{"generatedAt":"2026-10-27T17:32:06.826Z","source":"ismscopilot-marketing","contract":"v1","product":"chat","canonicalHumanPage":"https://chat.ismscopilot.com/changelog","note":"Scrubbed mirror of the chat product changelog (chat.ismscopilot.com). Platform ships: /api/public/platform-changelog/v1. GitHub PR URLs removed.","markdown":"# ISMS Copilot Product Changelog\n\nAll notable user-facing changes to the **ISMS Copilot chat app** (chat.ismscopilot.com), grouped by month.\n\nPlatform (API, embed, console) ships: `docs/platform/CHANGELOG.md`.\nheyGRC ships: `docs/heygrc/CHANGELOG.md`.\n\n## How to add an entry (authors and agents)\n\n**Canon version:** `changelog-voice/2026-07-v1`  \nFull agent runbook: `founder-ops/runbooks/changelog-voice.md` (private ops repo).\n\nThis How-to block is **not** rendered on the public page (parser only accepts `## Month YYYY` month headings).\n\n### Shape (July 2026 and later)\n\n```\n## Month YYYY\n\n### Features\n\n- **Company context.** Set structured org facts under Customize so Chat and Agent draft with your company in mind.\n\n- **Short title.** One plain sentence.\n```\n\n### Rules\n\n1. Categories only: `Features`, `Improvements`, `Fixes`, `Privacy & legal`, `Safety` (this order).\n2. One bullet = **bold title ending in a period** + **one** sentence (max ~40 words).\n3. No em dashes. No statute dumps. No internal jargon.\n4. `Privacy & legal`: one-sentence product pointer to [trust.ismscopilot.com](https://trust.ismscopilot.com/dpa); full legal text stays on the Trust Center.\n5. PR links must be `([#N](url))` (build breaks otherwise).\n6. Bundle the entry in the **feature PR** (with `docs/ENGINEERING-LOG.md` as needed). Weekly catchup is the safety net only.\n7. Do not invent `### Feature title` headings as entries; every `###` is a category.\n8. Positive style examples: January and February 2026. Do not copy dense recent prose for voice.\n9. **Chat-only scope:** platform/embed/API console ships go to `docs/platform/CHANGELOG.md`; heyGRC to `docs/heygrc/CHANGELOG.md`; Aevral console to `docs/aevral/CHANGELOG.md`.\n\nValidate: `node scripts/validate-changelog.mjs docs/CHANGELOG.md`\n\n---\n\n## October 2026\n\n### Features\n\n- **Credit the partner who sent you.** When you arrive through a partner's link, ISMS Copilot asks whether a partner sent you; Yes credits them, No records nothing.\n- **China's compliance frameworks.** Ask about China's Personal Information Protection Law, the revised Cybersecurity Law (in force 1 January 2026), the Data Security Law, MLPS 2.0 (GB/T 22239-2019) and the cross-border data routes, in Chinese or English, with facts pinned to the official texts.\n\n- **Serving users in mainland China safely.** Sessions from mainland China now run on providers whose terms welcome China users (GLM on non-China hosts, EU-hosted Mistral as backup), instead of providers that bar China-located use; the app stays available to everyone.\n- **IEEE 2863 on AI governance.** Ask about IEEE 2863-2026, the new IEEE recommended practice for organizational governance of AI, and get its status, committee and dates.\n- **New AI standards: EN 18286 and ISO/IEC 27090.** Ask about EN 18286, now a harmonised standard for the EU AI Act in the Official Journal, and what it gives your Article 17 quality management system, or about the new ISO/IEC 27090 on AI security.\n- **Assistants.** On any paid plan, define an assistant once with its instructions, work procedures, up to 5 reference files, skills and output style, then pick it when you start a chat or set it as a workspace's default.\n- **Call another assistant with @.** Type @ in your first message to choose the chat's assistant, or mid-chat to get just the next answer from another assistant while the chat keeps its own.\n- **Assistant documents, named your way.** Set an assistant to answer in chat or always as a Word, PDF, Excel or Markdown document named after its title, and skip the document for one message with the Document toggle.\n- **Skills per workspace.** Choose which skills are on in each personal workspace; an assistant only uses skills that are on there and never turns one back on.\n- **French contract law.** Ask about liability caps, faute lourde, unfair clauses, e-signature or significant imbalance between partners, and get the post-2016 Code civil articles, the current Code de commerce L. 442-1 and the key Cour de cassation ruling.\n- **Team roles: Admins and co-Owners.** Team owners can now make teammates Admins, who invite and remove members, or co-Owners, who also manage team settings and roles, while the primary owner keeps billing.\n- **Invite your whole team at once.** Paste a list of emails or upload a CSV, pick the role, resend or revoke pending invitations, or share an invite link that expires after 14 days.\n- **Two-step verification.** Turn on sign-in codes from an authenticator app in Settings, Account, and keep ten recovery codes in case you lose your phone.\n\n- **Usage by member for team admins.** Team owners and admins can now see how much each member used in the current session and the last 30 days under Settings, Usage, and export it as CSV.\n- **Japan's cyber laws and government baseline.** Ask about Japan's Basic Act on Cybersecurity, the 2025 active cyber defense law and the government Common Standards, in English or Japanese, and get APPI breach-reporting thresholds and deadlines right.\n- **Client contexts for every client.** Save each client as a company once, link it to any of your workspaces, and update it in one place so every linked workspace stays fresh, with your plan including a set number of companies.\n- **Link a company from the workspace.** Each workspace card now shows its client context, and you can link or change the company right from the workspace's Edit dialog, so linking works from both sides.\n\n- **Connect ChatGPT by signing in.** ChatGPT now has its own setup card on the Connectors page: add the ISMS Copilot server address, keep the default settings, sign in and approve.\n\n- **Connect your AI tools by signing in.** Add the ISMS Copilot server address in Claude (claude.ai and Claude Desktop) or Claude Code, sign in and click Approve, with no token to copy; disconnect any time in Settings, Connected apps.\n\n### Improvements\n\n- **Bigger reference files for assistants.** An assistant's reference files can now hold up to 500,000 characters in total, enough for a full ISO standard.\n- **Add files while creating an assistant.** Pick reference files in the new-assistant form; they upload as soon as you create it, so there is no need to save first and come back.\n- **New partner portal.** Refer and Earn opens our new partner portal: partners earn 30% of qualifying subscription payments, for as long as the credited customer keeps paying, paid automatically to the payout method the partner chooses.\n- **Workspace instructions.** The instructions card on a workspace page is now called Workspace instructions instead of Project instructions, and it is translated into every app language.\n\n- **Add ISMS Copilot to Claude in one click.** On the Connectors page, Add to Claude opens Claude with ISMS Copilot already filled in, and the ChatGPT button copies the address and opens ChatGPT for you.\n- **A cleaner Connectors page.** Every connector now shows its logo and whether it is connected, and setup opens in a side panel with only the steps for that tool; the home page links to it from one line under the message box.\n- **New plans: Plus at $24 and Standard at $50.** New subscriptions get more usage credits per plan, annual prices are shown first, and existing subscribers keep their current price.\n\n- **BSI C5:2026 criteria.** Ask about any C5:2026 criterion by ID and get its official title, alongside C5:2020, with each answer naming the edition it comes from.\n\n- **Your plan now goes further.** File processing and other behind-the-scenes work no longer count against your usage limit.\n\n- **Use ISMS Copilot from your AI chat.** The Connectors page now starts with AI chats: step-by-step setup for Claude, and a clear status for ChatGPT and Grok, which cannot connect yet.\n\n### Fixes\n\n- **Upload failures now say so.** A file whose text extraction fails shows a clear message instead of a silent dead end, and a file too big for an assistant is refused up front.\n- **Signing out keeps your AI tools connected.** Signing out of the web app now ends the session on that browser only, so connected AI tools such as Claude Code, ChatGPT and Cursor keep working; a separate \"Sign out everywhere\" option ends all devices and connections.\n\n- **Invitations name the team.** The invitation page now shows which team you are joining and who invited you before you accept, in your language.\n\n- **Generated documents survive a brief storage hiccup.** If saving your Word, Excel or PDF file hits a short outage on our storage provider, ISMS Copilot now tries once more before showing an error.\n\n- **Documents when you ask, even with workspace instructions.** Workspace instructions such as \"only create a document when I ask\" no longer stop a file being made when you do ask, and \"continue\" after a document keeps producing the next part as a file.\n- **Long documents no longer stop at \"Part 1\".** When a conversation already held a long answer or a long pasted text, some models wrote \"[Part 1/3]\" and stopped; earlier messages are now sent to the model whole, so documents finish in one reply.\n\n- **New here? Sign up and keep connecting your AI tool.** When you connect an AI tool to ISMS Copilot without an account, you can now create one and land straight back on the Approve screen.\n\n- **Cleaner answers in connected AI apps.** When you connect ISMS Copilot to an AI app by signing in, usage limit messages now just say when the limit resets, and the app receives only the account details your request needs.\n\n- **Clearer usage limit messages.** Usage limit messages now say in your language when the limit resets, on Slack and for connected agents too, and offer Upgrade only when it applies.\n\n- **Word, PDF and Markdown exports keep your document's exact wording.** The downloaded file is built from the document text you see in the chat, so section numbers, headings and document ID lines match it exactly, and placeholders in angle brackets such as <Organisation name> are kept.\n\n- **Closing a popup no longer freezes the page.** After picking Beyond in the mode picker and closing the popup that opened, the page now stays clickable instead of needing a reload.\n\n### Privacy & legal\n\n- **United States state privacy law terms in the DPA.** The DPA now includes section 10 with the service-provider terms for the CCPA/CPRA and comparable US state privacy laws, on the Trust Center.\n\n### Safety\n\n- **Exported files never load outside content.** Word, PDF and Excel exports are now built only from safe document elements; images appear as their description in brackets and checklists as ☑ and ☐.\n\n- **Excel exports keep section numbers and IDs exactly.** Values such as 1.10, 5.2.1 or 007 are no longer turned into numbers or dates, real numbers stay numbers, and every sheet uses the same clear table style.\n\n## September 2026\n\n### Features\n\n- **Dutch NIS 2 law.** Chat now covers the Netherlands' Cyberbeveiligingswet (in force 15 August 2026) with its implementing decree and sector regulations: who is in scope, the duty of care, registration, the 24-hour, 72-hour and one-month reporting clocks, supervisors and fines.\n- **Spain NIS 2 status.** Chat now explains that Spain has not yet adopted its NIS 2 law and covers the 2018 rules that still apply, including reporting windows, authorities and fines.\n- **Luxembourg NIS 2 law.** Chat now covers Luxembourg's NIS 2 law of 5 May 2026, in force since 10 May 2026: who is in scope, the ILR and CSSF roles, registration, the 24-hour, 72-hour and one-month reporting clocks, and fines.\n- **Agents draft with your company context.** Conversations your connected agents run over MCP or the account API now use your Company Context like web chat does, except in team-shared workspaces.\n- **DORA RTS and NIS 2 implementing regulation in detail.** Chat now covers the DORA RTS on ICT risk management (Regulation (EU) 2024/1774) at article and paragraph level and the NIS 2 implementing regulation (EU) 2024/2690 at annex-point level.\n- **Onboard your coding agent in one paste.** Settings > Connected apps now has a Copy prompt that connects ISMS Copilot to Claude Code, Codex, or Cursor as their GRC specialist, plus an Agent delegation preset that picks the right token scopes in one click.\n- **Swiss outsourcing rules.** Chat now covers FINMA Circular 2018/3, the rules banks and insurers in Switzerland must follow when they outsource.\n- **Italian cookie guidelines.** Chat answers on cookies and tracking now draw on the Italian Data Protection Authority's cookie guidelines.\n- **Dutch healthcare data exchange standard.** Chat now recognises NEN 7512 and points to its edition and the Dutch healthcare rules that require it.\n- **Agents can create workspaces.** Connected agents (MCP and the account API) can now open a new personal workspace for you when granted the Create personal workspaces scope; up to 10 new workspaces per day.\n- **Unlimited plan.** $1000 a month of unlimited chat tokens on the shared 4-hour pool, for you or your team.\n- **heyGRC on Unlimited advertised correctly.** The settings row now shows the 2,000 private reviews a month Unlimited includes, not the uniform 100; upgrade-card bullets are unchanged.\n- **Share an existing workspace with your team.** Edit a workspace you own (or duplicate one) and turn on Share with team so teammates see conversations, pinned files, and memories.\n\n\n- **Extra usage for teams.** When the shared session is empty, the owner can buy +50 chat credits for $25 / EUR 25 that last until the end of the UTC month.\n- **OT and energy-sector knowledge.** Chat now covers IEC 62443, NIST SP 800-82 Rev 3, and ISO/IEC 27019:2024.\n- **Aerospace and space-systems knowledge.** Chat now covers EASA Part-IS, UK CAA cyber oversight, airworthiness security (DO-326/ED-202), and space-systems standards.\n- **Agents can continue past your usage limit on your say-so.** When an agent hits the 4-hour session cap on a paid plan, it sees when your overflow is available and, only when you explicitly ask, continues the conversation on the same up-to-2x overflow the web app offers.\n- **Agents can run Beyond through the account API.** Connected agents (MCP and the account tools) can now run Beyond, the agentic multi-step mode, on their conversations, sending with mode beyond and polling get_reply for the finished deliverable.\n- **EU Cyber Resilience Act knowledge.** Chat now answers CRA questions with article-level references to Regulation (EU) 2024/2847: manufacturer duties, the 24h/72h vulnerability and incident reporting clocks that apply from 11 September 2026, Annex I requirements, conformity routes, and penalties.\n- **Western Australia cyber security policy.** Chat now has specialist knowledge for the 2024 WA Government Cyber Security Policy.\n- **Try ISMS Copilot for ISO 27005 at /iso-27005-assistant.** Logged-out ISO 27005 landing with starter prompts on risk criteria, assessment, and treatment (guidance only).\n- **Try ISMS Copilot for ISO 22301 at /iso-22301-assistant.** Logged-out ISO 22301 landing with starter prompts on BCMS scope, impact analysis, and recovery objectives (guidance only).\n- **Try ISMS Copilot for ISO 27017 and 27018 at /iso-27017-assistant.** Logged-out cloud-security landing with starter prompts on ISO/IEC 27017 cloud controls and ISO/IEC 27018 cloud PII (guidance only).\n\n### Improvements\n\n- **Connected agents are now guided to hand NIST SP 800-171, CMMC and Cyber Resilience Act questions to ISMS Copilot.** The MCP guidance now directs connected agents to ask ISMS Copilot first for these frameworks.\n- **Connected agents check only what ISMS Copilot flags and note it in your file.** Agents now verify only answers ISMS Copilot marks unconfirmed or cannot confirm, skip re-checking confirmed ones, and record what they verified in the deliverable as well as in chat.\n- **Connected agents double-check what ISMS Copilot marks unconfirmed.** The MCP guidance now tells agents to verify anything marked unconfirmed against the official source text and say what they checked, keep follow-ups in one conversation, and change your company profile only when you ask.\n- **Agents can ask for brief or decision-ready answers.** Connected agents can request a short answer or a recommendation with reasons, risks and next steps, and completed fast and think replies report the tokens ISMS Copilot used on its side once they are recorded.\n- **Connected agents know when to hand work to ISMS Copilot.** Agents that connect over MCP now get guidance on which compliance questions to delegate, which modes to use, and how to keep long deliverables in files.\n- **Clearer continue hint when an agent hits the session cap.** Connected agents now see they can continue with a faster model, matching the web app wording.\n- **Faster simple Beyond answers.** A short one-step Beyond question now tries a faster host first, so the writing step should finish sooner.\n- **The team Usage tab shows credits, not raw token counts.** Settings > Usage now shows included session credits instead of millions of tokens.\n\n### Fixes\n\n- **Honest upgrade message.** The screen you see after upgrading no longer says rate limits are gone; it now says your usage limits are much higher.\n- **Team owners keep chat after cancelling.** If you cancel the plan behind your team, you now fall back to your own plan (Free unless you buy again) instead of losing chat.\n- **EU AI Act dates follow the AI Omnibus.** Knowledge now reflects the application timeline as amended by Regulation (EU) 2026/1744, not the pre-Omnibus 2024 dates.\n- **Document generation no longer fails silently on name collisions.** The deduplication lookup was truncated past 1,000 generated files, and collision recovery now checks the storage folder, so document generation completes instead of failing silently.\n- **Unshare closes the pinned-file gap.** After you turn off sharing, pinned files from that workspace stop being served to people who lost access, membership edits cannot bypass the trigger, and saving while the org lookup is pending no longer unshares.\n- **Workspace actions recover after an auth hiccup.** If an auth call is rejected, Edit, Delete, and Duplicate for workspace owners now recover instead of staying hidden until reload.\n- **Dutch GDPR implementation act up to date.** Answers about the UAVG now reflect the amendments in force since 1 September 2026, and Dutch government and healthcare security answers reflect the Cyberbeveiligingswet in force since 15 August 2026.\n- **Large or stalled file uploads no longer hang in processing.** Very large spreadsheets and stalled downloads now fail quickly with a clear status, so chat stops waiting on a file that will never finish.\n- **Beyond planning retries once if the backup planner fails.** A brief provider outage on the fallback model no longer always stops the run with no plan.\n- **New chats no longer inherit auto-learned facts from other conversations.** A chat that is not in a workspace no longer receives account memories Copilot saved by itself, while facts you saved and company context still apply.\n- **Beyond planning stall.** If planning hangs, Beyond now retries once after 60 seconds instead of waiting up to nine minutes.\n- **Bank, tax, and credit-rating \"CRA\" no longer load EU Cyber Resilience Act knowledge.** A bare CRA mention now needs a clear EU-product cue before that pack is injected.\n- **Connected agents keep polling when Beyond briefly cannot read the run.** A momentary database error no longer stops the poll as a permanent failure.\n- **Team members at the org cap no longer see a personal upgrade link.** The chat app, Slack, and connected agents tell them to ask the owner or wait until the next 4-hour window.\n- **Upload top-up errors name the real reason.** A teammate who cannot buy top-ups now sees the server message instead of a generic checkout failure.\n\n### Privacy & legal\n\n- **Faster AI models on the same privacy footing.** Chat now runs the newest GLM-5.3 generation (paid fast, paid think, Beyond, free tier), rolling out gradually: same providers, same zero-data-retention controls, no price change, Advanced Data Protection still pins to the EU when on, details on the [Trust Center](https://trust.ismscopilot.com/en/dpa).\n\n- **ISO 27001 is a Better ISMS programme, not a product certificate.** We are not certified today; the intended scope is on the [Trust Center](https://trust.ismscopilot.com/en/iso-27001).\n\n---\n\n## August 2026\n\n### Features\n\n- **NSW and Victorian government security-policy packs.** Chat now has specialist knowledge for the NSW Cyber Security Policy and Victoria's Protective Data Security Standards, including who those policies cover.\n\n- **One plan, free teammates, shared usage.** Extra teammates are no longer a Stripe line: the owner's plan covers the whole team's chat, uploads, and agent runs as one shared pool at the plan's limits, with a hard stop.\n\n- **New interface languages: Japanese and Chinese.** Users whose browser is set to Japanese or Chinese, or who choose it in Settings, now see the full interface in those languages, and Chat replies in the language you picked.\n\n- **Copy or reuse a sent instruction.** Copy and Use again sit on a message you sent, the same way thumbs sit on the reply, so you can copy it or drop it back into the composer without retyping.\n\n- **heyGRC included with your plan.** Standard, Pro and Business plans now include heyGRC, compliance review for your pull requests, with 100 private reviews a month; activate it in the heyGRC console with your ISMS Copilot account.\n\n\n- **Agent Tasks.** Open Tasks, describe a job on your Notion pages and Chat threads, and the agent reads first, writes only with your permission, and lets you rewind a write it just made.\n\n- **Agent Auto mode covers title changes.** Auto now auto-approves page title changes in addition to creates and appends, while deletes and archives still always ask you.\n\n- **Chat reuses document IDs in a workspace.** When you generate more documents in the same workspace, chat can keep an existing document ID instead of inventing a new one.\n\n- **A thank-you listing on ISMS Directory.** Paying customers can claim one instant listing from the sidebar gift icon.\n\n- **Canada and Singapore framework packs.** Chat now has specialist knowledge for Alberta PIPA, BC PIPA, OSFI B-13, Singapore PDPA, and the MAS TRM Guidelines.\n- **Japan framework pack.** Chat now has specialist knowledge for Japan's APPI, the My Number Act, METI's cybersecurity management guidelines, and JIS Q 27001.\n- **Australia and New Zealand framework packs.** Chat now has specialist knowledge for the Australian ISM, APRA CPS 234, the New Zealand Privacy Act 2020, and NZISM.\n- **Automotive and related knowledge.** Chat now covers vehicle cybersecurity (ISO/SAE 21434 and UN R155), plus HITRUST, Korea's ISMS-P, and Singapore's MTCS.\n- **Try ISMS Copilot for NIST 800-53 at /nist-800-53-assistant.** Logged-out NIST SP 800-53 landing with starter prompts on control families, baselines, and tailoring (guidance only).\n- **Try ISMS Copilot for NIST CSF at /nist-csf-assistant.** Logged-out NIST Cybersecurity Framework 2.0 landing with starter prompts on Profiles, Functions (including Govern), and Implementation Tiers (guidance only).\n- **Try ISMS Copilot for the EU Cyber Resilience Act at /cyber-resilience-act-assistant.** Logged-out CRA landing with starter prompts on product scope, CE marking prep, and vulnerability reporting (guidance only).\n- **Try ISMS Copilot for ISO 9001 at /iso-9001-assistant.** Logged-out ISO 9001 quality-management landing with starter prompts on QMS scope, the process approach, risk-based thinking, the Plan-Do-Check-Act cycle, and internal audit (guidance only).\n- **Try ISMS Copilot for NIST 800-171 at /nist-800-171-assistant.** Logged-out NIST SP 800-171 landing with starter prompts on CUI, SPRS scores, and system security plans (guidance only).\n- **Duplicate a workspace as a template.** Copy a workspace with its instructions, pinned documents, memories, and pinned links into a fresh workspace, so a new project starts from your base set and you only add what is new.\n- **Company context.** Set structured org facts under Customize so Chat and Beyond draft with your company in mind.\n- **Company context for connected agents.** With Connected apps permissions, your agents can read and update company context.\n- **A real status page for every surface.** [status.ismscopilot.com](https://status.ismscopilot.com) now tracks chat, agent access, the API, AI providers, the platform, and docs individually with live outage events, plus a heyGRC view at [status.heygrc.com](https://status.heygrc.com).\n- **COBIT 2019 knowledge.** Chat now recognizes COBIT 2019 governance and management objectives for IT governance questions.\n\n### Improvements\n\n- **A quieter Tasks footer with a Context chip.** The Ask and Auto explanation moved behind a small info button, and a new Context chip opens your company facts and Notion connection in one popover instead of a banner.\n\n- **The open conversation is highlighted in the sidebar.** Your current chat now stands out in the left History list, so it is clear which one is selected.\n\n- **Paid Think writes with Grok 4.6.** Long procedures in Think are written by Grok 4.6 instead of GLM-5.2 so they are less likely to stop mid-document.\n\n- **One Notion connection.** Chat and Tasks share a single Notion row, and the workspace name is a subtitle rather than the product title.\n\n- **Signup and login no longer claim we are ISO 27001 only.** The line under the title and the desktop poster now cover ISO 27001, SOC 2, and the rest of the work.\n\n- **BSI IT-Grundschutz knowledge matches Edition 2023 with Errata.** Titles and guidance now track the official Bausteine catalogue and March 2026 errata (including federal-only CON.11.1 scope and clearer H-requirement risk analysis).\n- **Paid Fast and Think use GLM-5.2 again.** Paid Fast and Think route to GLM-5.2; Beyond stays on Grok.\n\n### Fixes\n\n- **The Usage tab no longer goes blank.** Opening Settings > Usage no longer crashes when org usage numbers are missing.\n\n- **Auto title changes actually reach the Tasks worker.** Renaming a page in Auto now offers the title-change tool to the model instead of only advertising it in copy.\n\n- **Think mode no longer dumps its working notes into the chat.** When Think is on, the assistant keeps that reasoning internal and still answers in the thread.\n\n- **Excel files no longer sit on “processing” forever.** A spreadsheet whose used range is much larger than the filled cells now extracts instead of hanging, and you can delete a workspace file that is still processing.\n\n- **BSI IT-Grundschutz by module ID.** Asking about a Baustein by its ID alone (like OPS.1.1.6) now pulls the correct IT-Grundschutz reference, so the module title and scope match the number.\n- **Connected agents get a wait-or-upgrade answer at the free cap.** When the 4-hour session limit is hit, the account MCP error keeps the same reset sentence the chat app uses and includes the time and an upgrade link.\n- **The phone sidebar has a name for screen readers.** Opening history on a phone no longer trips a missing dialog title.\n- **A Tasks job no longer freezes on the first Notion read.** Fetching a parent page now lists its child pages instead of walking every nested document, so an assessment can write instead of hanging.\n- **A Tasks follow-up that appends must re-read the page this turn.** If the agent stages an append without fetching that page again, it is sent back to fetch instead of failing as a platform error.\n- **A stuck Notion read cannot freeze a task for half an hour.** A single tool call that does not return within two minutes fails honestly so the job can continue.\n- **An open-ended Tasks job writes instead of reading forever.** \"Assess my workspace\" now samples a bounded set of pages and produces a first document instead of looping until the deadline.\n- **Document preview bullets stay readable in dark mode.** Nested lists on the white preview page no longer use near-white text.\n- **Pinned website links no longer look like the site rejected you.** If our snapshot service cannot authenticate, the error now names the snapshot service instead of looking like the website blocked you.\n\n- **A Tasks follow-up that says append stays on the same page.** Add-a-section follow-ups append to the existing document instead of creating a second copy.\n- **A document save no longer fails when that file name already exists.** If the name is taken, we save a numbered copy instead of showing Failed to generate the document.\n- **Workspace memories no longer scroll sideways.** Long saved facts wrap in the Manage dialog, and the panel stays 600px wide.\n- **Open heyGRC from Settings lands on Reviews.** The link opens the GitHub install home instead of Plan.\n- **An attachment that never started processing no longer stalls your message for three minutes.** Chat retries the upload step a few times and, if it still cannot start, tells you right away so you can re-attach the file.\n- **Notion in Settings stays Chat-only while Tasks is off.** The Notion row no longer talks about Tasks or Auto unless Tasks is on or already connected.\n- **Rewind still archives the page a task created, even after a crash or a partial write.** A retried create does not make a second page, and a half-written page is not marked finished.\n\n- **A failed card renewal no longer drops you to the free conversation limit.** While Stripe is retrying, chat keeps your paid plan.\n\n- **Connected-agent chat replies again.** Conversations started from Claude, Grok, or another connected app were failing immediately since the company-context release; they now get a reply.\n\n- **Expired Plus trial now asks you to upgrade.** After the week ends, the sidebar no longer offers another free trial.\n- **PII Reduction Mode keeps your compliance wording.** With privacy masking on, everyday terms like \"Personnel Change\" or \"Incident Response\" are no longer rewritten as if they were personal names.\n- **Delete and edit saved memories on any device.** The remove and edit controls on each saved memory are now always visible, including on mobile where the hover-only buttons never appeared.\n- **Agent Tasks keep the conversation on one task.** Type under an open task to continue it (e.g. fix it); Ask or Auto is on the home screen before you start and in every thread footer, with Shift+Tab; Done closes without re-running.\n- **Agent Tasks offer next steps after findings.** Inspect runs propose Continue options (retry access, apply additive Notion writes, or stop); Auto mode can apply high-confidence append/create only.\n- **Agent Tasks Auto also approves the plan.** With Run mode Auto, the agent reserves credits and continues after the plan without a second click; you still see a credits toast and an Auto receipt.\n- **Agent Tasks remember Ask or Auto run mode.** Like Fast/Think, your choice sticks until you change it and applies to new tasks.\n- **Agent Tasks inspect jobs stay findings-first.** Notion consistency checks plan a single short findings note instead of a multi-document pack, and skip Word/PDF/Excel unless you ask for a file format.\n- **Multi-document evidence packs stay focused.** Companion logs and methodology docs no longer copy the full report outline with long not-applicable sections.\n- **Agent Tasks match the job shape for downloads.** Slack or Notion-write jobs skip Word/PDF/Excel packs unless you ask for a file format, while formal document tasks still get the pack.\n- **SoA drafts and implementation plans are not crushed by verify caps.** Agent Tasks ignore \"verification\" language inside attached input files when choosing hard word caps.\n- **Channel and blocked-verify word caps hold after soft model overshoots.** Agent Tasks try two rewrite passes, then trim at a sentence boundary so hard caps stick.\n- **Policy update packs stay Probo-short.** Each updated policy is hard-capped near 700 words with a rewrite pass if the first draft runs long.\n- **Short channel posts and blocked SoA checks enforce their word caps.** Agent Tasks rewrite over-long drafts once when a hard cap is set.\n- **Multi-document policy updates stay short.** When a task updates several policies, each doc still gets extension rules (shall-language, no metadata bloat).\n- **Pre-audit SoA checks stay short.** Agent Tasks open with pass/fail and list only mismatches and open items, not the full SoA dump.\n- **Short channel posts stay short.** Agent Tasks treat \"post to the compliance channel\" style asks as chat posts under ~200 words, not formal reports.\n- **Agent Tasks no longer fail on accented titles.** Deliverable filenames fold accents so Storage accepts them.\n- **Agent Tasks name pages it could not open.** When a connected Notion page is missing or not shared, the plan says so instead of inventing a generic document.\n- **Outage and upgrade links no longer point at the old Bubble app.** Status, support, and billing links use the current status page and docs.\n\n### Privacy & legal\n\n- **Browser language no longer turns Advanced Data Protection on.** First-login accounts keep the off default, existing ADP settings stay, and details are on the [Trust Center](https://trust.ismscopilot.com/dpa).\n\n---\n\n## July 2026\n\n### Features\n\n- **Agent-ready model API scopes in Connected apps.** When creating a personal access token, you can grant Model API scopes so agents can manage keys and credit top-up once server tools are enabled.\n- **Starting a free trial keeps the mode you clicked.** Starting Plus trial from Think, Beyond, or web search applies that mode immediately.\n- **Confetti when your Plus trial starts.** Free Plus trial success uses the same celebratory modal as a paid upgrade, with trial-specific wording.\n- **AIUC-1, the security standard for AI agents, now covered.** Built-in reference knowledge for AIUC-1 sits alongside ISO 42001, NIST AI RMF, and the EU AI Act.\n- **UK Freedom of Information and Environmental Information Regulations now covered.** Built-in FOIA and EIR knowledge for public-sector information-rights questions.\n- **A redesigned ISO 27001 risk-analysis demo page.** The free logged-out risk tool has a clearer landing, results layout, and dark mode.\n- **More usage on Pro and Business.** Pro is 250 credits per 4-hour window and Business is 500, applied automatically for existing subscribers.\n- **Try Plus free for 7 days, no card.** Eligible free users start a one-week Plus trial without a credit card.\n- **Generated documents keep your section numbering.** Numbered headings in chat stay numbered in Word, PDF, and Markdown downloads.\n- **Find any past conversation fast: the new Conversations page.** Sortable, filterable list of every conversation you can access, with search.\n- **Team search now finds all shared conversations.** Shared workspace search includes teammates' conversations you have not posted in.\n- **Dark mode.** Appearance in Settings supports System, Light, or Dark and syncs across devices.\n- **Grounded web research in chat and Beyond.** Eligible plans can pull current public pages as labeled evidence; details and ADP limits are on the Trust Center.\n- **Free ISO 27001 risk analysis, no signup.** Enter a company at /iso-27001-risk-analysis and get a scored risk register in about 30 seconds.\n- **Point-level NIS 2 knowledge, across the whole directive.** NIS 2 answers cite the exact article, paragraph, and point across all 46 articles, including the Article 21 measures, the Article 23 reporting chain, and both fine tiers, in chat and over the API.\n- **Point-level EU AI Act knowledge, across the whole regulation.** EU AI Act answers cite the exact article, paragraph, and point across all 113 articles, from prohibited practices to the GPAI regime and penalty tiers, in chat and over the API.\n- **Point-level HIPAA knowledge.** HIPAA answers cite the exact section and paragraph across the Privacy, Security, and Breach Notification Rules, with Required or Addressable markings on every Security Rule specification, in chat and over the API.\n- **Point-level CCPA/CPRA knowledge.** California privacy answers cite section and subdivision, in chat and over the API.\n- **Point-level UK GDPR knowledge, across the whole regulation.** UK GDPR answers cite paragraph and point and track UK divergences from the EU text.\n- **Deep-reasoning (\"think\") mode works reliably from your AI agent.** MCP clients no longer time out on longer Think answers.\n- **Point-level GDPR knowledge, across the whole regulation.** GDPR answers cite paragraph and point across all 99 articles.\n- **Point-level DORA knowledge, across the whole regulation.** DORA answers cite paragraph and point across all 64 articles.\n- **Workspaces: your conversations are front and centre again.** Two-column workspace layout puts recent chats under the composer and setup in a side panel.\n- **A cleaner Connectors page.** Agent tokens, picker, and revoked-token cleanup are clearer.\n- **Connect your AI agent from the Connectors page.** PAT setup for Claude Code, Codex, Cursor, Hermes, or any MCP client lives under AI agents.\n- **Broader ISO 27000-family knowledge.** ISO/IEC 27000 overview and refreshed ISO 19011:2026 knowledge.\n- **New Dutch framework: DigiD Assessment.** DigiD Assessment plus refreshed BIO 2, NEN 7510, and UAVG knowledge.\n- **New Swiss framework: Switzerland National Cyberstrategy (NCS).** NCS plus refreshed Swiss ICT Minimum Standard and FINMA Circular 2023/01 knowledge.\n- **New country framework: Australia (Privacy Act 1988).** Australian privacy answers now draw on the Privacy Act 1988 and the Australian Privacy Principles, reflecting the 2024 reforms.\n- **New Belgian framework: Data Protection Act 2018.** ISMS Copilot now recognises Belgium's national GDPR implementation act alongside its existing CyberFundamentals knowledge.\n- **EN 18286:2026, the EU AI Act quality-management standard, now covered.** Reference knowledge for the CEN-CENELEC standard operationalising EU AI Act Article 17 for high-risk AI providers.\n- **Try ISMS Copilot for HIPAA at /hipaa-assistant.** Logged-out HIPAA landing with starter prompts (guidance only).\n- **Try ISMS Copilot for the EU AI Act at /eu-ai-act-assistant.** Logged-out EU AI Act landing with starter prompts.\n- **Try ISMS Copilot for PCI DSS at /pci-dss-assistant.** Logged-out PCI DSS landing with starter prompts on scope, SAQ selection, and the twelve requirements (guidance only).\n- **Try ISMS Copilot for ISO 27701 at /iso-27701-assistant.** Logged-out ISO 27701 landing with starter prompts on extending an ISMS for privacy and mapping to GDPR (guidance only).\n- **Try ISMS Copilot for CCPA and CPRA at /ccpa-assistant.** Logged-out California privacy landing with starter prompts on applicability, consumer rights, and opt-out (guidance only).\n- **Try ISMS Copilot for Cyber Essentials at /cyber-essentials-assistant.** Logged-out Cyber Essentials landing with starter prompts on the questionnaire, scope, and the five control themes (guidance only).\n- **The free plan now includes 10 file uploads a month (up from 5).** More room to try the product on your own documents.\n- **File uploads are no longer a plan tier.** Every paid plan includes 500 uploads per month (fair use); pinned workspace docs do not count.\n- **Pin website links to a workspace.** Pin up to 5 sites with a daily-refreshed snapshot the assistant can read.\n\n\n### Improvements\n\n- **ISO 27017 knowledge updated to the new 2026 edition.** The assistant now follows the ISO/IEC 27017:2026 structure published on 27 July 2026, including the four new CLD cloud controls, and still recognizes citations from the retired 2015 edition.\n- **In-app help opens the docs center.** Settings and assistant help links now go to [docs.ismscopilot.com](https://docs.ismscopilot.com) instead of the retired help host.\n\n### Privacy & legal\n\n- **xAI (Grok) is the default AI provider for paid chat and Beyond.** Full DPA text, comparison, and objection options are on the [Trust Center](https://trust.ismscopilot.com/dpa) (effective 2026-07-21).\n- **Authenticated search uses a governed Mistral discovery bridge.** Brave remains future-only; full search and ADP details are on the [Trust Center](https://trust.ismscopilot.com/dpa).\n- **AI transparency link on logged-out chat.** The public chat disclosure links to the Trust Center AI transparency page.\n\n### Fixes\n\n- **Downloads keep your document's identifier lines.** Document IDs, versions, classification, owner, approver, and dates now stay in Word, PDF, and Markdown exports.\n- **Usage limits now show the correct reset schedule.** In-app copy reads \"per 4-hour window\" and tells you when the next window starts, instead of \"per session\".\n- **Starting a Plus trial now asks you to confirm first.** Eligible free users see a short confirmation with the details before anything is granted, plus \"Try free\" badges on the eligible modes.\n- **Your own shared conversations now show a team badge.** Threads you started in a shared workspace are labeled \"Shared with team\" in the list and in search.\n- **The top bar now fits on phone screens.** Mobile title stays one line; upgrade is a compact icon.\n- **On phones, the button to open your conversation history was missing.** The menu button now appears at the top left on phones.\n- **Generated documents keep section numbering correct.** Numbered sections start at 1 with no gaps, and missing attachments are not invented.\n- **Links and formatting on this page now render properly.** Changelog links, bold, and inline code display as intended.\n- **Free plan message limit no longer counts internal AI calls.** Only your real chat turns count toward the free 10-per-4-hours cap.\n- **Deleting a conversation mid document-generation no longer false-errors.** Half-finished documents are discarded quietly.\n- **Document downloads survive a misbehaving formatter.** Intact documents are recovered; true failures fail fast.\n- **No more spurious \"Failed to load settings\" on first load.** Session reads are coordinated and retried.\n- **Workspaces load reliably in the sidebar on first render.** Same session-timing fix as settings.\n\n## June 2026\n\n### Privacy & legal\n\n- **DPA and Privacy Policy update: paid plan AI routing now includes the full OpenRouter allowlist.** We've updated the Data Processing Agreement, Privacy Policy, and Terms of Service (effective 2026-06-23) to document that paid plans (Plus, Standard, Pro, Business) with Advanced Data Protection off may route AI requests through any of the seven disclosed OpenRouter providers (the same providers already disclosed for the Essential plan) in any chat mode. Anthropic remains a disclosed provider on the paid path. Advanced Data Protection users stay on Mistral in the EU, unchanged. This supersedes the overflow-only routing described in our earlier June update. Full text at [trust.ismscopilot.com/dpa](https://trust.ismscopilot.com/dpa).\n\n- **DPA and Privacy Policy update: over-quota routing added for paid plans.** The Data Processing Agreement (§2.4) and Privacy Policy have been updated to document that paid plans (Plus, Standard, Pro, Business) with Advanced Data Protection off may continue chatting via OpenRouter after the 4-hour Anthropic token cap (with your explicit opt-in each session), routed to the same Google Vertex and Cerebras providers already disclosed for the Essential plan. This is consent-gated: you choose whether to continue. ADP-on users stay on Mistral in the EU and are never routed elsewhere; Slack integrations and Essential users are unaffected. Full text at [trust.ismscopilot.com/dpa](https://trust.ismscopilot.com/dpa).\n\n### New\n\n- **Connect ISMS Copilot to Claude Code.** You can now connect your ISMS Copilot account to Claude Code, Cursor, or any MCP-compatible AI tool and work with it as yourself: asking compliance questions, reading your saved context, and generating documents without leaving your coding environment. Go to Settings → Connected apps, create a personal access token, and follow the setup guide to add the ISMS Copilot MCP server. Think mode is available on paid plans.\n\n- **Upload Markdown files.** You can now attach `.md` files to a chat alongside PDFs, Word documents, and other supported formats.\n\n- **Keep going on a faster model when you reach your limit.** On paid plans, when you hit your 4-hour usage limit on the standard model you no longer have to wait. You can choose to continue the conversation on a faster model until your limit resets: a card explains the option (continue now, or upgrade for higher limits), a small banner shows while it's active, and your standard model returns automatically at the next reset. You decide each time. Advanced Data Protection stays on Mistral in the EU and is never routed elsewhere; the Essential plan is unaffected. Routing details are in the [DPA](https://trust.ismscopilot.com/dpa).\n- **Beyond mode: a new way to produce real compliance documents.** Alongside Fast and Think, premium plans get Beyond  -  for substantial, multi-document work. Instead of one answer, Beyond plans the work, drafts each document as its own step, and verifies every document against the plan before you see it, so what you get is checked, not just generated. You can watch it work (planning, writing, verifying) and expand each finished document. Best for jobs like \"draft my missing GDPR document set\" or \"turn these audit notes into a findings report\". Select it next to the message box.\n\n- **Share skills with your team.** In a team, any member can share one of their custom skills with everyone. Teammates can then enable and use it like any other skill, while it stays read-only for everyone except the owner (who can edit, unshare, or delete it). Your personal skills stay private unless you choose to share them.\n- **Suggested next steps can now be a decision card.** When the assistant lays out a real choice (for example \"SOC 2 or ISO 27001?\"), Suggested next steps shows the options as a tappable card with the recommended pick highlighted, so you can choose with one tap or the keyboard (Enter accepts the recommendation, arrow keys pick another) instead of retyping. When there's no clear choice, you still get the usual suggestions. Turn it on with the \"Suggested next steps\" toggle next to the message box.\n- **Analyze several documents in depth, one by one.** Attach 2 or more documents to a chat and choose \"Analyze each separately\"  -  ISMS Copilot gives each document its own full-depth analysis (instead of one combined pass that spreads attention thin across them), with live per-document progress. Prefer the previous behavior? Choose \"Analyze together\".\n- **New UK framework: NIS Regulations 2018.** Questions about the UK's Network and Information Systems Regulations 2018 now draw on that framework directly, including operators of essential services and digital service providers and the NCSC Cyber Assessment Framework basis, instead of being conflated with the EU NIS 2 Directive.\n\n### Improvements\n\n- **Your skills now shape Beyond runs.** When you have a skill active, Beyond now follows it while it plans and drafts each document, the same way the regular chat does, so a Beyond run respects your tone, format, and instructions instead of ignoring them. Works with your own skills and any team skill you have enabled.\n- **Beyond now ends with a short recap.** After a Beyond run finishes, you get a 2-3 line summary of what it produced and the key takeaway, shown as a closing note under the run, so a long output (several documents, or a detailed opinion) is easy to grasp at a glance without re-reading it. It appears only when there's enough to summarize.\n- **Beyond shows what it is doing while it plans.** When you start a Beyond run, the planning step now names what it is reading (how many documents, the relevant frameworks, your saved context), then shows it thinking and writing the plan live (with a word count climbing), instead of sitting on a spinner. You can watch real progress before the plan appears.\n- **New framework: CIS Controls v8.1 (Critical Security Controls).** Questions about the CIS Critical Security Controls now draw on the CIS Controls v8.1 structure directly instead of generalising.\n- **New framework: ISO 19011 (auditing management systems).** Questions about running or planning a management system audit, for example an ISO 27001 internal audit, now draw on the ISO 19011:2026 audit-guidance structure directly instead of generalising.\n- **More room for saved memories.** Each memory scope now holds up to 200 saved facts, up from 100.\n\n### Fixes\n\n- **Web search is clearly paused during your extra-usage window.** When you're in the extra-usage period (after hitting your plan limit), the web search toggle now shows as paused and cannot be enabled. In that window, searches would have silently produced no results, because over-cap traffic routes through a provider without web search. If web search was already on when your limit was reached, it turns off automatically.\n\n- **Saved memories are reliable again.** The assistant could stop saving new facts once you already had some memories saved, including when you explicitly asked it to remember something. It now reliably captures new details about your organization.\n- **Markdown documents generate again.** Generating a Markdown document had been silently failing since 2026-06-05. The fix restores this, and you can now also download the result as a `.md` file.\n- **Upload-slot count tooltip is no longer hidden behind the sidebar.** The tooltip showing how many file uploads you have left now appears in front of the left sidebar instead of behind it.\n\n- **The assistant now uses your most recent saved memories.** When you have many saved facts, the assistant now keeps your newest and manually-added entries instead of the oldest ones when space is tight.\n- **Dismiss suggested next steps, and clearer decision-card titles.** You can now dismiss the suggested next steps (and decision cards) with the X button or the Escape key without turning the feature off, and the small category label on a decision card no longer gets cut off mid-word.\n- **Shared workspaces now show your whole team's work.** In a shared (team) workspace, you and your teammates now see each other's conversations, generated documents, and search results, not just your own. Personal workspaces stay private to you.\n- **Generated documents are easier to notice.** When you create a document from a message with the document icon, the new document card now scrolls into view and briefly highlights, so it's clear the document was created instead of quietly appearing below a long reply.\n\n---\n\n## May 2026\n\n### Privacy & legal\n\n- **Essential plan AI routing.** The new Essential plan routes AI requests through OpenRouter, limited to Google Vertex and Cerebras, when Advanced Data Protection is off. With Advanced Data Protection on, Essential routes to Mistral in the EU like every plan. No new sub-processor was added (both providers were already in our OpenRouter allowlist). Full text at [trust.ismscopilot.com/dpa](https://trust.ismscopilot.com/dpa).\n- **DPA and Privacy Policy update: sub-processor notice mechanism aligned with industry norm, OpenRouter underlying-provider allowlist expanded to seven, effective 2026-06-25.** We've amended DPA §2.4 and Privacy Policy §2 to distinguish materially-adverse sub-processor changes (still 30 days' advance email and in-app notice) from control-neutral changes (Trust Center and in-app changelog). Under the new wording, three vetted underlying providers (Together AI, Fireworks AI, Nebius) join the OpenRouter sub-processor allowlist alongside the original four (Inceptron, DeepInfra, Cerebras, Google Vertex); Novita AI was evaluated and not added. The privacy bar (zero retention, no training, no PRC-jurisdiction infrastructure, Advanced Data Protection Mode for EU-only processing) is unchanged. Object before 2026-06-25 by emailing privacy@ismscopilot.com. Full text at [trust.ismscopilot.com/dpa](https://trust.ismscopilot.com/dpa).\n\n### Features\n\n- **New Essential plan: $12/month.** A lower-priced paid plan for focused, individual compliance work, sitting between Free and Plus. It includes core compliance guidance, 25 file uploads per month, and cancel-anytime billing.\n- **Run several conversations at once.** Open a new chat without losing one that's still answering. The sidebar marks which chats are working, ready, or failed, and you always stay in the chat you opened.\n- **Buy more uploads when you hit your monthly limit.** If you reach your plan's monthly file-upload cap, you can buy a one-time top-up of +100 uploads for $25 (€25 in the EU). It's a separate one-off payment, so your plan, billing, and renewal date are untouched. The extra uploads stack on top of your plan allowance and last until the end of the month; the upload indicator shows your plan allowance and any top-up separately.\n- **Keyboard shortcut for new chat, plus a shortcuts cheat sheet.** Start a new conversation from anywhere with ⌘⇧O (Ctrl+Shift+O on Windows/Linux). A new keyboard icon in the sidebar opens a cheat sheet of every shortcut (new chat, search, toggle sidebar, send), so they're easy to discover.\n- **Generate a document from any AI message.** When a response would make a good document but none was created automatically, click the document icon under the message and pick a format (Word, PDF, Excel, or Markdown). The new document appears as an extra card under the message, and you can generate the same message in more than one format.\n\n### Improvements\n\n- **New interface languages: Polish and Ukrainian.** Users whose browser is set to Polish or Ukrainian, or who choose it in Settings, now see the full interface in those languages.\n- **New country frameworks: Netherlands.** Ask about the Dutch government security baseline (BIO 2), Dutch healthcare information security (NEN 7510), or the Dutch GDPR implementation act (UAVG), and the assistant now answers from those standards directly instead of generalising from GDPR or ISO 27001.\n- **New country frameworks: India.** Indian privacy and cyber questions now draw on the DPDP Act 2023 and Rules 2025, the CERT-In incident-reporting directions, the RBI IT-governance direction for banks, and the SEBI cybersecurity framework.\n- **New country frameworks: Switzerland.** Swiss data-protection and resilience questions now draw on the revised Federal Act on Data Protection (revFADP), FINMA Circular 2023/1, and the ICT Minimum Standard.\n- **New country frameworks: Germany.** German questions now draw on the BSI IT-Grundschutz catalogue and the BSI C5 cloud-attestation framework.\n- **New country frameworks: UK.** UK questions now draw on Cyber Essentials (and Cyber Essentials Plus) and the NCSC Cyber Assessment Framework.\n- **New country frameworks: France.** French cloud-security questions now draw on the ANSSI SecNumCloud qualification.\n- **New country frameworks: Belgium.** Belgian questions now draw on the CCB's CyberFundamentals (CyFun) framework, including its Basic, Important, and Essential assurance levels.\n- **New country frameworks: Canada and Quebec.** Canadian questions now draw on PIPEDA, and Quebec questions on Law 25 (Loi 25).\n- **New country frameworks: Ireland.** Irish questions now draw on the Data Protection Act 2018. Ireland's NIS 2 transposition is included as a pre-enactment placeholder, with the assistant clear that the bill is not yet law.\n- **New US frameworks: FedRAMP and CMMC 2.0.** Federal cloud-authorization questions now draw on FedRAMP, and DoD contractor questions on CMMC 2.0, instead of being conflated with each other or with NIST 800-171.\n- **New NIST references.** Added the NIST AI Risk Management Framework and its Generative AI profile, the Zero Trust Architecture guide (800-207), the Secure Software Development Framework (800-218), the Privacy Framework, and the HIPAA Security Rule implementation guide (800-66 Rev. 2).\n- **ISO 27001 companion standards.** Added ISO 27002, ISO 27017 (cloud), and ISO 27018 (cloud PII), so the assistant answers from each directly instead of folding them into ISO 27001.\n- **SOC 2 Report Review skill, version 2.** The built-in skill now gives a more rigorous walk-through of a vendor's SOC 2 report: clearer Pass / Minor / Major / Fatal verdicts, a new check for whether the auditor's testing was thorough enough to find exceptions, direct reading of attached SOC 2 PDFs, and correct handling of Type 1 reports.\n- **Longer custom skills.** The Skills editor now allows up to 12,000 characters per skill (was 8,000), with room for more detailed instruction packs. Existing skills are unaffected.\n- **Inline PDF preview.** PDF documents now render as inline page images in the preview panel, alongside Word and Excel. The copy button returns the full document text. Long PDFs render up to 50 pages inline.\n- **Inline Excel preview.** Generated spreadsheets now render as a table in the preview panel, so you no longer need to download just to see what's inside. Multi-line cells and cell links are preserved.\n\n### Fixes\n\n- **Document generation failures are now shown as errors.** When the assistant fails to produce a downloadable document, you now see an error message instead of a normal-looking reply with no document attached. The document icon also briefly pulses on failure so it is easy to spot and retry.\n- **Documents now generate reliably when requested.** A conflict in the assistant's instructions could cause the document pipeline to silently produce no file even when a document was clearly requested. Fixed.\n- **Plus plan highlighted as Popular in the upgrade dialog.** The recommended-plan badge has moved from Standard to Plus.\n- **Streamed answers finish without a flicker.** When the assistant finishes writing a reply, the text now settles in place cleanly: no brief flash, no jump, and the typing cursor simply disappears. This holds during document generation too, so the answer stays put while a document is being prepared.\n- **The Skills page no longer shows up empty.** In some cases the page could show only your own custom skills, with the built-in skills missing until a hard refresh. The built-in skills now load reliably every time.\n- **Success and error messages are readable in dark mode.** Pop-up notifications (success, error, warning) and the in-chat error cards previously used light-only colors that could render unreadable in dark mode. They now adapt to the theme.\n\n---\n\n## April 2026\n\n### Features\n\n- **Workspace files: pin up to 5 files per workspace.** Pin reference files (policies, SoAs, risk registers, standards) to a personal workspace, and the assistant uses them as context in every new conversation there. Each file shows its processing status, and the eye icon previews the content. Personal workspaces only for now; team workspaces are next.\n- **Slack integration.** A new Connectors page lets you connect Slack. Click Add to Slack, approve the install, and your team can DM the bot or mention @heygrc in any channel. Solo paid users no longer need to create a team first.\n- **Skills: write your own AI instruction sets.** A new Skills page lets you create, edit, and delete instruction packs the assistant applies when your message matches what you describe. You can also browse the built-in skills and click Clone & Customize to start from one. When a skill fires, a small chip appears above the response so you can see which one was applied. Up to 20 custom skills per account.\n- **Fuller built-in skills, plus two new ones.** The built-in skills now ship with detailed content (decision rules, worked examples, severity definitions) instead of skeletons. New: SOC 2 Report Review and ISO 27001 Internal Audit. ISO 27001 Gap Analysis and Risk Register Drafting were rewritten with clearer scales and decision rules.\n- **Web search.** A toggle in the chat input lets you search the web for current information, with source links in the response. Useful for recent regulatory updates, enforcement actions, and breach reports. Available to paid users.\n- **Web search for Advanced Data Protection users.** Web search now also works on the EU (Mistral) provider, with the search handled inside EU infrastructure.\n- **Long EU-provider conversations no longer hit the context wall.** When a conversation on the EU provider grows very large, the assistant automatically summarizes older messages and continues. You see a brief \"Compacting\" indicator, then it carries on.\n\n### Improvements\n\n- **Faster message finalization.** Responses now finish immediately after the last word instead of waiting a few seconds for background processing. The typing indicator clears sooner and the input re-enables faster.\n- **Keyboard navigation for suggestions.** Tab into the suggestion chips and use the arrow keys to move between them, Enter to select, Escape to return to the input. The recommended suggestion auto-focuses so you can press Enter right away.\n- **Suggested next steps always visible.** Follow-up suggestions now appear above the chat input instead of inside the message, so you no longer scroll to find them on long responses.\n- **Refreshed chat input bar.** A cleaner, monochrome design with a circular send button.\n- **Fewer duplicate memories.** The assistant now detects far fewer near-duplicate memories from the same conversation.\n- **Excel files keep their layout.** Uploaded spreadsheets now preserve their structure (orientation, merged cells) when the assistant completes or regenerates them.\n- **Workspace file preview shows the real content.** The eye icon now previews the actual file content the assistant reads, with a clear note for very long files about which parts are visible to the assistant.\n\n### Fixes\n\n- **NIS 2 in Germany now uses the finalised law.** German NIS 2 questions now reference the finalised BSI-Gesetz and its current section numbers, instead of sometimes quoting outdated draft sections. Reported by a customer.\n- **File upload on a brand-new chat works again.** Uploading a file before sending the first message could briefly fail with a \"Failed to save file record\" error between April 21 and 24. Fixed.\n- **Pinned workspace files are read in full.** The assistant now reads the entire pinned document (up to about 50,000 characters) instead of a short summary, and garbled German characters in extracted text are fixed.\n- **Word spell-check now works in your language.** Generated Word, PDF, and Excel documents now open with the correct language set, so spell-check flags typos in German, French, and other languages instead of always assuming English. Reported by a customer.\n- **Large generated documents no longer come back half-finished.** Long policies and reports (especially in German) could quietly produce a cut-off Word file. Fixed, including the German quotation marks that triggered it.\n- **Stopped messages are kept.** When you stop the assistant mid-response, the partial answer now stays on screen and in the conversation, with a subtle \"Generation stopped\" note. Previously it disappeared.\n- **Suggestions no longer appear in the wrong language.** Follow-up suggestions could show in German on an English conversation. Fixed.\n- **No more scroll jump after long responses.** The view no longer jumps to the top of a message when a long response finishes, and you can scroll up freely while it streams.\n- **The skill chip no longer jumps around.** When a skill activates mid-response, its chip now appears in its final position instead of snapping into place afterward.\n- **Connectors page no longer blocked by ad blockers.** The page could show an endless spinner, or wrongly show \"Upgrade\" to paid users, when an ad blocker was active. Fixed.\n- **The compaction indicator no longer looks frozen.** When summarizing a long conversation, the indicator could sit at 95% and look stuck. It now shows elapsed time and reassurance text so it's clear work is still happening.\n\n---\n\n## March 2026\n\n### Features\n\n- **Automatic language detection.** The app detects your browser language and sets it as your default, so new users see everything in their language from the first visit. Supports English, German, Dutch, French, Italian, Spanish, and Portuguese. Change it anytime in Settings.\n- **Advanced Data Protection on by default for DE, NL, IT, FR, and PT users.** New users with those browser languages get EU-only AI processing enabled automatically. Toggle it anytime in Settings.\n- **Team workspaces.** Invite team members to shared workspaces from Settings → Team. Each member gets their own usage limits at the same per-seat price, and shared workspaces show a \"Shared\" badge.\n- **Data export.** Download all your personal data as a JSON file from Settings → Data Protection. Covers conversations, file metadata, workspaces, memories, and settings. Meets GDPR Article 20 (data portability).\n- **Delete your own account.** Permanently delete your account and all its data from Settings → Data Protection. You'll be asked to cancel an active subscription first. This is irreversible.\n- **Better Advanced Data Protection.** The EU AI model now supports reasoning mode and a larger context window (256K tokens).\n- **Workspace memories.** The assistant remembers your organization's context (tools, team size, certifications) across all conversations in a workspace. Memories are auto-detected and can also be added by hand.\n- **Personal memories.** Memories now work outside workspaces too, so personal facts you share are remembered across sessions.\n- **Memory controls.** Turn memory detection on or off per workspace or for general chats, see how many memories you have with a capacity indicator, edit memories in place, and tell auto-detected from manual ones with a small badge. The limit was raised from 50 to 100.\n- **Custom instructions.** Set persistent personal preferences that apply to every conversation, like \"always respond in bullet points\" or \"focus on SOC 2\". Configurable in Settings.\n- **Document library.** View and manage all generated documents in a workspace from one page.\n- **Conversation search.** Find past conversations with full-text search.\n- **UK frameworks.** Added UK GDPR, the UK Data Protection Act 2018, and the Data (Use and Access) Act 2025.\n- **Framework version display.** See which version of each framework the assistant is using.\n- **Workspace sorting.** Sort workspaces alphabetically, by newest, or by oldest.\n\n### Safety\n\n- **Content moderation.** Chat messages are now automatically screened for harmful content. Flagged conversations are protected from deletion to support review.\n\n### Improvements\n\n- **Memories are now opt-in.** New accounts start with memories off; enable them anytime in Settings. Existing users are unaffected.\n- **Clearer invite billing.** The invite flow now shows a confirmation explaining the prorated charge applies when the invitee accepts.\n- **Document generation overhaul.** PDF and Word exports now use a more reliable pipeline, so even 20-plus-page policies covering all 93 Annex A controls come out complete.\n- **Longer responses.** Maximum response length was raised significantly, allowing much more detailed answers.\n- **The assistant responds in your language.** It now automatically uses the language set in the UI.\n\n### Fixes\n\n- **Correct dates in generated documents.** The assistant now knows today's date in your language, so documents no longer contain unresolved date placeholders.\n- **Correct ß in German documents.** The assistant no longer replaces \"ß\" with \"ss\" (for example \"Maßnahme\", not \"Massnahme\").\n- **More reliable document downloads.** Documents that occasionally failed to generate now recover in most cases.\n- **You keep your partial answer when the AI is busy.** If the AI service is briefly overloaded mid-response, you now keep what you already received, with a clearer, softer warning.\n- **Oversized Excel files no longer freeze the service.** Spreadsheets with millions of empty rows are now stripped and capped.\n- **Fixed false subscription downgrades.** Caused by a billing webhook race condition.\n- **Fixed documents cut off partway through.** Downloaded files could be missing most of their content; they now generate in full.\n- **Accurate upload counter.** Only fully processed files count toward your monthly limit.\n- **Reset stuck conversations yourself.** If a conversation gets stuck in \"processing\", you can now unstick it.\n\n---\n\n## February 2026\n\n### Features\n\n- **Context compaction.** Long conversations are automatically summarized as they approach the context limit, so you can keep going without starting over.\n- **Think mode.** Turn on extended reasoning for more thorough analysis (paid plans).\n- **Change password in the app.**\n- **Copy a whole conversation to your clipboard.**\n- **Usage and stats.** View your token consumption in Settings.\n- **Split-screen document preview.** Preview generated documents side by side with your conversation.\n- **Name your generated documents.**\n- **Report an issue** from below the chat, with the error context pre-filled.\n- **Interface in 6 languages.** English, French, German, Spanish, Italian, and Dutch.\n- **5 new frameworks.** ISO 22301 (business continuity), TISAX (automotive), the EU AI Act, ISO 9001 (quality), and HDS (French health-data hosting).\n- **Automatic provider failover.** If the main AI provider is down, conversations switch to a backup automatically.\n- **Faster responses** through prompt caching.\n- **Free-tier limits with clear upgrade prompts** when you reach the conversation or upload cap.\n- **Date awareness.** The assistant now knows today's date, useful for compliance deadlines.\n\n### Improvements\n\n- **Smarter framework detection** that uses fewer tokens to work out which framework you're asking about.\n- **Better table rendering.** Tables in responses now copy and display correctly.\n- **Clearer upload-limit messages** as you approach your plan's cap.\n\n### Fixes\n\n- **Fixed silent file-upload failures** caused by a race condition.\n- **Fixed file-processing timeouts** on large documents.\n- **Fixed paying users showing as free** after the subscription system migration.\n- **Clear error on expired password-reset links** instead of a blank screen.\n- **Fixed document generation** skipping legitimate requests.\n\n---\n\n## January 2026\n\n### Features\n\n- **New subscription system.** Four plans (Free, Plus, Pro, Business) with clear feature tiers, managed through Stripe.\n- **AI model switching.** Choose between Anthropic (Claude), OpenAI, Mistral (EU), Grok, and Gemini.\n- **Upload several files at once.**\n- **Message feedback.** Copy any message, thumbs up or down, or report an issue from the chat.\n- **Help form** in the sidebar for quick support requests.\n- **Think / Fast mode selector.** Choose between quick answers and deeper reasoning.\n- **Password reset** from the login page.\n- **Privacy-first analytics.** Switched to cookieless tracking.\n","byteLength":70991}