Built in public. New entry every time something useful goes live.
Formal Google CASA Tier 2 verification completed, ahead of our public Q2 2026 commitment. Closes the assessment that started with the pre-submission hardening on 27 April (token revocation, Svix-signed webhooks, SPF/DKIM, fail-closed encryption) and the cascade-revoke on 8 May. Listed under Certifications; annual re-verification follows the standard Google OAuth schedule.
Full redesign — dark + violet, aligned with the app. New persona pages, transparent pricing, security details.
Account deletion (F10.06 nightly prune) and EmailAccount cascade-delete now also revoke OAuth tokens at Google/Microsoft, not just locally. Closes the CASA Tier 2 "tokens revoked when no longer needed" requirement end-to-end. Best-effort with retry + audit-log per account.
Published /.well-known/security.txt, vulnerability disclosure policy with response SLAs, certifications roadmap (CASA Tier 2 by end of Q2 2026), and Hall of Fame for security researchers.
Token revocation on disconnect (Google + Microsoft). Strict encryption requirement on OAuth token storage. SPF/DKIM verification on inbound emails. Pre-submission for Google CASA Tier 2.
New dashboard endpoint shows total balance, MTD cashflow and matched percentage in one request. Bank transactions with exact IBAN + exact amount auto-promote to strong matches.
Tax advisors can now export up to 25 clients in a single ZIP — one folder per client, CSV + PDF inside. Period-filtered.
If a client edits a flagged invoice, the advisor gets notified and the invoice auto-resets to pending — no manual chasing.
Full pentest preparation — fail-closed semantics on storage, virus scanner, webhook signatures and encryption. No silent fallbacks.
Invoices in foreign currencies are auto-converted at live ECB rates. Original amount + converted amount + rate source preserved for every line.
