab
• Regenerating an approved or imported policy asks you to confirm first

Fixed

• Invited users who sign in with Google land in the organization that invited them instead of a new one
• The Microsoft 365 check for guest Conditional Access coverage now passes when your policies cover guests
• The tests-by-requirement export leaves out criteria your program excludes
• Auditors see the same evidence the Test page shows, including files in read-only snapshots
• A test sent back for changes counts as To do rather than Failing
• The workspace sidebar stays visible on narrow screens

New

• Screenata now works out which cloud services you actually run — across AWS, Azure, Google Cloud, and Cloudflare — and asks you to confirm the list during setup, so checks are scoped to the services in use rather than every service the provider sells
• Wider native coverage inside each cloud: more AWS services, deeper Azure service discovery, and Cloudflare account, DNS, and TLS checks
• Every step in the Setup guide can be skipped, not just the ones marked optional, so a step that does not apply to you stops holding up the chapter it sits in
• Bulk actions on test lists
• Linked risks show their risk code, so a risk referenced from a control is identifiable without opening it
• Search-or-create boxes create what you typed when you press Enter, with a hint showing that they will

Improved

• Native checks are more accurate across several providers — Azure management MFA coverage is scoped correctly, security contact checks match the current provider API, owner notification roles are validated, and the security and monitoring checks are hardened
• The AI review is told what Screenata already holds, so it stops asking for evidence that is already in the vault
• Procedure evidence rolls up by period
• Scope proposals read as defer or activate, rather than presenting themselves as a new test

Fixed

• Eight elective controls were marked required and no longer are
• The Audit chapter of the Setup guide is reachable, and specific to the cycle you are in
• Cloud service selections are preserved and restored instead of resetting between visits
• Sessions stay in step between the web app and the browser extension when you sign in or out
• Evidence lifecycle state agrees between generated evidence and what the interface shows
• Daily briefing details render in the inbox
• Recording no longer captures navigation that happened while it was paused
• Grouped unread counts stay consistent

New

• Single sign-on for your organization — SAML and OIDC, with guided setup for your identity provider, while password and social sign-in stay available alongside it
• A Setup guide that owns the whole audit process, not just onboarding — eleven chapters from connecting systems through the audit, each saying what the auditor is looking for, with skipped steps struck through and restorable, and a link to exactly where each step happens
• A machine-readable Trust Center API — every Trust Center is also a versioned JSON API, so a customer’s vendor management can pull your documents, controls, subprocessors, and a signed attestation straight into their intake instead of asking over email
• Revoke a Trust Center access grant at any time, and the access link is shown on approval with a copy button, so it never depends on an email arriving
• Vendor risk scored from impact and likelihood, with an assessment workbench that shows where every fact came from — a document, a trust page, or a person — and lets you edit it
• A relational people graph for assets — who holds which device, a custody history when it changes hands, and a default accountable owner for every asset, with licenses folded into the People tab
• Comments and full editor toolbars on policy documents and recordings, plus review notes you can reply to, resolve, and export, in read mode too
• Start an empty policy by uploading yours or generating it with Vera, and generation waits until the questionnaire it depends on is answered
• Bulk actions on resources, including marking them out of scope — scoped-out resources are skipped at collection time and their findings dispositioned, so they stop generating noise
• Key documents on the auditor dashboard, resolved to the tests behind them with each one’s review status
• Recording submissions attach to the test they evidence

Improved

• Test lists show automated rollup progress, and rollups include a representative check’s evidence so you can see what passed, not just that it did
• Requirement rollups are labelled apart from automated checks, and a linked test’s status is clearer
• A test’s verdict respects the exceptions on it, reminders go out before an exception expires, and SLAs are no longer raised for tests marked not applicable
• Audit readiness covers more of the program, and new native checks landed across integrations
• Questionnaire answers are verified against live scans rather than a stored snapshot
• Policy acknowledgment reports use one canonical format
• Compliance roles can be held by more than one person
• Chat accepts attachment-only messages

Fixed

• Audit package downloads survive navigating away mid-generation
• Policy editor autosave no longer loses work, and Edit and Request Approval are hidden while a policy is still generating
• A policy whose generation job was lost can be recovered, and questionnaire answers are committed before regenerating or closing
• The scoped policy upload dialog binds the file you chose and drops the redundant slot list
• Review note actions and policy comment interactions no longer misfire
• GitHub branch protection remediation is hardened against partial configurations
• Dashboard and inbox indicators show the right counts
• Long finding titles stay contained in the dismiss dialog, and formatting is preserved in color popovers
• The Setup guide no longer offers Start setup on workspaces that already have tests
• New workspaces reach the onboarding questions exactly once, and those answers scope the test plan, so a SOC 2 program no longer starts with every non-Security control out of scope
• The Inbox stat card is gone from the auditor cycle dashboard

New

• The activity log shows the reasoning behind a verdict, not just the verdict itself
• Tests say whether their evidence is a policy, an automated check, or something a person has to capture, so it is clear what each one needs from you
• An MDM enrollment report showing which devices are enrolled and which are not
• Open Attest device rosters sync nightly and carry a freshness deadline, so stale device data is flagged rather than assumed current
• Open Attest now counts as anti-malware evidence, and the different Defender products are told apart properly
• Not-applicable tests are hidden by default, with one checkbox to bring them back and lighter badges on every row

Improved

• Failed evidence reviews keep their five-axis score and are marked advisory, so you can see exactly where the evidence fell short
• Annual training tests use the training records already in Screenata instead of asking you to upload them again
• The training program schedule can be edited after it is set
• Comment and mention emails link straight back to the test they came from
• SLA warnings arrive batched instead of one message per item
• Azure onboarding scans are scoped by subscription, so a multi-subscription tenant is covered properly
• Every evidence route is a link from the empty state, so it is obvious how to supply what is missing
• Scan coverage is reported as its own finding, so a gap in what was scanned shows up instead of passing quietly

Fixed

• Rollup periods no longer park waiting on approval — evidence is scored and the period moves on
• Partial review scores are kept instead of being lost on the next pass
• A failing rollup shows the window it actually examined instead of a dash
• Passed rollups still require approval before they count
• Submitting evidence clears the escalation attached to it
• Recording actions stay reachable, hidden steps no longer drift, and progress is restored for guidance-only tests
• Edited recording screenshots submit as evidence, and hidden video is left out of what gets submitted
• Confirmed fields stay editable during onboarding, and discovered company logos are checked before they are shown
• GitHub repository security verdicts resolve instead of hanging unresolved
• Framework cards count tests the same way the framework page does
• Requirement citations are scoped to the framework you are looking at
• Setup progress counts framework requirements rather than the controls underneath them
• Baseline program depth covers the first engagement for every framework
• Chat send and loading no longer jump around, and forms wait for the whole input before submitting
• Leaving a test view shows one consistent loading state
• Bulk edit on people resets properly between uses
• Risk exports from Vera use the standard CSV format
• Slack no longer runs admin checks its API does not support, so those stop showing as failures
• Compliance counts on Open Attest reconcile with the rest of the program

New

• Auditor portal request queue — auditors raise information requests, you answer them, and the whole exchange stays in one place instead of an email thread
• Decide an auditor's proposed change straight from your inbox, without opening the request
• Auditors can see the run history behind an automated check: when it last ran and what it returned
• Per-engagement scope review — the auditor confirms what's in scope inside their own workflow, and the decision is recorded
• Choose Baseline or Enterprise-ready program depth during onboarding, with the recommended option and the reason for it shown before setup runs
• Filter your tests by program depth, and see the depth badge on any test, so it's clear why a test is or isn't in your program
• Agent-first onboarding — hand setup to Claude Code or Codex from the first screen, with a manual path if you'd rather do it yourself
• Search the vendor catalog while extending coverage during onboarding
• Optional Slack step in onboarding, with a preview of the channel Vera will post to
• Assign policies and training to groups of people instead of one person at a time
• Import your vendor list from a CSV or Excel file
• Axiom compliance checks
• Okta access evidence lands in canonical types, with new coverage checks behind it

Improved

• AI evidence review now scores the five dimensions an auditor actually weighs instead of four that all moved together
• Curated auditor guidance appears in the test, in its scoring, and in what Vera tells you
• Inbox digest emails are scannable and labeled by organization, with a preview of each item and a count of the rest
• Approval notifications link straight to the thing waiting on you
• SOC 2 Type II is the recommended audit type, and the onboarding wizard resumes where you left off
• A period rollup result now shows on every check that covers it
• Clearer evidence panel on a test for automated and approved results, and an easier risk assessment to read and edit

Fixed

• Approved policy claims now show on the tests that prove them
• Filtering by framework returns the right tests instead of quietly matching the wrong ones
• Microsoft 365 sign-in for delegated permissions no longer fails partway through connecting
• Okta coverage now includes MFA enforcement and the complete user roster
• The CLI installs cleanly again, and screenata upgrade updates it in place
• Imported records keep their ownership and their rounding instead of being overwritten by setup
• Restored native evidence checks that had gone missing

New

• ISO 42001 readiness — get audit-ready for the AI management standard alongside SOC 2, HIPAA, and ISO 27001, with its own artifacts and AI governance questionnaire
• AI system inventory — register the AI systems you run, break them into components, and see the tests covering each
• EU AI Act Article 50 transparency evidence, offered only on the AI systems it actually applies to
• Supabase connector — connect over OAuth and scope scans to the projects you choose
• Policy commitments become tracked claims — every hard commitment in your policy prose links to the test that proves it
• Tiered policy approval — Vera blocks a statement that isn't true of your company and offers the rest as suggestions
• Audit package readiness — see what an auditor would find missing before you submit

Improved

• Recommended evidence is consolidated per test, including documents Screenata generates for you, with the automated check or person behind each result
• Reminders and escalations arrive as one batched digest instead of a message per item
• Test list filters stay in the URL and carry through to the tests you open, and long dropdowns are searchable
• A failing test or period rollup hands off to a person instead of stalling

Fixed

• HIPAA Business Associate programs no longer inherit requirements that only apply to Covered Entities
• Audit cycles edit the framework you actually selected instead of defaulting to SOC 2
• Editing a policy awaiting review now opens for editing and withdraws the stale approval request
• Controls are titled by the requirement they satisfy, and retired tests stay out of your test list
• A check covering several connected accounts runs once and records its result on every test it proves

New

• ISO 27001 readiness tracking — cover the ISMS clauses and the Annex A themes a certification body samples
• Requirement-level control mapping — every control is labeled by the framework requirement it satisfies, with coverage gaps shown per period
• Custom evidence requirements — define the exact evidence a control needs, and tests scope themselves to what you asked for
• Sentence-level policy comments — highlight a single sentence and comment on it instead of the whole section
• Reusable questionnaire answers — saved answers carry forward as durable commitments, written as prose instead of stitched-together claims
• Control status in plain words — read each control's state from the row itself instead of decoding a colored dot
• Employee account linking — connect the accounts Screenata finds in your integrations to the right employee profile

Improved

• Review notifications open inline in your inbox, with a direct link to the test in question
• Guided setup tracks Slack and Trust Center as their own steps, and no longer opens on sample data
• Test and task counts now agree across the dashboard, the board, and the test list
• Vendor discovery pulls candidates from every connected integration, not just a handful

Fixed

• HIPAA tests are no longer judged against SOC 2 criteria you never selected
• ISO 27001 audit cycles load and stay editable instead of failing on an unrecognized audit type
• Re-scoping or unlinking a control now reaches its tests and stays that way
• Every test gets its own code and title instead of repeating the first one
• Google Workspace and GitHub checks verify against live APIs, and skipped scans no longer read as failures

New

• Global search — find any test, task, or work item by name or code from a new sidebar search box and a ⌘K command palette
• Grouped list view — organize tasks and registers into collapsible groups you can scan at a glance
• "Provides evidence for" links on tasks — jump straight from a task to the test it satisfies
• Quieter compliance board — auto-generated scanner findings stay off the board until you choose to triage them

Improved

• Vera's escalation emails now deep-link to the exact test or task that needs your attention
• Stale "Vera needs your help" prompts auto-dismiss once the underlying work is resolved
• Task descriptions expand to fit their full content instead of clipping

Fixed

• Signature attestations now persist reliably
• Activity logs show assignee and role changes accurately and no longer merge distinct events
• One person now shows a single consistent avatar across every name-format variant
• Uploaded intake attachments keep their original source and provenance
• Group inventory registration now completes without stalling

New

• Self-service compliance requests — a unified intake for compliance work, with in-app and email requests that Vera routes to the right procedure automatically
• Live request activity feed — follow any request in real time with a causally-ordered timeline of steps, evidence, decisions, and comments
• Agentic compliance operations — Vera triages incoming work, auto-executes high-confidence steps, posts her outcome report to the test thread, and hands anything uncertain to a human for approval
• Asset and device register — track device lifecycle, warranty, and MDM sync in one place, with employee software licenses and per-device history unified into the asset timeline
• Custom form fields — add Choice (dropdown) and Signature field types to your procedures and human steps
• Auditor Center rollups — period-of-time evidence coverage, sampled-run details, live check-health badges on test cards, and searchable run history for audit sampling

Improved

• Reorganized Screenata sidebar — grouped into Program, Vault, Registers, Trust, and Configure
• Instant procedure start — begin a procedure immediately while policy grounding finishes in the background
• Broader contributor access — contributors can now act on questionnaires, assets, offboarding, and risk seeding without hitting permission walls
• Workspace-scoped GitHub — connect and disconnect GitHub per workspace, with multi-account support
• Bulk evidence export — download any selection of documents as a single zip

Fixed

• Cancelled procedure runs no longer leave phantom tasks in your inbox or My Tasks
• Board columns now render cards correctly after a previously-empty column re-populates
• The public Trust Center now loads on your custom-domain root without an auth prompt
• Vera chat handles empty replies gracefully instead of stalling
• Vera's comments no longer show double-escaped whitespace

New

• Trust center on your own domain, host your public trust page on a custom domain with guided DNS verification
• Redesigned public trust page, dark and light themes, brand-color theming, and configurable hero backgrounds
• NDA-gated document access, require a signed NDA with an expiry date before sharing trust-center documents
• 90+ new automated checks across AWS, GCP, Azure, and SaaS identity providers

Improved

• Review panel, a cleaner layout with intent-clear actions to mark not applicable, remove, assign an owner, or route for approval
• Trust-center admin, frameworks visibility controls, request filters, and a live public-URL preview
• Vera grounds drafted answers in your approved policy passages only

Fixed

• Approval cards now name the specific check or action you're approving
• Viewer role, read-only access is enforced consistently across every surface
• Setup guide hides itself once onboarding is complete

New

• Guided "Get audit-ready" setup, a floating setup guide, coach-marks across compliance surfaces, and Vera starter suggestions on every onboarding step
• Ask Vera everywhere, starter prompt pills under the composer and a chat rail you can open from any compliance surface
• Audit command center, a dedicated audit page with SOC 2 Type II period-coverage tracking, plus auditor first and last names captured at invite time
• Vera-generated SOC 2 bridge letter, draft a bridge letter for your SOC 2 audit without leaving the platform
• Personnel and manager management, a structured manager picker that auto-links on sync and import, a background-check column, and personnel sync across your identity providers
• Continuous-monitoring lens, surface the latest automated check verdict directly on each control test

Improved

• Simplified cloud setup, a cleaner wizard for connecting your cloud providers
• Design system refresh, softer squircle corners, refined focus rings, and clearer elevation across the app
• Policy-set approvals, approvals are now coverage-aware, so you only sign off on what actually needs it
• Evidence guidance, recommendations no longer hinge on test type and evidence-slot instructions are consolidated in one place

Fixed

• Browser capture, grab evidence by screenshotting any web-app URL
• Document evidence, no longer fails on tests that don't have a template
• Risk register layout, widened the ID column so warning icons no longer overlap the rating badge
• Navigation, the Controls sidebar item now stays active while you're viewing tests

New

• Employee onboarding and offboarding, automate joiner and leaver workflows with manager approvals and access tracking
• Human steps in Slack and email, approve, complete, or upload evidence for Vera's workflow steps without leaving your inbox
• Ask Vera in the portal, grounded answers about your compliance posture, drawn from your own policies and evidence
• Slack agent escalations, act on Vera's compliance alerts with one click, right in Slack
• Email Vera and browser-capture settings, manage how you reach Vera by email and capture evidence from any web app

Improved

• Policy governance, override approvals and import your entire policy library from a single page
• Tasks, a unified board and list view for everything assigned to you, now defaulting to a board
• Document management, upload, stash, and batch-assess evidence documents in one workflow
• Faster program setup with parallelized test compilation

Fixed

• MFA enrollment, now shows a clear error message instead of a generic network failure
• Policy coverage counts, now reflect shared and master policies accurately
• Completion ratios, no longer capped by covered policies or not-applicable controls
• Control lists, de-duplicated across overlapping frameworks
• Test editing, the Edit Test dialog now updates the evidence instructions directly

New

• Vendor risk management, discover vendors from integrations, tier them, and let Vera draft assessments
• Continuous evidence enforcement, track freshness with renewal filters and automated integration-to-evidence lifecycles
• Compliance posture dashboard, monitor workspace-wide readiness with actionable cards and Vera-generated risk registers
• Policy governance, set per-policy review cadences and manage bulk approval requests in a unified inventory
• HRIS and IdP sync, automate personnel directory management and provider-agnostic background checks
• Microsoft Teams and M365 compliance, dedicated provider support for Teams, SharePoint, and Entra ID

Improved

• Optimized cloud connection, improved background processing speeds when connecting or disconnecting cloud providers
• Framework mapping, unified HIPAA controls for streamlined cross-framework evidence collection
• Policy management UI, split policy imports into tabs with smarter classification and richer review dialogs
• Role-based access control, restricted policy edits and vendor assessment writes to authorized manager roles

Fixed

• N/A test accuracy, corrected display logic and applicability reasons for non-applicable control tests
• Identity resolution, resolved duplicate user account creation during OAuth login and browser extension authentication
• Role stability, fixed role assignment persistence by syncing on stable identifiers rather than editable names
• Questionnaire parsing, improved support for multi-sheet workbook uploads and draft auto-population
• Audit cycle management, fixed date-shift logic and handled null periods in auditor invitation emails

New

• Test-first onboarding, replace questionnaires with action-oriented steps to accelerate audit readiness
• Evidence classification, Vera suggests tests for uploaded documents and saves them as classified evidence
• Two-stage request lifecycle, manage evidence requests through distinct respond and resolve stages
• Audit-cycle management, track frameworks, vault uploads, and readiness analytics in a unified view
• Organization-wide MFA enforcement, manage and enforce two-factor authentication across all user accounts
• Policy checklist, upload and track required policies with support for bulk imports and drag-and-drop
• Open Requests dashboard, view all pending requests and linked-document evidence in a dedicated view

Improved

• Automated test status, Vera automatically marks tests as N/A when no in-scope resources are found
• Enhanced Microsoft 365 monitoring, replaced manual attestation stubs with automated Graph API checks
• Bulk actions, manage controls and policies efficiently with multiselect and bulk approval workflows
• Responsive interface, properties panel now collapses into a floating tab for better use on narrow screens

Fixed

• Test regression handling, tests now revert to a failed state if a re-run confirms a new failure
• Evidence integrity, Vera now invalidates and re-grades reviews when the underlying evidence files change
• Notification cleanup, stopped duplicate Open Requests from appearing as auditor notifications
• Upload reliability, blocked evidence submissions when files are unreachable to prevent data gaps
• Login security, hardened workspace-scoped routes and validated redirect URIs to prevent cross-org requests

New

• Frameworks dashboard, navigate controls and tests grouped by specific regulatory criteria
• Automated test skipping, Vera identifies and skips non-applicable tests to reduce manual escalations
• HIPAA Security Rule expansion, six additional implementation specifications added to the compliance catalog
• Readiness questionnaire overhaul, inline integration setup and direct access to Vera for guidance
• Evidence management, attach evidence to any category and find tests by description
• Audit Cycles, track historical and active audits grouped by year with dedicated cycle views
• Discrete evidence tracking, specific slots for network diagrams and performance evaluations

Improved

• Vera reasoning transparency, new visual indicators show Vera's thinking process and skill usage
• Slack and email agent reliability, improved skill reachability and cross-turn memory for remote interactions
• Test activity feed, paginated results with noise reduction for automated check logs
• Progress tracking, section counts now reflect sub-questions for more accurate readiness reporting

Fixed

• Evidence-driven test status, test results now trigger from evidence submission for higher accuracy
• Chat evidence attachment, resolved issues with test ID memory and link sanitization in Vera
• Integration stability, fixed OAuth connection lifecycles and API key credential modal triggers
• Control tree reliability, eliminated duplicate controls and flickering when switching between frameworks
• Document search, improved relevance ranking to match any token within policy searches

New

• Vera claim verification, Vera verifies compliance claims and recommends supporting evidence from your integrations
• Continuous monitoring, daily API-driven checks detect configuration drift across your security stack
• Audit cycle management, track progress and evidence submissions across multiple frameworks in one view
• On-demand evidence review, Vera performs instant quality reviews on uploaded evidence artifacts
• SOC 2 readiness expansion, 14 new auditor-requested tests for SOC 2 Type I readiness
• Policy-to-message attachments, attach existing vault documents and policies directly to chat threads with Vera
• Deep-linked onboarding, resume setup at any stage with persistent wizard state and direct URLs

Improved

• Performance virtualization, faster loading for large task boards, test lists, and control trees
• Composer responsiveness, reduced input lag by deferring non-critical card rendering in the chat interface
• Snapshot coalescing, cleaner readiness history by grouping gap-detection updates into single snapshots

Fixed

• Evidence locking, vault documents linked to submitted evidence are now correctly locked from modification
• M365 provider resolution, corrected display titles for Microsoft 365 integration checks
• Inbox layout, fixed property panel overflow issues within the inbox view
• Evidence submission flow, resolved errors blocking the end-to-end evidence approval and submission process
• Duplicate tool calls, prevented duplicate assistant messages to ensure stable AI agent responses