What's actually shipped
A running log of platform changes (connectors, frameworks, trust center, MCP, and core platform work), updated as each one lands.
- Integrations
New evidence connectors: Clerk, Neon, incident.io, Brex, PostHog, Qovery
Added six more read-only connectors — identity/auth (Clerk), managed Postgres (Neon), incident management (incident.io), corporate card/spend (Brex), product analytics (PostHog), and deployment platform (Qovery) — each collecting only inventory and access-posture evidence.
- Frameworks
Typed cross-framework mappings with audit projection
Controls in one framework can now be typed against controls in another (equivalent, subset, intersect), and a read-only projection layer proposes which controls in a target framework are likely already satisfied based on your current status elsewhere. Seeded as a proof case between SOC 2 and ISO 27001; this is a display-layer suggestion, not an automatic status change.
- Frameworks
Framework library: GDPR, CMMC Level 1/2, and NIST AI RMF now seeded
GDPR ships a partial set of controls authored from the operative articles most relevant to a security/governance program. NIST AI RMF ships a partial, substantive selection of the framework's published Govern/Map/Measure/Manage categories. CMMC Level 1 and Level 2 ship full control sets. (FedRAMP Moderate remains partial, seeding the base Access Control, Audit and Accountability, Identification and Authentication, System and Communications Protection, and System and Information Integrity control families rather than the full ~325-control baseline.)
- MCP
MCP tool surface expanded to ~24 tools
The MCP server grew from about 7 tools to around two dozen, adding read tools across risks, vendors, policies, findings, access reviews, questionnaires, trust-center documents, integrations, training, AI systems, exceptions, and review schedules, plus a set of propose-only action tools.
- Platform
Exceptions register
Added a time-boxed exceptions register at /exceptions for documented waivers on controls, requirements, policies, and risks — each with an owner, a justification, compensating controls, and a mandatory expiry that forces re-review.
- Platform
Reviews-due engine
Added a unified recurring-review queue at /reviews spanning risks, policies, controls, vendors, access reviews, exceptions, and assets in one overdue-first view.
- Platform
Privacy Operations module
Shipped a privacy operations module under /privacy covering a Records of Processing Activities (RoPA) register, a data-flow register, data-subject-request (DSR) tracking with an SLA clock, and a DPIA workflow.
- Platform
Bulk CSV import for risks and vendors
Added a CSV import wizard (/import/risk, /import/vendor) that maps columns to fields, previews a dry run, then commits — re-importing the same file updates existing rows by name/title instead of duplicating them.
- Integrations
Outgoing webhooks with HMAC signing, plus a CLI
Added outgoing webhooks with HMAC-SHA256 request signing, and a thin command-line wrapper (scripts/grc-cli.ts) over the same token-authed MCP server and scan-trigger endpoint the dashboard already uses.
- Platform
Obligations tracker and Meetings register
Added an obligations tracker (/obligations) for jurisdictional legal and regulatory obligations tracked separately from framework controls, and a governance meetings register (/meetings) that records attendees, decisions, and action items as evidence of governance cadence.
- Integrations
Shopify security/access connector template
Added a read-only Shopify connector template that collects staff-account and access-posture evidence for e-commerce tenants, following the same evidence-only pattern as our other connector templates.
- Integrations
Stripe security config connector template
Added a read-only Stripe connector template that inventories account security configuration for vendor-risk and access-review evidence, without touching payment or customer data.
- Integrations
Notion connector template
Added a read-only Notion connector template covering workspace member and permission inventory, for teams that use Notion as a system of record.
- Integrations
Twilio connector template
Added a read-only Twilio connector template for account and access-posture evidence collection.
- Integrations
Connector catalog review: 7 templates promoted out of draft tier
Reviewed and promoted 7 connector templates that had been sitting in our lowest-confidence tier after a targeted verification pass against each provider's real, documented API surface.
- Platform
Expanded native connector catalog
Landed a broad batch of additional read-only connectors (including Zendesk, Confluence, Freshservice, Supabase, Vercel, Netlify, Google BigQuery, Sentry, Discord, SecurityScorecard, and Carbon Black), each collecting only inventory/access-posture evidence, never writing to the source system.
- Integrations
HR and recruiting connectors: Ashby, Deel, Justworks, HiBob, OmniHR, BreezyHR, Personio
Added read-only connectors across HR/HRIS and applicant-tracking systems for access-review and roster evidence, each scoped to the specific documented endpoints of that provider's API.
- Integrations
Native connectors: GitHub, AWS, GCP, Okta, Google Workspace, Rippling, GitLab, Datadog, Snyk, PagerDuty, Auth0, CrowdStrike
The dashboard's core integrations surface supports 12 native connectors spanning source control, cloud, identity, and security tooling, each with its own dedicated marketing and setup page.
- Trust Center
Public trust center pages
Shipped the public trust-center surface (a per-tenant public page plus NDA-gated document sharing) alongside the admin trust-center workspace where the security posture and documents are managed.
- MCP
MCP server for tenant compliance data
Added an MCP endpoint and an API-tokens settings page so AI clients like Claude can query a tenant's controls, evidence, and risk data directly over the Model Context Protocol.
- Frameworks
Framework coverage: SOC 2, ISO 27001/27701/42001, HIPAA, GDPR, PCI DSS, CMMC, FedRAMP, NIST AI RMF, NIS2, DORA, EU AI Act, SOX
The frameworks hub covers cross-mapped controls for security, privacy, government/defense, AI governance, and EU-resilience standards, so one control and one test can satisfy requirements across multiple frameworks at once.
- Scanner
Public one-off website scanner
Shipped an ungated public scanner at /scan that runs passive, browser-equivalent checks and returns results inline when the job queue or database isn't configured.
Want the raw feed? /changelog/rss.xml. Curious what's next? See the roadmap.