Changelog

A summary, in plain words and grouped by month, of what has been added to the product. It is taken from the platform’s commit history. It is not a list of releases and not a route-by-route record of API changes.

Read This First

Zonitix is early-stage. Development began on 28 April 2026, and what follows are development milestones grouped by month. The entries carry no release names or version numbers, and this page does not list any.

To see which release your instance runs, an administrator opens System → Updates. The Application tile says “running” followed by the release name when the installed release has one, and otherwise by the first seven characters of its commit. System → System Health shows the same under App version, in the Running row, with the date it was installed in the Deployed row. If the tile reads Unknown, the instance could not check for releases; read the value under System → System Health instead. Quote that value when you report a problem.

If you write against the API, this page is not a compatibility record: it is prose, it lists milestones a person would notice, and a changed or withdrawn route may not appear in it. Zonitix publishes no route-by-route list of API changes. What you can check yourself is described under API Versioning: save your instance’s OpenAPI file before an update and compare it with the file after.

Entries Marked Breaking

The entries below are the ones written with the word “breaking”: a caller that was not changed stopped working. They are repeated here from the months that follow so they are easy to find. The list is only as complete as the monthly entries are; it is not a full record of every API change.

September 2026. Licensing (breaking): the store now accepts only the ten-field heartbeat signature; the old seven-field form is refused with 403 INVALID_SIGNATURE.
July 2026. Licensing (breaking): the provisioning status poll moved from GET with the token in the query string to POST with it in the JSON body — the GET form now returns 410. The retrieval token became single-use and is no longer echoed back in heartbeat responses.
July 2026. Licensing (breaking): heartbeat signatures now cover the telemetry fields (appVersion, userCount, metrics) and timestamps must strictly increase per licence.

October 2026

Mandatory backup setup, automatic release installs in a weekly window, an HR records module, training with courses and learning paths, phishing simulation, policy signing, and one to-do list for every employee.

Backups: setting up backups is now required on every plan. A new instance is locked from the first sign-in until storage you own is connected and a first backup has been read back from that storage and verified. Both recovery keys then have to be put in escrow within 14 days, or the instance locks until they are. An instance that was already live gets a banner and 30 days before the lock applies. While locked, the screens needed to finish setup stay open and everyone else sees a short waiting message.
Backups: once backups are set up, the instance checks every hour that they are still reaching your storage. If the destination is switched off, stops answering, or receives nothing for more than 3 days, administrators get a banner, a dialog they have to acknowledge, a bell notification and an email. A failing backup does not lock the product.
Updates: Zonitix releases can now be installed automatically in a weekly maintenance window. The database is backed up first, the instance is checked end to end afterwards, and it goes back to the version it was running if that check fails. Administrators are emailed the day before, an hour before, at the start and at the end. Nothing is installed by itself until email is set up, and a release that changes the database in a way a rollback cannot undo is never installed unattended: it waits on System → Updates.
Setup wizard: a new Updates step between Admin Identity and Review & Launch, with “Update automatically, once a week” already selected and “I’ll install updates myself” as the other choice. An instance that was already live keeps applying releases by hand until an administrator switches the schedule on.
HR records: one employee file per person, on every plan, with employment details, job history, personal details, emergency contacts and a leaving record. People see their own file and managers see a reduced view of the people below them in the reporting line, with no permission needed for either.
HR records, from Team: pay history kept as a record and revealed one amount at a time, with each reveal written to the audit log; a document vault per person; and People Reports with combined figures for headcount, joiners and leavers, turnover and tenure.
Time off: types of time off with a yearly allowance, working calendars with public holidays, requests decided by the reporting line, balances with a history, and a calendar of who is out.
Goals and review cycles: people keep their own goals; HR runs review cycles with a self review and a reviewer, optional feedback from colleagues, optional calibration before ratings are released, and a fairness check that can be saved as a record.
Anonymous surveys: an answer is stored with no link to the person who gave it, and results are shown only as combined figures, after the survey is closed and only when at least 5 people answered.
Payroll hand-off: one file for a pay period listing joiners, leavers, pay changes and approved time off, to give to whoever runs your payroll. Zonitix does not calculate or pay anything.
Training: courses are now built and taken inside Zonitix, made of reading parts, video and a knowledge check, with due dates, reminders, renewals and a certificate of completion. A starter library of ready-made courses can be added and edited. Uploading your own video file and importing a SCORM 1.2 lesson are part of the preview and not yet validated end-to-end.
Training: learning paths put courses in order, so a person is given the next course when they finish the one before.
Phishing simulation: practice phishing emails to your own staff from fixed templates, sent through your own mail server only after a second person approves. It records who clicked the link and who reported the email; the landing page has no fields and collects nothing typed. It has its own permission, separate from the training one. Part of the preview and not yet validated end-to-end.
Policy signing: add a policy from the template library, make it yours and approve it, then have people sign it by confirming each section and typing their name. You can see who has and has not signed, send reminders, and download a signed copy or a signed roster. Available from Team; the Compliance Hub registers and audit evidence remain on Advanced.
My to-do: every person has one list, under My Work, of the training they have to do and the policies they have to sign. It is on every plan and is empty when neither is in use.
Plans: Training is now its own plan feature, included in Team and Advanced.

September 2026

Directory push and SAML sign-in, a full data export, verifiable reports, staged device rollouts, and admin control over AI.

Identity: inbound SCIM 2.0, so Okta or Entra ID can push users and groups into Zonitix as changes happen; SAML 2.0 single sign-on alongside OIDC, with opt-in just-in-time account creation; and a password-history rule that refuses reuse of recent passwords on every path that sets one.
Support access: Zonitix support has no sign-in to your app unless an administrator grants one — time-boxed from 1 to 72 hours, read-only by default, revocable at any moment, announced by a banner and email, with everything support opens written to your audit log. A redacted diagnostics bundle you download and choose to send is often enough instead.
Data export: an administrator can export all company data from Security Settings → Data export as one ZIP (JSON and CSV, with a manifest and a SHA-256 per file). It leaves out credentials, tokens and key material, so it is a copy of your records, not a database dump; backups remain the restore path.
Licensing (breaking): the store now accepts only the ten-field heartbeat signature; the old seven-field form is refused with 403 INVALID_SIGNATURE.
Threat Defense: one page for country and IP rules, plus detectors that automatically block an address for a fixed time after patterns such as repeated failed sign-ins. Thresholds are adjustable.
Devices: a compliance profile can be rolled out in stages — a pilot group, then a percentage, then everyone — with pause and roll back. FileVault recovery keys on Macs can be rotated on request, after a reveal, or on a schedule; the new key is created at the Mac’s next login. Like the rest of FileVault escrow through Apple MDM, rotation is part of the preview and not yet validated end-to-end.
Finance: spend requests reserve budget before a purchase is made, and a correction after a period is closed is posted as a balanced adjusting entry in the open period rather than by reopening the locked one.
Reports: the report library now covers eight kinds — system overview, framework readiness, custom query, lifecycle reconciliation, endpoint compliance, budget report, framework crosswalk and a Type II period report that is sealed to the evidence vault when it runs.
Reports: an archived report can be shared through an expiring public link (1, 7, 30 or 90 days) that you can revoke, with each open recorded. Every archived PDF carries a verify address on your instance where anyone holding the file can confirm it matches the sealed record; the file is hashed in their browser and never uploaded.
Compliance Hub: the control catalog now stands at 146 controls across 8 frameworks, with CCPA added to the seven listed under August.
Hiring: the public careers site has a page per role, job alerts that visitors confirm by email and can unsubscribe from, and general applications that land in a talent pool. Both can be switched off.
E-signatures: offers are now sent as a single-use secure link with no separate access code, so whoever holds the link can open the offer. Signed documents, templates, résumés and offer documents are encrypted at the application layer (AES-256-GCM) on your instance.
AI: an administrator can switch every AI feature off for the whole organisation, or require a separate use_ai permission on top of the feature permission. AI requests are limited per user and each one is written to the audit log. The bundled models are now two small ones chosen to run on CPU-only servers: Qwen 3 0.6B (default) and Qwen 2.5 0.5B.
Data Governance: one page to add custom fields to invoice allocation, vendors, devices and access requests, and to curate the lists behind job titles, locations, compensation bands and candidate sources.
API: each instance serves an OpenAPI 3.1 reference for part of its API at /api/docs: a saved file built from the product’s route definitions and shipped with the release the instance runs.

August 2026

An AP-to-ledger finance backbone, tamper-evident audit logs, and a broader Compliance Hub.

Finance: a full accounts-payable-to-ledger suite — invoice ingestion (PDF/DOCX/image/Excel) with on-box LLM-assisted extraction that only accepts a field when it validates against the source text, a human review gate for low-confidence extractions, GL coding against a chart of accounts, and 2-/3-way PO matching that blocks approval on variance or a missing PO.
Finance: month-end close with lockable periods that refuses to lock a dirty period and posts balanced double-entry GL journals (net expense / input tax / AP), amount-tiered N-of-M approvals with segregation of duties, budgets that block over-budget approvals unless an audited override is given, and a duplicate-payment block. There is no payment rail — the flow ends at a "Paid" status you mark; connectors never move money.
Finance: journal exports in QuickBooks and Xero templates (plus generic CSV), and an idempotent outbound GL-sync connector that fails closed and never double-books via a stamped external reference.
Finance: a spend copilot that answers dollar questions from exact SQL first (never a guessed figure), and SaaS-spend management — per-app budgets, unused-app and renewal-window signals, and a billing-connector catalog (AWS and Azure/Entra live today, the rest declared pending each provider's credentials).
Audit: the central audit log is now hash-chained in the database with a daily off-box external anchor, so tampering is detectable and provable; a one-click integrity check returns a green/red result and an auditor-ready export. This is tamper-evidence, not a claim of un-hackability — and uploaded evidence files are not themselves chained, only the system audit log and the compliance report-run vault artifacts.
Finance ledger tamper-evidence: database-level append-only triggers on journals, approval actions, and the finance audit log; the finance audit trail exports as auditor-ready controls evidence.
Compliance Hub: expanded to 138 controls across 7 frameworks — SOC 2 Type II, ISO/IEC 27001, HITRUST CSF, HIPAA Security Rule, PCI DSS v4.0, GDPR, and NIST CSF 2.0. Evidence now harvests on a scheduler every 30 minutes rather than only when the page is opened.
Compliance Hub: honest scoring separates readiness, auto-verified, and machine-verified coverage; un-instrumented controls are labelled Manual (never assumed to pass) and an inconclusive or crashed probe reads as "attention", never green. A finalized audit record is sealed (HMAC over the score, audit period, and per-control verdict/evidence manifest) so any later edit reads as invalid, and completed records are immutable — superseded, never deleted.
Evidence vault: report-run artifacts are encrypted at rest (AES-256-GCM), keyed-HMAC sealed, and SHA-256 verified on download (a tampered artifact returns 409).
SaaS Discovery: finds the SaaS apps your people actually use by reading sign-in and usage signals from connected identity providers (Okta System Log and Google Workspace Reports) after a directory sync — surfacing accounts that match nobody in your directory and dormant accounts, marking an app corroborated when two or more sources agree, and pushing per-app active-user counts to Finance so SaaS Spend can compute reclaimable spend. It is source-bounded to the providers you connect, not a network scanner; read-only w.r.t. identity; and runs inside the sync error boundary so it never aborts a sync that already succeeded. Rides the AlignSync entitlement (an Advanced feature) behind its own read-only view_saas_discovery permission.
Licensing: the finance suite is enforced parser-side — a license middleware gates every /finance/* route on the finance entitlement.

July 2026

Security hardening, cloud-map intelligence, and a rebuilt workflow/task experience.

Workflows: designing and approving split into separate permissions, so a designer cannot promote their own version; added a real side-effect-free dry run, versioning, and JSON import/export.
Tasks: rebuilt as a master-detail console with inline step execution and an approvals view.
Org chart: health metrics, collapsible managers, matrix (dotted-line) reporting, and vacancies.
Cloud map: a relationship engine that derives topology from the account, plus identity graphs, attack paths, snapshot diffing, and data-sensitivity lenses — brought to parity across AWS, Azure, and GCP.
Security Lab: real Trivy and Nuclei scanners installed (previously these runs reported "skipped"), live run console, and an in-app self-test probe.
Secrets: plaintext .env eliminated in favour of file-based Docker secrets; weak set-once keys auto-generated on a fresh box.
Backups: configure an S3-compatible off-box destination in-app, optionally reusing already-connected AWS credentials; every backup and patch execution is written to the audit trail.
System health: host updater agent with an admin request/approve workflow for backups, OS patches, and application updates.
RBAC: an effective-access control matrix with chained dependency checks.
Recruitment: enterprise pipeline UI, live-streamed LLM screening, question bank, and real data-driven overviews replacing fabricated demo content.
E-signatures: offer letters are now signed by Zonitix Sign, our own in-house engine that runs entirely on your instance — cryptographically sealed to the PAdES standard with a trusted timestamp and a hash-chained audit trail, with no third-party e-signature account.
Finance: vendors, currency, cost centres, budgets, chargeback, approvals with separation of duties, Excel/PDF export, and bulk import.
Audit: workflow execution, cloud remediation, finance, recruitment, persona/license, and compliance actions all now mirror into the central audit log.
Licensing (breaking): the provisioning status poll moved from GET with the token in the query string to POST with it in the JSON body — the GET form now returns 410. The retrieval token became single-use and is no longer echoed back in heartbeat responses.
Licensing (breaking): heartbeat signatures now cover the telemetry fields (appVersion, userCount, metrics) and timestamps must strictly increase per licence.

June 2026

Cloud identity fusion, geo/IP access control, and the setup wizard.

Geo/IP access control using a bundled offline IP database (no third-party geo lookups), plus heartbeat hardening.
Identity fusion: cloud IAM principals cross-referenced against the employee directory to produce findings, generalised across AWS and Azure, and fed into the Compliance Hub as evidence.
Governed remediation for identity findings.
Real LDAP / local AD bind and sync (this had previously been a silent stub) and GCP added as an identity hook.
Heartbeat now reports app version and user count (host vCPU/RAM is measured on the instance but not read by the store).
Setup wizard with a branding step and a public branding endpoint.
RBAC: built-in enterprise roles (Security, Finance, Cloud), an Everyone group, automated baseline access for new users, and self-healing permission reconciliation on boot.
1Password wired into workflows, finance, and SCIM directory sync — the connection test hits the same SCIM endpoint the sync uses, so a green test predicts a working sync.

May 2026

Licensing, the store handshake, and the compliance and cloud-mapping foundations.

Secure "phone home" license sync and the automated provisioning handshake with the store.
Compliance & Audit Hub, with a live execution engine and multi-platform evidence extraction.
AWS Resource Map and Security Lab: discovery, versioning, traffic flow, and cost-integrated nodes.
Local AI service integrated for screening.
Day Zero setup wizard, on-demand setup architecture, and automated database initialisation.
Granular access control and a modularised finance dashboard.
Production Nginx, Certbot, and automatic SSL initialisation.
API gateway hardening and global auth resilience; configurable session timeouts.

April 2026

Project start.

First commit on 28 April 2026: initial project and Azure AD sync.
Identity hooks with connection testing enforced before sync, plus audit logging of hook actions.
User/group source tracking; disabled users blocked from signing in.
Org chart and the first reporting backend.
Removed the JWT secret fallback and tightened the MFA window.

Give Zonitix support temporary access

Reference Overview