Changelog

September 2026

The documentation moved to our own infrastructure

docs.kliper.dev is now served from Kliper’s own Cloudflare account instead of a third-party documentation host. Every address is unchanged. What you gain: a home page with search and a getting-started path, hand-drawn diagrams of the data hierarchy, evidence pipeline, scoping flow and QA states, a changelog RSS feed, a notice when a newer version of a page is available, and the same cookie consent model as kliper.dev, with a separate choice for the docs site. The subprocessor list no longer names a documentation host: the site holds no customer data and is listed under Cloudflare.

The documentation is available in French

Every page has a French edition under docs.kliper.dev/fr. The language switcher in the header opens the same page in the other language, search returns results in the language you are reading, and the French edition is kept complete: an English change cannot ship until its French twin is updated. PCI DSS requirement numbers and the terms quoted into a ROC stay in English on purpose, as they do in the app.

Start an assessment from anywhere, and land on it

The filled button in the top bar used to read New engagement and only took you to the engagement list. It now reads New assessment and opens the creation flow itself — quick create or the full wizard — from any page. Whichever path you take, Kliper opens the new assessment as soon as it exists; tick Open scoping questions after creation and it opens on the scoping questionnaire instead. See Creating an Assessment.

The upgrade prompt names the limit you hit

Reaching a plan quantity limit showed a generic “this capability is part of a higher plan” message even though the server had already said exactly what happened. The prompt now carries that sentence — for example, Assessment limit reached. Your plan allows 1 assessment per client. — so you know which allowance to look at before opening Billing. See Billing & Plans.

A removed workspace no longer locks you out

If the workspace your browser remembered as active no longer existed — or you had been removed from it — every sign-in bounced straight back to the login form until you cleared site data. Kliper now notices, forgets the stale workspace, and signs you into the first one you still belong to.

The documentation has a home page

docs.kliper.dev now opens on a home page — search, a quick start, the getting-started path, docs by role, core concepts, popular guides and integrations — instead of dropping you into the first article. The Documentation tab still opens on Platform Overview with the full sidebar.

August 2026

Every new workspace starts on a 14-day Pro trial

The trial the pricing page has always advertised now exists. Creating a workspace puts it on Pro for 14 days, with no card required. A banner counts the days down (amber for the last three) and links to Billing; it can be dismissed for the session. When the trial ends the workspace moves to the Free allowances: everything created during the trial stays readable and editable, and only adding more is blocked until you upgrade. See Billing & Plans.

Library and Admin are proper groups in the sidebar

Library and Admin were tiny captions with a chevron, and their pages sat at the same indent as top-level items, so the grouping was invisible. Both are now full rows with their own icon; their pages indent beneath a guide line, and the group highlights when one of its pages is open. Nothing changes on the collapsed rail, which never showed grouping.

Demo sign-in shortcuts are configured per environment

The Quick demo logins panel on the sign-in page was a fixed list built into the app, so every deployment showed the same accounts and, until this fix, carried their passwords in the page. The list now comes from each environment’s configuration and production ships labels and emails only; the buttons fill in the address and you type the password.

Releases and recovery, behind the scenes

Every production deploy is now tagged with what shipped and passes health, rendered-page and sign-in behaviour checks before it counts. The database can be rebuilt from a single baseline — 111 historical migrations squashed into one — which the weekly disaster-recovery drill now exercises, along with a readiness check on the inputs a rebuild needs. Dated operational commitments (certificate expiries, credential rotations, recurring drills) open tracked issues automatically instead of living in a document.

Two new security tools: Asset Discovery and the Vulnerability Scanner

Asset Discovery finds the external-facing hosts on a domain and tells you which still answer — the forgotten staging box or abandoned subdomain that quietly sits in scope. It flags dangling records (a DNS name pointing at an address nothing answers on) first, because that is the finding worth acting on. It supports Requirement 11.3.1.

The Vulnerability Scanner runs nuclei against a URL and splits the results into actionable and informational, with the low-signal notices tucked behind a toggle. Both tools require an authorization attestation before an active scan runs — you confirm you own the target or have written permission — and both show a banner if the scanning host itself is unreachable, so a failed scan is never mistaken for a problem with the site you are assessing. See Security Tools.

Cortex reads the whole ROC, not just Section 7

Ask Cortex about the Executive Summary and it used to answer with boilerplate — the content genuinely never reached it. Cortex could only see the Section 7 requirement tables, which left the Executive Summary, all of Parts I and II, the scan results, sampling, and the appendices invisible to it: on a real assessment, most of the document.

It now reads those report sections too. Ask about the Executive Summary, the appendices, sampling, or scan results by name and Cortex works from what is actually saved there. It refers to sections by name — “6.4 Documentation Evidence,” not a bare number — so a report section is never confused with the requirement that shares its number, and an empty section is reported as empty rather than as a raw blank value. Cortex also now works from the most recent messages in a conversation, so a follow-up like “and the one after it” is read against your last few turns rather than the first thing you asked. See Cortex AI.

Every Cortex feature moved off the old model

The model behind Cortex’s drafting, extraction, and analysis features was upgraded. The switch surfaced a class of failures where the newer model rejects a parameter the old one accepted, which had quietly broken several features; those are fixed, and every Cortex feature now runs on the current model.

Evidence remembers who provided it, and one file can back many controls

Each evidence file now records who provided it — the person who uploaded it in the app, or the client contact who submitted it through the portal — shown on the row and carried into the full-page evidence view. And a single file can now be cited against many controls without duplicating it: one firewall export can satisfy several requirements, removing one citation leaves the others intact, and accepting portal evidence links it to the requested control automatically. See Evidence Management.

Reliability and recovery, behind the scenes

Several changes you will not see but will benefit from: the backend now runs as a cluster, so deploys no longer drop in-flight requests. Continuous database backup (point-in-time recovery) cut the worst-case data-loss window from a day to under a minute. Task reminders that had silently stopped firing were fixed. And audit-trail change entries now show what changed — a readable before/after — instead of two raw JSON blobs.

Cortex can find guidance for a specific requirement

Cortex’s knowledge base is meant to answer questions about one control at a time — ask about 1.2.5 and get what your firm’s own material says about 1.2.5. It was not doing that. Every stored passage was filed without the requirement it belonged to, so a question about a specific control searched the whole library instead of the relevant part.

The knowledge base has been rebuilt with each passage tied to its requirement: 250 of the PCI DSS controls are now individually addressable, where before there were four. Answers about a specific control are drawn from the material that is actually about it, rather than whatever reads as similar.

Kliper tells you when a PDF is a scan

A scanned document — printed, signed, and photographed back in — contains no text, only a picture of text. Uploading one used to look like it worked: the file was stored, the analysis came back empty, and nothing explained why.

Kliper now recognises a PDF with no text layer and says so, so you can run it through OCR and upload it again instead of wondering why Cortex had nothing to say about it. Text extraction from evidence has also improved: tables in control matrices, firewall rules, and access reviews reach Cortex as tables rather than as a jumble of words, and repeated page headers no longer eat into the analysis. See Evidence Management.

Document validation rules that were not reaching production

About half the document-validation rules were present in our source but had never been deployed, dating back to March. All 286 are now live, so evidence validation applies the full set of checks rather than the partial one. No action needed on your side.

Guidance for Appendix A controls

Guidance for the Appendix A controls — the additional requirements for multi-tenant service providers and for entities still using SSL or early TLS — was stored in a way nothing could retrieve, so Cortex had no background material when working on them. It now resolves correctly.

Open-source attributions

A new Open Source Attributions page credits the open-source projects Kliper is built on and records the licence each is used under. These are distinct from subprocessors: every component listed runs on our own infrastructure and receives no customer data.

July 2026

Evidence you analyse but never keep

Some clients will not let their documents rest on a third-party platform. Evidence retention is now a per-client setting: leave it on Store uploaded files, or switch to Analyse without retaining, where a file is read once for analysis and the document is never written to storage. The analysis, doctags, and requirement matches persist; the file does not, and its row is labelled Analysed, not stored with download unavailable. Malware scanning and hashing still run first. The trade-offs are deliberate and documented — slower uploads, no retry on a failed analysis, no getting the file back. See Analyse Without Retaining.

Exported ROCs have a truthful table of contents

The page numbers in an exported ROC’s table of contents were inherited from the empty template, so they bore no relation to the document you were holding. They are now generated from the finished document — every entry points at the page it is actually on, for a report of any length. See ROC Report.

The assessment pages work on a phone

A sweep across the assessment workspace at phone width: scoping, the assessment header, milestones, activity, interviews, requirements, and the project backlog. Controls that ran off the edge now stay on screen, filter and tab rows scroll with a visible hint that there is more, sub-requirement tables reflow instead of clipping, and the backlog reads as cards rather than a squeezed table. Nothing changed on desktop.

Scoping questions in four languages

The scoping questionnaire — section names, question labels, and helper text — now follows your language preference in English, French, Spanish, and German, joining the rest of the interface. PCI DSS terms and the answers you record stay in English on purpose: they are quoted verbatim into the ROC and AOC, where the English text governs.

You hear when a client sends evidence

The evidence loop no longer goes quiet at the point that matters. When a client hits Send for Review in the portal, whoever created the request is notified in-app and by email, linked straight to the Evidence tab holding it — no more checking back to see whether anything arrived. See Evidence Management.

Warnings before an allowance runs out

Cortex allowance and storage used to fail silently — you found out at the block. Admins and Managers are now warned once when a workspace passes 80% of either, and told when a plan is about to renew or end, has expired, or has a payment problem. See Billing & Plans.

Security Tools speak your language

The whole Security Tools suite — all 19 tools, their upload panels, filters, table headers, and empty states — now follows your language preference in English, French, Spanish, and German. Scan output stays in English on purpose: findings, CVE text, and vendor or protocol names are quoted verbatim so they match the evidence attached to a requirement. See Security Tools.

Notification preferences you can trust

Every switch on the Notifications tab now genuinely controls delivery. Comments & mentions and Assessment updates suppress their notifications on every channel when switched off, alongside the existing email and in-app channel switches. Four settings that had nothing behind them were removed rather than left as decoration. See Personal Settings.

Cortex keeps your conversation

Closing the Cortex panel no longer discards the thread. Reopen it — even after a page refresh — and your conversation is still there, along with any prompt you had typed but not sent. Resuming costs nothing against your message allowance.

Personal settings that actually apply

The Appearance and Preferences pages were rebuilt so every control does what it says. The theme picker switches Light/Dark/System on click. Language is now a proper selector over the four interface languages (English, Français, Español, Deutsch) — it applies immediately and travels with your account, so emails and notifications arrive in your language. 24-hour time drives the top-bar clock and every calendar time; Start week on Monday reorders all calendar grids; Compact mode sets the assessments board’s default density. Timezone is detected from your device and shown read-only, matching the top-bar clock. All of it is per-user, never per-organization. See Personal Settings.

Cortex on every plan

The hard paywall on Cortex chat is gone: every plan now includes Cortex, metered by a monthly message allowance (Free 50 · Solo 300 · Pro 1,500 · Team 5,000). Write operations meter separately as AI drafts (Cortex write tools + the Section 7 drafter) and AI file summaries — and the first AI analysis of each file is free on every plan. Live meters for all three sit on the Billing page, and hitting an allowance names the plan that raises it. See Plans & Allowances.

An admin console for organization admins

Organization Admins now get their own Organization section of the admin console — Integrations, Activity, Org Analytics, Security, and 2FA Management, all scoped strictly to their workspace. The Security page summarizes failed logins, flagged activity, impersonation sessions, membership changes, and credential & 2FA changes — every number backed by events Kliper genuinely records, including when platform staff accessed the workspace read-only. See Organization console.

Workspace switching, airtight

For users in several organizations, every surface now follows the workspace switcher: Billing, Inbox, Tasks, Calendar, and notifications are scoped to the active organization — no more seeing another workspace’s items after a switch. Comment mentions notify within the right org only.

No more phantom logouts

A full pass over session reliability: rate limiting is now per-client and strictly atomic, a rate-limited or transiently failing auth check can never masquerade as an expired session, and a single misbehaving endpoint can no longer force a false “Session Expired” — the app re-confirms against the session source of truth before signing you out. Sessions also record the signing-in IP address correctly for the active-sessions list.

Skeletons, not spinners

Pages now load with a skeleton of their own layout instead of a centered spinner — the header renders immediately and only the data blocks shimmer. Applied across Integrations, Pricing, Billing, the portal, the engagement editors, and the whole admin console, along with a sweep that fixed cards left half-empty or mismatched in height.

Security hardening pass

A platform-wide security review closed out its findings: trusted-device 2FA binding was upgraded to server-issued secrets, outbound requests to user-supplied URLs are pinned to public IPs at connect time, cross-tenant isolation was audited and tightened across list endpoints, invitation tokens are hashed at rest, and file uploads moved to an extension allowlist. Details of the standing posture live in Security & AI Trust.

Precise AI cost accounting

Every AI call is now recorded in a unified ledger — per organization, user, feature, and tool — with token counts, per-tool latency, time-to-first-token, and an estimated cost verified against the real provider bill to within 0.2%. Cortex also now resolves parent PCI requirements (like “Requirement 8.3”) by summarizing their sub-requirements instead of reporting them as not found.

The export suite: AoC, INFI, and a ROC with appendices

The export modal now produces the full deliverable set: the Attestation of Compliance generated from the same engine as the ROC, Items Noted for Improvement (INFI) compiled from your requirement notes, and the closure-plan XLSX — individually tagged filenames, or one zip. PDF exports gained an identity cover page, an evidence index appendix, and a Cortex advisory appendix; incomplete exports carry a DRAFT watermark on every page. Before generating, deterministic integrity checks catch overall-result contradictions, unknown interviewees, and malformed field values, with jump links to fix each one. See the ROC guide.

ROC import: appendices, form tables, and honest fields

The importer now captures Appendix C and Appendix E worksheets (with a redesigned worksheet editor), the Section 3-6 form tables — contacts, assessor details, scan attestations, sampling — and each executive-summary section as its own reviewable row. A new field-hygiene engine flags malformed dates, placeholder text, and type mismatches inline in the editor, on import, and at the export gate, so bad values surface where you can fix them instead of in the finished report.

Draft from Evidence

In the Section 7 editor, Cortex drafts a finding justification from the evidence you’ve cited — and only from it. Drafts are written in the assessor’s voice, refusals are explained (including cited evidence with no uploaded file), and nothing saves until you accept. Kliper measures accept/discard rates and how much of each accepted draft gets edited, on the admin Cortex dashboard. Cortex chat answers also carry structured citations — the reporting-instruction items and interviewees behind each claim. See Draft from Evidence.

Tag the exact control

Message threads now tag individual controls, not just sections: #1.1.1 chips jump to the precise control, hover cards show the requirement’s title and status (and member photos for @mentions), and both work from the section right-drawer composer — the conversation happens next to the control it’s about. See Collaboration.

Invites that actually onboard

Inviting a teammate now sends a real email with an accept page: a new person sets their password and lands in your workspace already verified — no separate verification round-trip — while someone with an existing account is added instantly and notified. Signup verification itself moved to a 6-digit code with a secure one-click link, admin-created accounts must change their password on first login, and the team list’s Last Active is now per-organization. See Adding Team Members.

Billing you can operate from inside Kliper

Change plan directly from the in-app pricing page (no fresh checkout), and view or download Polar invoices in-app. Under the hood, subscription state is now reconciled against Polar rather than trusting webhook delivery — signature-verified, idempotent, and paid access ending exactly when the paid period does. Billing pages are admin-only. See Billing & Plans.

Quick create for the next assessment

Quick create makes the common case — same framework, another client — a one-screen, two-click operation, remembering your last framework and client. The full wizard stays for report profiles, carry-forward, and QA setup. See Creating an Assessment.

Portal fidelity

Client-portal evidence and ROC exports moved to object storage, portal comments show who actually wrote them, the portal timeline records real activity events, and real user photos now render consistently across the portal, calendar, version history, leaderboards, and assessment lists.

A faster path to a new assessment

The New Assessment wizard now takes you from nothing to a working assessment without detours. Pick an existing client or create a new client inline; if the client has no engagement letter yet, one is auto-provisioned so solo assessors go straight from client to assessment. See Creating an Assessment.

Report profiles — fill Section 1 once

Save your firm details (Settings → Firm profile) and your QSA credentials (Settings → Profile) once, then apply them at creation to pre-fill ROC Section 1 — QSA Company and Lead Assessor blocks — on every assessment. Everything stays editable in the report. See Report profiles.

Carry answers forward (re-certification)

Annual re-certs repeat most of last year’s ROC. Starting a not-first-time assessment lets you carry a prior assessment’s answers forward as a starting point — flagged for re-verification, with Section 1 contact info and dates left fresh, and no QA credit until you touch each carried section. See Carry answers forward.

Pre-QA checks before Send to QA

Sending an assessment to QA now runs deterministic checks first — In Place without evidence, N/A/Not-Tested without justification, undecided controls, and Section 1 date consistency — and lists any issues with jump links before you submit. Overrides are allowed and surfaced to the reviewer. See Pre-QA checks.

Environment-aware Cortex + designated QA reviewer

Set an assessment’s environment scope (cloud, on-prem, hybrid) and Cortex tailors its testing and evidence guidance to it. Assign a QA reviewer at creation and the Send-to-QA hand-off notifies them directly. You can also open scoping immediately after creating an assessment.

Rearrange your clients

Drag client cards in the Engagement Hub into any order you like — the arrangement is saved for your whole organization.

Bring Your Own AI (Enterprise)

Enterprise organizations can now run Cortex under their own AI agreement from Settings > Cortex AI: plug in your own OpenAI API key (requests bill to you and run under your data-processing agreement) or connect your own self-hosted, OpenAI-compatible model endpoint for full data residency. Keys are encrypted at rest, endpoints are security-validated, and a built-in connection test verifies the setup. See Choosing Your AI Provider.

Require 2FA across your organization (Team)

Organization admins can enforce two-factor authentication for every member from Settings > Security — members without 2FA see a blocking enrollment prompt until they set it up. See User Management & RBAC.

Plans now count clients, not assessments

Pricing switched to the unit that actually tracks a firm’s growth: active client engagements. Paid plans get unlimited assessments per client — annual re-assessments, readiness reviews, and gap analyses for an existing client no longer consume quota. Tier features are now enforced in-app (client portal, BAU, review & QA, Cortex Knowledge Base, readiness, and analytics from Pro; SharePoint and org-wide 2FA enforcement from Team), and hitting a boundary shows exactly which plan unlocks the feature — nothing you already created is ever locked away. See Billing & Plans.

Cortex answers in seconds, with receipts

Cortex moved to a substantially stronger model: knowledge-grounded answers now land in seconds instead of minutes, and every reply shows which model produced it and how long it took — in the chat and across conversation history. A stop button cancels generation mid-stream, tables render properly, and the panel footer shows live usage against your allowance. Cortex can also reference any assessment by name from any page (“in the ACME ROC, what’s the status of 8.3.1?”) — org-scoped, read-only. The admin Cortex dashboard gained a Model usage panel with per-model responses, token counts, and estimated cost, backed by accurate token accounting.

Admin console tune-up

A full pass over the admin console: the Server Monitor now collects real CPU, memory, and disk metrics from remote database servers over hardened SSH; Knowledge Base stats report true totals; the Overview’s misleading “security score” was renamed to Account Hygiene and no longer flags the platform critical; and the daily Cortex usage cap no longer counts read-only requests (browsing never burns quota).

Assessment summary, one click

On any assessment’s Progress Status card, Summary PDF exports a branded one- to two-page status snapshot — progress and compliance as distinct numbers, the per-requirement status breakdown, milestone completion, and the open-task backlog. A fast way to keep a client or engagement manager current between formal ROC exports. See the ROC guide.

Progress and compliance, told apart

The assessment Overview now reports two separate numbers instead of one blurred figure: progress (how much you’ve drafted — every requirement with a decision recorded) and compliance (how much is actually In Place). A mostly-drafted assessment with open gaps now reads honestly instead of looking finished — and the Overview, the requirement counts, and the new Summary PDF all agree, because they read the same risk model.

Permissions & Roles — a clear read-only reference

Settings > Permissions & Roles is now an honest read-only reference for Kliper’s five built-in roles (Admin, Manager, Assessor, QA, Viewer): a Roles tab showing what each role carries and the full Permissions catalog by category. You assign one of the five to each member — the roles are fixed and enforced by the platform. See User Management & RBAC.

A smoother first run

New accounts get a cleaner path into their first workspace: the onboarding welcome screen no longer flashes a spurious “session expired” prompt, and the app returns tidy responses instead of errors while you’re still setting up your organization.

Under the hood — security & reliability

Ongoing hardening: stricter multi-tenant isolation across list and file endpoints, safer parsing of uploaded spreadsheets, and dependency security updates. No action needed.

Readiness — score a client’s maturity before the ROC

A new Readiness Assessment runs a short, interview-based maturity review before the formal engagement. Score each control 0–5 (Non-existent → Optimized) while you talk — keyboard-first, with a live compass showing overall maturity, the weakest domain, and coverage as you go. Closing the session locks the scoring and produces a one-page gap-to-green report: overall posture, per-requirement domain scores, a requirement × dimension maturity matrix, and ranked levers, each with the concrete next action you authored to raise it. Scoring is deterministic and assessor-driven, not an AI guess — and it’s the engine behind the Cyber Pulse free tier. See the Readiness & Maturity guide.

BAU — run each client’s standing PCI program

Compliance between assessments is now a first-class surface. The new BAU tab (first tab on every client page) seeds 32 recurring activities straight from the standard’s mandated frequencies — daily log reviews to annual pen tests — each with an owner, cadence, and completion history:

• Three lenses: Activities (cadence groups, overdue pinned on top), Owners (unowned first), and a living Register whose entries open automatically when an activity crosses its due date and close themselves when it’s marked done.
• Client portal execution — a new Recurring tasks page where the client team sees their own tasks bucketed by urgency and marks them done with a date, note, and evidence reference.
• Daily email reminders — owners with a portal email get one digest when tasks become due soon or overdue; each task nags once per state per cycle, never every morning.

See BAU & Recurring Compliance.

Evidence Coverage — does every finding have proof behind it?

The Evidence tab gained a Coverage view that audits the control → evidence-tag → artifact chain: Backed controls whose cited tags resolve to registered evidence, Dangling citations pointing at nothing, and No proof findings that cite no evidence at all. Three lenses — by control, by tag, and a citation Matrix — plus a cross-link from Gap Analysis. See Evidence Coverage.

QSA guidance inside every control

The requirement editor now renders validated reference content on all 250 PCI DSS v4.0.1 controls — a Guidance accordion (purpose, good practice, Azure/AWS cloud guidance, copyable response templates) and a per-testing-procedure How to test strip with expected evidence tags, validation steps, sampling procedures, and assessment questions. Static, verbatim content — not AI paraphrase.

The scoping questionnaire, rebuilt

Scoping now runs on a 62-question questionnaire mirroring the official ROC scoping interview, with live, suggest-only applicability suggestions: the Scoping Insights card proposes Not-Applicable controls based on official SAQ criteria, shows the provenance of every suggestion, detects conflicts with findings you already recorded, and never changes anything without your say. Answers autosave; the final button is an explicit Save & Continue. See the scoping guide.

Editor quality-of-life

• Requirement priorities — tag requirements High / Medium / Low from the toolbar as your personal triage lens, independent of the PCI milestone.
• N/A cascade — setting a control Not Applicable fills its empty testing-procedure responses with “Not Applicable.” (reversibly; typed content is never touched).

Your Workbench went live

The Workbench — your role-aware landing page — now runs on real, live data instead of placeholder numbers:

• Priority queue of what needs your attention next, with sortable columns and an estimated time-to-clear.
• Stat strip — Engagement, Progress, Reqs drafted (today / this week), Open gaps, Awaiting client, Cortex queue, and Days to deadline — all computed from your actual data.
• Coverage heatmap and Open gaps broken down by real risk severity across the defined-requirement set.
• Active engagement, Next up (from your calendar), and a Recent activity feed.
• Live team presence — see who’s online and where they’re working across the org.
• A persistent gap registry with stable IDs and a per-gap owner / ETA.

See the Workbench guide.

Security Tools — a dedicated workspace page & link-to-requirement

The security tools moved out of the assessment-only view into their own Security Tools page in the workspace sidebar — a scan factory for running and managing scans across all your clients in one place.

• Focused shell — on the Security Tools page the sidebar becomes the tool list itself (Assessment Tools + Threat Intelligence) with a Back to workspace link, so there’s one clean navigation column instead of a page-within-a-page.
• Link to requirement — run a scan on the global page, then attach it as evidence to any assessment you have access to. Each tool applies to its canonical PCI DSS requirement (SSL/TLS → 4.2.1, ASV → 11.3.2, CVE → 6.3.1, and so on). Inside an assessment, the one-click Apply to Req X works exactly as before. Linking is permission-checked — you can only apply to assessments in your workspace that you can access.
• Collapsible Library — the Library sidebar group (Evidence Library, Reports, ROC Library) is now a collapsible section to free up vertical space.

See the Security Tools guide.

Evidence Library, redesigned

The Evidence Library got a cleaner layout for browsing and managing evidence across the workspace. Cloud-imported files now carry a small source badge — Google Drive, SharePoint, Confluence, or Jira — so you can see at a glance where each file came from.

One executive summary across PDF and Modern views

An assessment’s executive summary now renders identically in the PDF and Modern report views — the two differ only where they should: the requirements table and appendices. No more drift between the two.

A two-stage QA review workflow

Assessments now move through a two-stage quality gate. Reviewers QA individual requirements as they’re finished — submit from the sections editor, then Approve or Send back (with a note) from the Reviews page — and a final assessment sign-off completes the whole thing at the end.

• Requirement QA panel on the Reviews page — a funnel per assessment (drafted → in review → sent back → done), a reviewer queue with a per-requirement completeness stat (N/M TPs answered), and a “sent back to you” list.
• Status chips (In review / Sent back / QA done) on every requirement card, with the reviewer’s note inline; send-backs notify the assessor with a deep link.
• Connected sign-off — the final sign-off row shows the per-requirement QA rollup (N/total QA-approved) and its button only lights up once the granular QA is done. It warns before signing off an assessment whose requirements haven’t all been reviewed.
• Drift guard — editing an approved requirement resets it to drafted, so QA done always reflects the reviewed content.

See the QA Review Workflow guide.

Security Tools — choose input from the evidence library

Every file-parsing security tool can now source its input from a file already in the platform instead of a fresh local upload. Click or choose from evidence library under the drop zone to browse any assessment in your workspace, search by filename, and pick a file — it imports in one step. Works the same on the global Security Tools page and inside an assessment.

See the Security Tools guide.

Workbench metrics — coverage/evidence lenses, drafting pace & more

The Workbench dashboard gained several live metric upgrades:

• Coverage | Evidence lens — flip the coverage card between compliance findings and evidence readiness (which requirement areas are blocked on client evidence), each as a heatmap with grid and by-requirement views.
• Drafting pace — requirements drafted in the last 7 days with a trend arrow, plus an honest projection against the QA milestone.
• Tab-aware priority-queue footer — the queue footer now shows the shape of the active tab (evidence, gaps, or TP-review counts) right where the items are.
• Recent activity filters — filter the activity feed by All / You / Cortex, with a cleaner show-more (scrolls in place) and a separate expand control.
• QA review tile for reviewers, escalating in color as the QA milestone approaches.

See the Workbench guide.

Also this month

• Snappier UI — optimistic status toggles on tasks and the assessments board, plus hover-intent prefetch on assessment lists.
• Sections navigation fix — returning to an assessment’s sections now lands you back in the group you were last in (Requirements / Appendices), instead of showing Executive Summary while the sidebar highlighted a different group.
• Role-aware Admin console — /admin is now a role-aware console, and the sidebar’s bottom card is a full user menu (Account, Billing, Notifications, Documentation, Changelog, Log out).
• Security hardening — RBAC is now enforced across every client, engagement, assessment, evidence, and task mutation (and security-tool runs); auth endpoints gained rate-limiting and brute-force protection; write endpoints are validated with Zod; and file uploads are hardened (content-type checks, zip-bomb bounds, fail-closed anti-virus).

June 2026

Enterprise SSO (OIDC)

Kliper now supports enterprise single sign-on over OpenID Connect — Okta, Microsoft Entra ID, Auth0, Google Workspace, and any standards-compliant OIDC provider. Login is identifier-aware (users on an SSO domain skip the password field), new users are just-in-time provisioned, and MFA is handled by your identity provider. Setup is arranged with the Kliper team.

See Enterprise SSO.

Integrations hub — Slack, Teams, Jira, Odoo, SharePoint & more

A dedicated Admin → Integrations area to connect the tools your firm runs on:

• Microsoft Teams notifications (new), alongside Slack
• Odoo ERP — push clients to CRM, push tasks to Projects, create invoices from LOEs, and import contacts
• SharePoint / OneDrive document access
• plus Jira, Google Drive, Google Calendar, Git providers, and custom webhooks

Management is role-gated: admins set up connections, admins and managers use them.

See Integrations.

Clients can import evidence from SharePoint

In the Client Portal, clients can now attach evidence straight from their SharePoint / OneDrive (read-only, virus-scanned), alongside Google Drive, Confluence, and Jira.

See Client Portal.

Guided onboarding checklist

New organizations get a Get started checklist on the dashboard — add a client, create an LOE and your first assessment, connect your tools, and invite your team. It tracks real progress and disappears once you’re set up.

ROC import, guided export, and a versioned ROC Library

The full ROC document lifecycle landed this month.

• Import an existing ROC — pre-fill an assessment from a prior ROC DOCX (PCI DSS v4.0 or v4.0.1, auto-detected). Already-answered requirements are skipped by default, with opt-in Overwrite per row. From the assessment Overview → Import existing ROC.
• Guided export modal — pick deliverables (ROC, plus the optional Closure-plan XLSX) and format (PDF or DOCX, zipped when you export more than one). A completion check flags unfinished sections first, and incomplete exports are labelled DRAFT.
• ROC Library — every export is archived as an immutable version per engagement (browse by assessment or by client, with Final/Draft status, preview, and download). Reachable from ROC Library in the sidebar.
• Live completion tracking — sidebar status dots and per-subsection / per-requirement counters show exactly what’s left, counting sensibly (a table or a checkbox group counts as one unit).

See the ROC Report guide.

Personal calendar sync

• Add to my calendar on any event — download an .ics (Apple Calendar, Outlook, Google) or Connect Google to add it straight to Google Calendar
• Bulk export your upcoming events as a single .ics
• Per-user Google Calendar sync — each team member connects their own account; an expired authorization prompts a reconnect instead of silently failing

See Tasks & Calendar.

New pricing, billed through Polar

• Plans are now Free / Solo / Pro / Team / Enterprise with public pricing, framed per client (assessments) and per assessment (DOCX exports)
• Checkout and billing moved to Polar as Merchant of Record — Polar handles cards, invoicing, and tax/VAT; card data never touches Kliper
• SSO / SAML and white-label reports are clearly marked Coming soon on the plans where they’ll appear

See Billing & Plans.

Redesigned LOE wizard

Creating and editing a Letter of Engagement now share one full-width, 7-step tabbed wizard (Details → Signatures) with a pinned Back/Next/Save bar — and you can import an existing LOE from a PDF to pre-fill it. See Client & Engagement Management.

Cortex review, triage & closure plans

Cortex now reviews your work, not just drafts it.

• CRESS reliability scoring replaces self-reported confidence — every verdict gets a 0–100 score and a band (Reliable / Review advised / Verify manually)
• Advisory finding-review layer on the Risk and Gap views, with dismiss/restore — advisory only, it never changes your deterministic scores
• /cortex triage queue — every open flag and untasked draft plan across all your assessments, filterable by effort and priority
• Closure plans — turn gaps into a remediation plan (why / steps / evidence / effort) and create tasks from it
• Scoping interview — describe your environment in plain text and Cortex extracts grounded Yes/No/Pending answers for the scoping questions

See Cortex AI.

Gap & Risk views redesigned

• Gap analysis is now a master-detail navigator — a requirement rail with open-gap counts and a readiness ring, plus per-subsection gap-closure cards
• Risk scoring is a collapsible explorer, grouping sub-requirements by subsection with expand/collapse all

See Gap & Risk Analysis.

Evidence review workflow + Nudge client

• Review submitted evidence with Accept / Request changes / Waive — each shows its consequence, writes to the audit log, and emails the client where relevant
• Nudge client emails a reminder for any still-open request

See Evidence Management.

Client Portal is now a separate app

The client portal moved to a dedicated app at portal.kliper.dev — clients open it from their invite link, and the in-app link opens it in a new tab. Invites now show a scope strip and offer email or copy-link delivery (reusable, email-locked, 30-day). See Client Portal.

Sessions, user management & security tools

• NIST AAL2 session profile — 8-hour rolling sessions, 12-hour absolute cap, 30-minute idle logout
• Create user (formerly “Invite people”) provisions an account directly with an auto-generated or admin-set password
• Security tools Port Scanner, Headers & DNS, Cloud Posture, and Dark Web OSINT are now Enterprise-gated

Data exports

The Reports page generates assessment-summary, evidence-inventory, and audit-trail exports as styled Excel or CSV. See ROC Report → Data exports.

May 2026

Trust Center

A new Trust Center at app.kliper.dev/trust brings every artifact we publish about our security posture into a single landing surface — status page, security architecture, subprocessor list, third-party scanner grades, vulnerability disclosure address, data protection commitments, and audit-export documentation.

• Honest framing — explicitly calls out what we don’t have yet (no SOC 2 certification, no bug bounty program) and points to the independent verification we do have in lieu of those programs
• Every claim is linked to evidence — SSL Labs A+, Internet.nl 95%, securityheaders.com A grades all link to the scanner’s live report, not a static screenshot
• Public — no auth required — buyers and security reviewers can reach it without signing up

Audit log export endpoint

Administrators can now export the full audit trail as CSV or JSON via /api/admin/audit/export. This is the canonical endpoint for SOC 2 evidence requests and external audit queries.

• Filters — date range (default 90 days, max 365), action, entity type, user, and organization (super admin only)
• Org scoping — regular org admins are restricted to their own org’s logs automatically
• Row cap — 100,000 rows per response with truncation warning if exceeded
• RFC 4180 CSV escaping — JSON old_value / new_value columns are serialized and quoted correctly so the file imports cleanly into Excel, Sheets, or csv.reader

See the Admin Dashboard guide for the full parameter list.

Subprocessor list published

A new Subprocessors page lists every third-party service that processes Kliper customer data, what each one receives, and the processing region. This page is the authoritative record referenced by our DPA.

• Active subprocessors documented — OpenAI, PostHog, Sentry, VirusTotal, Stripe, Cloudflare, BetterStack
• Service providers without customer data — Mintlify (docs), GitHub (source code)
• Own infrastructure listed for transparency — Postgres, Supabase (self-hosted), Redis, SMTP, optional on-prem Ollama for Cortex
• 30-day notice commitment — customers under a DPA receive written notice before a new subprocessor receives their data

Product analytics (PostHog)

Anonymous product analytics are now enabled to help us understand which features are used and where users get stuck. Implementation is privacy-first by design.

• EU region — events sent to eu.i.posthog.com for data residency
• No session recording, no autocapture — explicitly disabled at the SDK level
• Minimal event schema — event names plus a pseudonymous user ID, organization ID, and aggregate properties (e.g. file size bucket, framework ID). Never file content, file names, requirement text, or message bodies.
• Disabled outside production — no events fire from local development or test environments

See the Subprocessors page for the full data flow.

April 2026

Cortex — Full Tool-Calling Agent

Cortex has graduated from a single-shot autofill assistant into a full agentic loop. It can now perform multi-step reasoning, call tools in sequence, and write directly to the assessment without leaving the chat.

• 15 tools available — requirement lookup, assessment reads, answer writes, TP detail writes, evidence queries, task creation, calendar events, scoping data, firm knowledge search, and PCI guidance search
• Multi-step execution — Cortex iterates: read context → call tool → read result → decide next step → respond
• Direct writes — “draft a justification for 1.2.6 and save it” now actually saves it; the form refreshes live without a reload
• PII redaction — all knowledge base ingestion and tool context runs through a redaction layer (IPs, emails, credit card numbers, SSNs) before the model sees it
• Status indicators — the old “Cortex is thinking…” is replaced with descriptive labels (“Looking up requirement 1.2.6”, “Writing TP response for 1.2.6.b”, “Scanning all requirements status”) so assessors can see what Cortex is doing at each step
• Analyzing → Drafting phases — the UI distinguishes the initial reasoning phase, the per-tool execution phase, and the final response drafting phase

See the Cortex AI guide for the full tool list and behavior.

Knowledge Base & RAG Infrastructure

The underlying pipeline for ingesting firm data into Cortex is now built and wired. Firms can upload past ROCs, AOCs, meeting transcripts, and accepted evidence; Cortex can search across them when drafting.

• Document ingestion — PDF, DOCX, TXT supported via dedicated extractors
• Chunking by PCI requirement — text is split into semantic chunks keyed to requirement IDs so retrieval is targeted
• Embedding — chunks are embedded via OpenAI text-embedding-3-small and stored in Postgres with pgvector
• PII redaction on ingest — sensitive data is redacted before embedding, with a per-job count surfaced in the admin UI
• Per-org isolation — every chunk is scoped to the uploading organization; semantic search never crosses tenant boundaries
• Admin UI — upload, monitor ingestion progress, and see PII redaction counts from the Knowledge Base panel
• New tool: search_firm_knowledge — Cortex can now retrieve grounded context from your firm’s past work during drafting

Interview Sessions with Cortex Analysis

Interviews are now first-class objects in the platform, with a dedicated session page for conducting, recording, and analyzing interviews.

• Dedicated session page — each interview has its own route with a sortable, drag-and-drop question table and per-question response fields
• Collapsible sections — questions grouped by PCI DSS section with expand/collapse per group
• Cortex analysis — at the end of a session, Cortex generates a structured analysis of the interview responses, tied back to specific requirements
• PDF export — full interview sessions export to PDF for evidence submission or QA review
• Interviews tab in Assessment Hub — new top-level tab lists all interviews scheduled or completed for an engagement
• Transcript import — paste a meeting transcript to seed interview responses

Atlassian Confluence & Jira Integration

Kliper now connects directly to Atlassian products for both evidence collection and gap remediation.

• Confluence (client portal) — clients connect their Atlassian account via OAuth and attach pages directly from their Confluence spaces as evidence. Pages are imported as PDFs.
• Jira (assessor side) — link Jira issues to specific PCI DSS requirements to track remediation. Supports creating issues, searching by JQL, and syncing status.
• Dual display fix — the Jira integration panel now shows either the OAuth flow or the CSV import section, never both at the same time

Focus Mode & Live Mode

Two new viewing modes for the assessment workbench give assessors control over their working context.

• Focus Mode — full-width single-subsection view with prev/next navigation. Sidebar hidden for distraction-free work on a single requirement.
• Live Mode — real-time presence indicator showing which team members are currently viewing the assessment. Live status is displayed in the top bar.
• Compact section rows — when a finding status is set, the row collapses to a single status chip. All four options only appear when no finding is set yet.
• Compact hub stat cards — reduced padding, icon size, font size, and progress bar height on the Assessment Hub stat cards

Resume Card on Dashboard

The dashboard now remembers where you left off and offers a one-click resume.

• localStorage tracking — the last subsection you worked on is tracked per-assessment in the browser
• Resume card — appears on the dashboard with the assessment name, specific requirement label, and a “Continue” button that takes you to the exact subsection
• Strict matching — the card only appears when localStorage has a confirmed match; no arbitrary “in progress” fallback

Interviews Tab in Assessment Hub

The Assessment Hub now has a dedicated Interviews tab listing all interview sessions for the engagement — scheduled, in-progress, and completed — with quick links into each session page.

PCI DSS Multiselect for Scoping

The “applicable requirements” textarea on client engagements has been replaced with a PCI DSS top-level multiselect. Assessors pick from the 12 principal requirements directly instead of typing them free-form.

Google Drive File Picker in Client Portal

Clients can now attach evidence directly from their Google Drive without downloading and re-uploading files.

• OAuth flow — one-time authorization to grant Kliper read-only access to the client’s Drive
• File picker — native Google Drive picker filters by file type
• Cross-origin session fix — the portal now uses fetch-based downloads to include session cookies across origins, so cross-tenant auth works without a full page reload

CSV Table Preview in File Viewer

CSV and spreadsheet files now render as a proper table in the assessor file viewer and the client portal — no more forced download to read evidence.

• Table view with column headers
• Works in both portal and assessor contexts
• Complements existing PDF preview (via blob URLs)

Client Portal — Mobile Responsive

The full client portal (login, verify, dashboard, request list, request detail, messaging) now works on mobile screens. Tables collapse to stacked cards, actions move to overflow menus, and touch targets meet accessibility minimums.

Main Branch Protection

Direct pushes to main are now blocked without authorization, enforcing the pull-request workflow for all changes.

Bug Fixes

• Cortex writes & form refresh — Cortex justification and TP writes now correctly save to the database and refresh the assessor’s form without requiring a reload
• pci_requirement column — added to assessment answers so requirement-level data has a dedicated column instead of living inside JSON
• csrfFetch consistency — file delete, autofill suggestions, file preview, and file download all use csrfFetch to include CSRF tokens and the x-organization header correctly
• PDF preview in portal — works cross-origin via blob URLs; CSP updated to allow blob: in frame-src
• Client file delete — clients can delete any unsubmitted file on their own request, not just files they uploaded themselves
• Confluence spinner merge — connection check and page load now share a single spinner instead of flashing twice
• Cortex spinner alignment — loading spinner in the analysis sidebar now vertically centered
• TDZ fix in assessment sections — moved a useEffect referencing structure to after its declaration
• Resume URL param — now uses sub (subsection) instead of section
• Auth session IP column — changed from inet to text to support proxied IP formats

March 2026

Sidebar Redesign

The main navigation sidebar has been reorganised to keep all controls in one place and keep the top header uncluttered.

• Collapse button — moved inside the sidebar footer, labelled “Collapse sidebar” / “Expand sidebar” with a directional icon. Collapses to an icon with a tooltip in narrow mode.
• Search (⌘K) — moved into the sidebar header, directly below the org switcher. Styled as a search input with the ⌘K shortcut badge. Collapses to a search icon in narrow mode.
• Resources — Documentation and Changelog links moved into the sidebar under a Resources section, pinned to the bottom of the nav list.
• Header cleaned up — the top bar now contains only breadcrumb navigation on the left and action icons (notifications, Cortex, settings, user) on the right.

Evidence Requests — Grouped by Assessment

The Evidence Requests panel now organises requests into collapsible sections, one per assessment. Each section header shows the assessment name, total request count, and summary badges (accepted / open) so assessors can see progress at a glance without opening every group.

• Sections expand and collapse individually
• All sections open by default
• Badge counts update live as request statuses change

Email System Redesign

All platform emails have been redesigned with a clean, minimal layout — no gradients, no emoji, consistent Kliper branding with a blue logo visible in both light and dark mode.

• Provider — switched from Mailcow SMTP to Resend for improved deliverability and monitoring
• Templates redesigned — evidence invitation, magic link, task assigned, task due reminder, assessment due reminder, @mention notification, welcome email, email verification, password reset, and OTP
• Dark mode compatibility — logo uses brand blue (#2346dd) which remains visible on both light and dark email backgrounds

Client Invite Improvements

• Duplicate invite detection — re-inviting an existing client to the same assessment reuses the existing link and shows an “Already invited — link reused” confirmation instead of creating a duplicate
• Job title — now saves correctly for both new and returning clients, and displays on the invited clients list below the client name alongside last seen date

Client Portal for Evidence Collection

A dedicated, secure portal where clients can view evidence requests, upload files, and communicate with assessors — without needing a full Kliper account.

• Magic link authentication — passwordless login via email, no credentials to manage
• Dashboard — summary cards (total, open, accepted, changes requested) with progress bar and per-assessment breakdown
• Evidence request list — sortable, filterable table with status badges, priority levels, due dates, and file counts
• Request detail page — view full request description, upload evidence files with progress indicator, submit for review, and exchange messages with the assessor
• Client invitations — invite clients from the Evidence tab or Engagement Hub with name, email, company (auto-detected), and job title fields
• Dark mode support — all portal pages (login, verify, dashboard, requests, detail) support light and dark themes with system preference detection

See the Client Portal Guide for full documentation.

Evidence Request Templates

56 pre-built PCI DSS evidence request templates covering all 12 principal requirements, enabling assessors to create requests in seconds instead of filling forms from scratch.

• Template picker — “New Request” opens a chooser (Custom Request vs From Template), then routes to the appropriate form
• Bulk creation — select multiple templates, optionally override priority and set a shared due date, then create all at once
• Search and filter — search templates by title, requirement number, or description with category grouping
• Full PCI DSS coverage — templates for firewall configs, network diagrams, encryption policies, access reviews, vulnerability scans, penetration tests, and more

Sort by Requirement Number

Evidence requests can now be sorted by PCI DSS requirement number on both the assessor Evidence tab and the Client Portal requests page.

• Toggle button cycles through default → ascending → descending
• Uses natural numeric sorting (1.9 sorts before 1.10, not after)

Public API with Rate Limiting

RESTful public API for programmatic access to Kliper data, secured with API key authentication and Redis-backed rate limiting.

• API key management — generate, revoke, and manage API keys from the Integrations page
• Rate limiting — 60 requests per minute per API key, enforced via Redis sliding window
• Endpoints — assessments, clients, evidence requests, and organization data

Custom Webhook Integration

Webhook integration with HMAC-SHA256 request signing for secure event delivery to external systems.

• Event types — assessment status changes, evidence request updates, and more
• HMAC signing — every webhook payload is signed with a shared secret for verification
• Delivery tracking — view delivery status and retry failed webhooks

Git Provider Integration

Connect Git repositories (GitHub, GitLab, Bitbucket) to assessments for automated evidence collection from version control.

• Multi-platform adapter — unified interface across GitHub, GitLab, and Bitbucket APIs
• Evidence attachment — link repository artifacts (commits, branches, configs) directly to evidence requests

Raycast Extension

Raycast extension for quick access to the Kliper public API, enabling keyboard-driven workflows for power users.

Integrations Hub — Slack, Google Drive, SharePoint, Jira, Google Calendar

Five new third-party integrations accessible from the Integrations page, enabling assessors to connect their existing tools with Kliper:

• Slack — per-organization webhook integration for posting notifications to Slack channels
• Google Drive & SharePoint — OAuth-based cloud file import, allowing assessors to browse and attach evidence files directly from Google Drive or SharePoint without downloading and re-uploading
• Jira — create Jira issues from assessment findings, link existing issues to requirements, and sync status bidirectionally
• Google Calendar — connect Google Calendar with a calendar picker, sync assessment milestones and deadlines as calendar events

Assessment Response Templates

Three-source template picker for assessment workbench responses, enabling assessors to populate findings and testing procedures faster:

• From previous assessments — reuse responses from completed assessments for recurring clients
• From Cortex AI — AI-generated suggestions based on requirement context and uploaded evidence
• From saved templates — organization-wide response templates for common findings

Assessment Workbench Redesign

Redesigned assessment panels with compact headers, inline Cortex AI chat, and auto-expanding message composer. Audit trail and activity log components rebuilt with modern card layout, collapsible filters, and per-user action breakdown.

Page Layout Standardization

Standardized all page layouts across the platform to a consistent pattern — flex column with fixed header and scrollable body. Affected pages include Engagement Hub, Calendar, Client Files, Project Files, Profile, and all sub-pages. Consistent button sizing (h-8/sm), input heights, and dropdown styling applied platform-wide.

Kliper v2 Branding

New Kliper symbol and logo deployed across the platform, documentation portal, and favicon. Framework logos updated to locally hosted SVGs for faster loading and consistent rendering.

Admin Dashboard & User Management Improvements

• Admin dashboard restructure — reorganized admin layout with dedicated tabs for Cortex analytics, usage metrics, and system health
• Users table actions dropdown — bulk actions menu on the user management table for role changes and account operations
• Collapsible filters — activity log and audit trail filters now collapse into a compact bar, expanding on demand
• User Management & 2FA table cleanup — modernized table styling with consistent spacing and alignment

Session Stability Fix

Fixed an issue causing random logouts during active sessions. Sessions now persist reliably across navigation and background tab activity.

Performance & Cleanup

• Batched file stats — file metadata requests are now batched to reduce API calls on pages with many files
• Production cleanup — removed all debug console.log statements from production code
• Cortex calendar lookback — expanded from 30 days to 365 days for comprehensive event context

Cortex AI — Unified Persistent Panel

Cortex is now a single global panel accessible from any page via the navbar, replacing the three separate chat panels (assessment, calendar, inbox). Conversations are database-backed and persist across sessions, browser refreshes, and devices.

• Persistent conversations — all chat history stored in PostgreSQL with auto-generated titles and conversation list
• Context-aware — automatically adapts to the current page (Assessment, Calendar, Inbox, or General) with fresh data retrieval per message
• Conversation management — browse, resume, and archive past conversations with context badges showing where each started

Cortex AI — Evaluation & Safety System

Three-layer safety check system that validates every AI response in assessment context against known-good PCI DSS reference data:

• Requirement reference validation — extracts requirement numbers from responses and checks against 267 valid PCI DSS v4.0.1 requirement IDs. Flags fabricated requirements (e.g., “3.9.7” doesn’t exist)
• File/evidence citation validation — checks file references against actual uploaded assessment files in the database. Flags references to non-existent files
• Document validation tag validation — checks document tags (DOCFW, EVDFW, etc.) against 93 known tags from the ROC template. Flags potentially fabricated tags
• Safety notices — when any check fails, a warning is appended to the response with specific details about what was flagged
• Message ratings — thumbs up/down on any Cortex response for quality tracking
• Autofill tracking — tracks when assessors accept AI-generated findings suggestions

Cortex AI — Token Usage & Cost Tracking

Every Cortex AI response now records prompt tokens, completion tokens, and model used. Cost is estimated automatically using published OpenAI pricing.

• Token Usage card — total estimated cost, token count, and responses tracked for the selected period
• Per-model breakdown — cost and token stats split by model (e.g., gpt-4o vs gpt-4o-mini)
• Per-user cost — estimated cost column in the Usage by User table, calculated from each user’s token share
• Daily activity date labels — chart bars now show date labels (e.g., “Mar 14”) for clear day-by-day visibility

Cortex Analytics Dashboard

Admin dashboard providing real-time metrics on Cortex AI usage across the organization:

• Satisfaction rate, autofill acceptance, conversations, rating coverage, safety checks, and token usage cards
• Safety check pass rate with validated/flagged response counts
• Message rating breakdown (positive/negative) with per-user drill-down
• Context distribution and autofill by type (template vs Cortex AI)
• Daily chat and autofill activity charts with date labels
• Per-user table with conversations, messages, ratings, autofill, tokens, estimated cost, and last active date
• Recent negative ratings feed for quality review

Cortex AI — Content Moderation

Four-tier content moderation system applied to all Cortex endpoints (unified and legacy):

• Frustration handling — when users vent at Cortex (“you’re useless”), it acknowledges briefly and redirects to helping rather than lecturing or refusing
• Off-topic deflection — non-IT topics (politics, sports, creative writing) are politely declined with a scope reminder
• Prompt injection defense — attempts to override instructions, extract system prompts, or change Cortex’s persona are refused without acknowledgment
• Harmful content refusal — threats, hate speech, illegal requests, and unauthorized data access attempts receive a firm refusal

Export UX Improvements

• Loading toast feedback — ROC exports now show a loading spinner toast (“Generating Word export…”) that updates in-place to success or error, replacing the silent wait
• LOE export dropdown — assessments table in LOE detail page now has a dropdown menu with Export ROC (PDF), Export ROC (Word), and placeholder AOC options
• Dismissible toasts — all toasts across the platform now have a close (x) button for manual dismissal

Database Connection Fix

Replaced 97 separate PrismaClient() instances with a shared singleton, fixing PostgreSQL connection pool exhaustion that caused 500 errors on exports and other DB-heavy operations. Idle connections dropped from 97 to 10.

UI Consistency & Polish

Comprehensive pass across the platform to standardize visual identity and eliminate browser-native dialogs:

• Standardized page headers — all remaining pages (Permissions, Profile, Billing, Integrations) now use the shared PageHeader component with consistent icon, title, and subtitle layout
• Skeleton loaders — replaced all loading spinners with skeleton loaders that mirror actual page layouts for a smoother perceived loading experience across Files, Analytics, Inbox, Calendar, Billing, Workbench, and Profile pages
• Shared EmptyState component — consistent empty data views across all list pages with contextual icons and descriptions
• Native alert() removal — replaced all 30+ browser alert() calls with the app’s toast notification system (showToast) across 18 files
• Native confirm() removal — replaced all 13 browser confirm() dialogs with styled shadcn AlertDialog via a reusable useConfirmDialog hook across 13 components, with support for destructive variant styling

Client Delete with Deactivate Option

The client detail page now offers two removal options when clicking the delete button:

• Set as Inactive — hides the client from active views while preserving all data (LOEs, assessments, files). The client can be reactivated later
• Delete Permanently — removes the client and all associated data. Blocked if the client has active LOEs

Task & Cache Reliability Fixes

Fixed critical issues preventing task creation, deletion, and status updates from reflecting in the UI:

• Redis cache invalidation — the cache invalidation function was a stub that logged but never deleted keys. Now properly scans and removes matching cache entries after every task create, update, and delete
• CSRF protection — added csrfFetch to all mutating requests (POST/PUT/PATCH/DELETE) in tasks, permissions, and integrations services
• Field name mismatch — fixed organizationId (camelCase) vs organization_id (snake_case) mismatch that caused 400 errors when creating roles and integrations

Cortex AI Chat — Data Accuracy Overhaul

Complete rewrite of the Cortex chat data pipeline to eliminate hallucinations and ensure accurate PCI DSS assessment data retrieval:

• Model upgrade — switched from DeepSeek to GPT-4o for higher accuracy and instruction-following. Model name now displayed dynamically in the chat header
• Fixed requirement data matching — findings and justification keys now use suffix-based matching instead of prefix-based, preventing cross-requirement data leakage (e.g., requirement 1.1.1 no longer shows data from 1.1.2)
• Fixed testing procedure mapping — TP keys now matched by exact dotted ID after the dash delimiter, eliminating false matches across requirements
• Framework-aware TP display — Cortex merges saved assessment data with the canonical PCI DSS v4.0.1 framework template, so unsaved testing procedures appear as “not started” rather than being omitted entirely
• Correct PCI DSS hierarchy — testing procedures (e.g., 1.2.4.a, 1.2.4.b) and reporting instructions (array elements within each TP) are now labeled with correct terminology
• Follow-up question support — requirement context is preserved across conversation turns by scanning the last 3 user messages for requirement IDs
• LLM debug logging — full request/response logging to cortex-llm.log for troubleshooting

Standardized Alert UI

Extended the shadcn Alert component with 3 new variants (warning, success, info) and replaced custom Tailwind-styled alert divs across auth pages, workbench, and assessment views for consistent styling with dark mode support.

Threat Intelligence Suite — 5 New Security Tools

Five new threat intelligence tools added to the Security Tools panel, bringing the total to 20 integrated tools:

• CVE Lookup + EPSS Enrichment (Req 6.3) — every CVE result is now enriched with FIRST EPSS exploit probability scores and percentile rankings, enabling risk-based prioritization beyond CVSS severity alone
• CISA KEV Tracker (Req 6.3, 11.3) — search and monitor CISA’s Known Exploited Vulnerabilities catalog with stats dashboard, keyword/CVE search, recent additions (90 days), ransomware-linked filter, and top affected vendors breakdown. Data sourced via NVD API with CISA extension fields
• Secret Scanner (Req 6.2, 6.3) — scan public Git repositories for leaked secrets using Gitleaks. Detects API keys, tokens, passwords, and private keys across full commit history. Findings grouped by rule with file path, commit hash, author, and masked secret
• Credential Leak Monitor (Req 8.3, 8.6) — check domains and company names against the Have I Been Pwned breach database. Includes breach stats, domain check, company search, recent breaches, and largest breaches views
• Threat Briefing (Req 6.3, 11.3) — aggregated threat intelligence from NVD (critical CVEs), CISA KEV (exploited vulnerabilities), FIRST EPSS (top exploit probabilities), and HIBP (recent breaches). Configurable time range with deduplicated, severity-sorted results

See the Security Tools Guide for full documentation.

Security Tools Suite — 15 Integrated Tools

Five new security tools added to the Assessment Workbench, bringing the total to 15 integrated tools with sidebar navigation:

• Payment Page Script Monitor (Req 11.6.1) — live-scan payment page URLs to extract all scripts and verify SRI integrity hashes and CSP headers, or import a CSV script inventory with approval status. Addresses the brand-new PCI DSS 4.0.1 requirement for payment page script monitoring
• Firewall Rule Analyzer (Req 1.2.5, 1.3) — upload iptables, Cisco ACL, pfSense XML, or AWS Security Group JSON exports. Auto-detects format, flags any-any rules, deprecated protocols (Telnet, FTP, TFTP), overly broad CIDRs, and dangerous ports without source restriction
• Password Policy Analyzer (Req 8.3) — upload AD GPO .inf, Azure AD JSON, AWS IAM JSON, or CSV policy exports. Checks all 7 PCI password requirements: minimum length (12+), complexity, history (4+), max age (90d), lockout threshold (10), lockout duration (30min), and first-login change
• Anti-Malware Deployment Checker (Req 5.2, 5.3) — upload endpoint protection CSV reports from Windows Defender, CrowdStrike, SentinelOne, or generic formats. Verifies agent deployment, signature freshness (7-day threshold), real-time protection, and scan recency across all endpoints
• FIM Report Parser (Req 11.5) — upload file integrity monitoring reports from OSSEC/Wazuh (JSON), Tripwire (CSV), AIDE (text), or generic CSV. Detects unauthorized modifications to critical system files (/etc/passwd, /etc/shadow, SAM, SYSTEM, etc.)

Previously shipped tools (10):

• Port & Service Scanner — live nmap scans or import existing nmap XML, detects risky open ports (Telnet, FTP, SMB, RDP), auto-fill for Req 1.2.1
• Patch Management Parser — upload WSUS, SCCM/Intune, or Qualys Patch CSV exports, flags critical/high patches overdue beyond the 30-day PCI window, auto-fill for Req 6.3.3
• Log Audit Validator — upload syslog, Windows Event XML/CSV, JSON, or CSV logs to verify all 6 PCI-required audit trail fields, auto-fill for Req 10.2
• Access Review Parser — upload Active Directory, Azure AD, or AWS IAM CSV exports, detects inactive accounts, shared/generic accounts, missing MFA, and excessive privileges, auto-fill for Req 7.2 & 8.6
• SSL/TLS Checker — domain certificate validation with SSL Labs grading, auto-fill for Req 4.2.1
• CVE Vulnerability Lookup — NVD-powered vulnerability search by software/version, auto-fill for Req 6.3
• ASV Scan Import — upload Qualys/Tenable/Rapid7 CSV scan results, PASS/FAIL compliance, auto-fill for Req 11.3.2
• Penetration Test Parser — upload Burp Suite XML, Nessus CSV, or OWASP ZAP XML reports, auto-fill for Req 11.4
• HTTP Header & DNS Checker — A-F grading on HSTS, CSP, X-Frame-Options, SPF, DMARC, CAA, auto-fill for Req 2.2.5
• Remediation Dashboard — unified view aggregating findings from all tools with severity, status, tool, and PCI requirement breakdowns

Security Tools Sidebar Navigation

Replaced the horizontal tab bar with a vertical sidebar for the Security Tools panel. All 20 tools are now accessible from a compact sidebar that scales without overflow.

See the Security Tools Guide for full documentation.

February 2026

Documentation Portal

Launched a public documentation portal with 14 pages covering every platform feature — step-by-step operations guides, platform architecture, and technical deep dives.

Document Validation & Evidence Pipeline

Cortex AI now validates every uploaded file against requirement-specific PCI DSS criteria. Results (Complete / Partial / Insufficient) appear inline in the attachments table without leaving the workbench. Malware scan status column added, plus unlink/unassign support for evidence files.

Bug fixes: Tailwind darkMode config, radio button selection in validation criteria, double scrollbar on attachments tab.

Assessment Workbench Overhaul

Major restructure of the primary assessment interface — redesigned section tree, prefill from previous assessments, per-section progress bars, bookmarks and stamps, interview question dialog with Cortex context, dedicated Cortex AI chat panel, and complete DOCX export tag mapping for all 12 PCI DSS principal requirements.

Bug fixes: Section 5/6 DOCX field mapping, fixed scrollbar layout, radio button findings, auto-summary for Req 1.8.1, Kanban progress calculation, textarea caret positioning.

Calendar 2.0 & Command Palette

RFC 5545 RRULE recurrence with safety limits (max 500 occurrences, 2-year expansion), task-linked calendar events (Teams/Zoom/Google Meet), command palette with fuzzy search across assessments/tasks/settings, and full keyboard/ARIA accessibility on calendar.

Security: Fixed passkey (WebAuthn) registration and auth flow, session accumulation on repeated logins, device OS detection, input sanitization, rate limiting, and XSS prevention.

January 2026

Production Hardening & Infrastructure

Database connection pooling, dynamic XLSX import (lazy-loaded), Sentry tree-shaking, Next.js Image component for logo, conditional logging (dev only). Activity logs migrated from JSON files to PostgreSQL. All npm audit vulnerabilities resolved.

Sentry Error Tracking

Integrated Sentry for frontend error capture — source map uploads for readable production stack traces, user context linked to sessions, environment-based configuration, and CSP headers updated for Sentry domains.

2FA Verification Page Redesign

Modern OTP input with 6-digit auto-advance, paste support, dark-background centered card matching the login page, trust-device checkbox (30 days), and countdown timer with resend.

Login & Signup Page Redesign

Split-screen layout — gradient brand sidebar alongside the auth form. Mobile-responsive, Google/GitHub/Microsoft OAuth buttons, inline validation, and server error handling.

December 2025

Engagement Hub — Client & LOE Architecture

Complete Client → LOE → Assessment data hierarchy. Client profiles with PCI context (merchant level, acquirer, transaction volume), LOE setup with scope/milestones/financials/legal terms/QSA signer, Engagement Hub dashboard, and tabbed LOE detail page (overview, scope, timeline, assessments, documents, terms, signatures, payment).

Session Management

Active sessions list with device info, browser, and IP. Remote logout for any session, configurable concurrent session limits, and OS/browser detection.

Password Security with HIBP Integration

Breach detection via the Have I Been Pwned API using k-Anonymity (only first 5 chars of hash sent). Real-time warning if password appears in known breaches, enhanced strength indicator.

Security Penetration Testing Fixes

IDOR protection (org-scoped validation on all resource endpoints), enhanced rate limiting on auth and API routes, XSS prevention on all user-input fields, CORS hardening.

November 2025

Calendar Improvements with Big Calendar

Migrated to react-big-calendar — month/week/day views, drag-and-drop event rescheduling, date/time picker for new events, recurring events, and LOE milestone/deadline visualization.

October 2025

Major Infrastructure Upgrade

Complete infrastructure overhaul — Supabase for real-time and file storage, Redis for server-side caching, TanStack React Query for frontend data management, and 100+ bug fixes.

• Supabase Storage — 4 auto-initialized buckets (evidence-files, avatars, org-logos, reports) with org-scoped paths and signed URLs
• Supabase Realtime — replaced 30-second polling with WebSocket connections for instant notifications, presence, and live assessment updates
• Redis Caching — 50%+ route coverage, 10-minute TTL, automatic invalidation, 60–70% response time reduction
• TanStack React Query — 35 hooks, 15+ components refactored, ~2,000 lines of boilerplate removed, 60–70% API call reduction
• Prisma schema — standardized 100+ field references to snake_case, 144-folder PCI DSS file structure per assessment

Trusted Device Management for 2FA

Mark devices as trusted to skip 2FA for 30 days. View and revoke trusted devices from security settings.

Admin Dashboard & Log Management

Database health dashboard (connection status, table stats), security audit dashboard (failed logins, suspicious activity), usage analytics (daily trends, feature breakdown), real-time log viewing with level/date/search filtering, and plan badge indicators.

Architecture & Workflow Documentation

Internal docs suite with business workflow guides, 9 Mermaid architecture/data-flow diagrams, and technical references for database schema, RBAC, and caching strategies.

Critical Bug Fixes & System Stability

Analytics crash fixes with data validation, authorization header forwarding in Next.js API proxy, single-instance enforcement for frontend (3000) and backend (3001), Cloudflare caching optimization (API bypass, static assets 2-hour cache).

Performance Optimization Suite

85% faster API responses — strategic database indexes (40–60% query improvement), 5-minute in-memory API cache (80–90% DB load reduction), Cloudflare CDN with Gzip compression (70–80% payload reduction). Average API response time: 4–7ms (down from 50–100ms).

Dark Mode & UI Improvements

React MutationObserver for real-time dark/light mode switching, professional PCI DSS assessment cover page, reorganized toolbar (filter/export, review/accept, members/help groups), scoping categories collapsed by default.

Stripe Integration & Advanced Scoping

Multi-tier Stripe billing (checkout, portal, webhook handling), 8-rule scoping engine (wireless, P2PE, CHD storage, segmentation), automatic N/A pre-fill for scoped-out requirements, browser push notifications (VAPID + service worker), Mailcow SMTP email system, and Microsoft OAuth.

Smart Notifications & Email System

@mention instant alerts, task assignment notifications, mobile-responsive email templates (Mailcow SMTP), automated daily/weekly/monthly task reminders via cron, enhanced task management (edit, delete, creator tracking), and activity audit logging.

2FA Authentication & Scoping Engine

TOTP setup wizard (QR code, manual key, code verification), 8 one-time backup codes, admin 2FA adoption panel, dedicated verification page. Scoping engine fixes: persistence, N/A auto-fill, visual N/A banner, conditional rule evaluation.

Initial Platform Launch

The first release of Kliper — a PCI DSS 4.0.1 compliance platform for QSA firms and internal security teams.

• Assessment Engine — 200+ testing procedures, 3-panel workbench (tree, questions, context), findings (In Place / Not Applicable / Not Tested / Not in Place), compensating controls, DOCX ROC export
• Multi-Tenant Architecture — org-isolated workspaces, 4 roles (Admin/Manager/Contributor/Viewer) with 28 granular permissions, Better Auth with Google/GitHub/Microsoft OAuth
• Evidence & File Management — SHA-256 hashing, dual-engine malware scanning (ClamAV + VirusTotal), MIME validation, 40+ blocked extensions, magic bytes inspection
• Collaboration — threaded comments with @mentions, Kanban tasks, calendar, live presence (who is viewing which section in real-time)
• Analytics — gap assessment with 5 severity levels, 4-factor risk scoring (finding 45% / documentation 25% / completeness 15% / staleness 15%), Cortex AI remediation recommendations