v1.9.0 September 15, 2026 Major
- New Analyst agent v9 — portfolio Q&A in plain English with per-finding citation chips linked to source spans.
- New DORA framework tracking for financial services vendors: register status, ICT third-party classification, exit strategy artifacts.
- New FedRAMP High Marketplace ingestion — authorization state and package expiry now surfaced as first-class evidence.
- Improved Residual risk now factors in subprocessor concentration: 4th-party fan-out visible in the portfolio view.
- Improved Vendor Pulse API webhook payloads: added `claim_ids[]` and `evidence_urls[]` on every signal event.
- Fixed Deduplication of Certificate Transparency signal bursts during mass issuance windows.
v1.8.0 August 20, 2026 Major
- New Trust Exchange NDA-gated document sharing is GA. Buyers accept a vendor DPA in-browser; acceptance recorded in the audit log.
- New Whistic and SafeBase profile import — one-click migration for buyers moving off vendor trust portals.
- New Per-vendor-group signal SLA overrides: PHI vendors can route to a different on-call channel than commodity tools.
- Improved SOC 2 exception extraction now handles rotated-text and multi-column table layouts (precision 92.8% on eval set).
- Fixed Timezone drift in certification expiry alerts for APAC-hosted vendors.
- Fixed Missing referrer header on outbound crawl requests to Cloudflare-fronted trust centres.
v1.7.0 July 22, 2026 Major
- New Vendor Pulse API v1.2: batch resolve endpoint accepts up to 1,000 domains per call for register onboarding.
- New LowerPlane native integration — unified SSO, shared tenant model, no connector to install.
- New Certificate Transparency early-warning: new subdomain issuance for auth.* triggers a low-severity signal.
- Improved Extractor Tier-2 model swap — 22% faster, 8% lower inference cost, no precision regression.
- Fixed PDF parser handling of two-column SOC 2 reports (Deloitte, PwC layout variants).
v1.6.0 June 18, 2026 Major
- New Portfolio natural-language search: "Which vendors process PHI and expire in 90 days?" returns a cited answer.
- New ServiceNow GRC bidirectional sync — vendor register, assessments, and signals flow both ways.
- New Tier-0 deterministic parsers for RSS trust-center feeds — zero inference cost for 65% of extraction volume.
- Improved Assurance decay model retuned against a 90-day observation window; per-evidence half-lives now editable.
- Fixed Missing `artifact_id` in webhook payloads under high throughput; retries now idempotent.
v1.5.0 May 14, 2026 Major
- New Signal routing rules per vendor group and per severity — critical PHI signals bypass digest windows.
- New Snowflake data share of the TrustVendor evidence dataset for enterprise customers.
- New HIBP breach ingestion for vendor employee accounts — surfaced as an outside-in signal.
- Improved Vendor identity resolver confidence threshold raised 0.75 → 0.80; low-confidence matches enter the review queue.
- Fixed Race condition in the claim writer under concurrent SOC 2 uploads to the same vendor.
v1.4.0 April 16, 2026 Major
- New Breach Risk product is GA — prober telemetry, CVE and KEV matching, incident disclosures, certificate events.
- New CISA KEV JSON feed ingested every 5 minutes; end-to-end KEV → routed signal SLA under 30 minutes.
- New Jira and Linear signal delivery: severity maps to issue priority; auto-close when the vendor recovers.
- Improved Portfolio view density — 40% more rows visible per screen at default zoom.
- Fixed Duplicate certification claims when a trust center layout changes and the extractor version bumps.
v1.3.0 March 11, 2026 Major
- New Evidence viewer: hash verification runs client-side via Web Crypto API — auditors verify the sha256 in-browser.
- New Slack app v2 — threaded signal delivery with acknowledge / resolve / snooze actions.
- New Framework coverage: FedRAMP Moderate and PCI DSS added; certifications tracked against public registries.
- Improved Extractor span validation now catches 3% more hallucinated citations before write; `ErrSpanMismatch` rate published per version.
- Fixed Assurance score staleness when a vendor trust center returns 5xx for more than 24 hours.
v1.2.0 February 4, 2026 Major
- New Trust Workspace is GA — portfolio view, per-relationship residual risk, signals inbox, human review queue.
- New Vanta integration — the vendor review control closes automatically on evidence refresh.
- New SOC 2 Type II exception table extraction with Triage agent materiality scoring per relationship.
- Improved Onboarding — bulk vendor import via CSV or GRC platform sync (OneTrust, ServiceNow).
- Fixed OAuth callback loop for Google Workspace SSO on domains with strict cookie policies.
v1.1.0 December 17, 2025 Minor
- New Vendor Pulse API — free unmetered `resolve` endpoint, per-vendor metered `pulse` endpoint.
- New Public vendor graph launched with 12,000 profiles built from public sources.
- New Trust Exchange beta — vendors can claim, verify, and edit their profile against agent-produced baselines.
- Improved Snapshot storage moved to a content-addressed backend keyed by sha256; artifact IDs are now stable across redeploys.
- Fixed Empty subprocessor list false positives on paginated pages where the extractor missed the "load more" link.
v1.0.0 October 9, 2025 Initial
- New Extractor agent v1 — reads trust centres, subprocessor pages, SOC 2 summaries, and status pages.
- New Verifier agent v1 — corroborates high-impact claims across independent sources before scoring.
- New Deterministic Go scoring — posture and assurance computed from cited claims only. No model runs in the scoring path.
- New Private beta launch with 8 design partners across healthcare, fintech, and enterprise SaaS.
