v0.2.12

What's Changed

• Docs: set up the MCP server on a self-hosted instance by @simonorzel26 in #436
• Timeline: Austria NISV 2026 FAQ, Poland KSC recommendation by @simonorzel26 in #438
• Walkthrough: first five steps free, offer at the gate; exports and sign-offs need an order by @simonorzel26 in #437
• E2E: run only the specs a pull request touches; the whole suite on main and nightly by @simonorzel26 in #440
• GDPR walkthrough (DSGVO Durchgang) by @simonorzel26 in #430
• Billing: an unpaid invoice suspends the licence by itself, and its payment reopens it (AGB B9) by @simonorzel26 in #439
• Wiki: "NIS2 Frist verpasst?", one page for every EU country by @simonorzel26 in #433
• README: what open-isms does for a company, with the docs as links by @simonorzel26 in #441
• Pricing: narrower, calmer cards by @simonorzel26 in #442
• Platform admin: Active users tab by @simonorzel26 in #443
• Platform admin: user search and a user dialog with the activity log by @simonorzel26 in #444
• Platform admin: tabs in the URL by @simonorzel26 in #445
• Security review fixes for #439 and #440 by @simonorzel26 in #446
• B9: audited in one step, manual revokes stay, fewer Qonto calls by @simonorzel26 in #447
• Platform admin: "Invited users" tab, who invited whom by @simonorzel26 in #448
• Test MCP endpoint, event log with dates and stored data, adjustable active-users window by @simonorzel26 in #449
• Active users: signed in or did something, not sign-in only by @simonorzel26 in #450
• Close sync: note each platform mail on the person's timeline by @simonorzel26 in #452
• Test MCP: browser sign-in for the operator's assistant by @simonorzel26 in #451
• Close sync: poll Resend and note its mail on the recipients' contacts by @simonorzel26 in #453
• Close sync: log Resend mail as emails on the contact, and redo the history by @simonorzel26 in #454
• Sign-in: say where the sign-in leads, above the card by @simonorzel26 in #456
• One price for everyone: grandfathered accounts pay 4.800 too by @simonorzel26 in #457
• Platform admin event log: names for the ids in stored values, people clickable by @simonorzel26 in #458
• Newsletter: never send to paying customers by @simonorzel26 in #459
• Admin user dialog: good time to reach them, and the company in a modal by @simonorzel26 in #461
• Analytics: the assistant connect page is a token route, so Umami no longer stores its URL by @simonorzel26 in #464
• MCP: every assistant call in the company's log, marked as MCP by @simonorzel26 in #460
• Export: one section per framework, with the GDPR's own files by @simonorzel26 in #462
• Supplier invite names the person who sent it by @simonorzel26 in #465
• CRA and AI Act timelines, one shared timeline UI, NIS2 post-quantum guideline by @simonorzel26 in #466
• MCP: read_records, the company's records as the export holds them (do not merge) by @simonorzel26 in #463
• Supplier portal: customers that invited your address appear under Customers by @simonorzel26 in #467
• Supplier portal: add a customer without an email, change or remove the contact by @simonorzel26 in #468
• Supplier portal: Delete customer in the page header, with a confirmation modal by @simonorzel26 in #469
• Supplier portal: several people per customer, each with a link of their own by @simonorzel26 in #471
• Course: sticky lesson navigation, scroll to top, course title, certificate on lesson 0.1 by @simonorzel26 in #475
• Course to walkthrough: blue button under the lesson title, counted clicks, locked items open read only by @simonorzel26 in #476
• Course end: do it yourself or hand it on; course shown in the walkthrough; CEO in the English title by @simonorzel26 in #477
• Course and walk: legal copy and review fixes after #475 to #477 by @simonorzel26 in #478
• Walk: a locked step shows the walk's steps beside it by @simonorzel26 in #481
• Billing: any admin can order an unpaid account and becomes the payer; no dead end on /order by @simonorzel26 in #482
• Add organization: choose the billing account that pays for it by @simonorzel26 in #483
• CEO course: fix case facts and overclaims (EN, DE) by @simonorzel26 in #484
• CONTRIBUTING: course fixes, running your own copy, course licence by @simonorzel26 in #485
• Show the AGPL notices on sign-in and in the portal; say when an install is not nisd2.eu by @simonorzel26 in #486
• Seed NIS 2 on first boot whenever it is missing, not only on an empty catalogue by @simonorzel26 in #488
• Self-hosted image: the compliance app only; courses, legal pages, wiki and supplier portal stay at nisd2.eu by @simonorzel26 in #487

Full Changelog: v0.2.11...v0.2.12

v0.2.11

What's Changed

• docs: every way into a fresh instance, not just Resend by @simonorzel26 in #159
• seo: front-load and trim meta titles and descriptions on ranked pages by @simonorzel26 in #163
• fix(security): hardening pass from the 2026-09-10 audit by @simonorzel26 in #164
• partner: ACS Teilnehmer badge and five programme logos by @simonorzel26 in #165
• landing: partner logo strip, all seven marks in one colour by @simonorzel26 in #166
• chore(i18n): drop the dead landing.regLine key by @simonorzel26 in #167
• platform-admin: Graphs tab, supplier questionnaire completeness by @simonorzel26 in #168
• platform-admin: weekly insights panel on the Graphs tab by @simonorzel26 in #169
• platform-admin: stop the insights panel repeating itself by @simonorzel26 in #170
• fix(ci): pull the minio images from quay.io, not Docker Hub by @simonorzel26 in #173
• fix(auth): a correct sign-up code has to end with the person signed in by @simonorzel26 in #172
• fix(auth): resend-verification honours the sign-up quality gate by @simonorzel26 in #174
• Journey: a guided path for companies where one person implements NIS 2 by @simonorzel26 in #176
• NIS 2 framework: incident handling after the inventories, and the four non-negotiables first by @simonorzel26 in #175
• Sign-off: a past signature no longer locks everyone else out by @simonorzel26 in #178
• Make a redeploy cheaper than a first build by @simonorzel26 in #177
• gdpr: correct five citations and credit Art. 32 from the NIS 2 work that earns it by @simonorzel26 in #180
• Unsubscribing from one email stops all optional email by @coryhighsea in #179
• Referral requests: a form where the mailto was, and somewhere to count them by @simonorzel26 in #181
• chore(deps-dev): bump react-email from 6.9.3 to 6.9.5 by @dependabot[bot] in #171
• grc-data-model: content CC BY 4.0, code MIT (AI use expressly permitted) by @simonorzel26 in #182
• Platform-admin scoreboard: discharged duties, paid referrals, drop-off, invite lists by @simonorzel26 in #183
• Cap static generation at one worker, so the builder stops being OOM-killed by @simonorzel26 in #185
• Centre the guided path on the section dividers, and crop the hero tighter by @simonorzel26 in #186
• Billing foundation: Qonto invoicing, VAT checks and the order page by @simonorzel26 in #190
• Billing accounts and company membership (multi-company, release A) by @simonorzel26 in #191
• Several organizations per login: switcher, add another, invites (multi-company, release B) by @simonorzel26 in #192
• Tenant isolation hardening by @simonorzel26 in #193
• Hotfix: organization and onboarding forms fail on billingAccountId by @simonorzel26 in #194
• Order service: one placeOrder, /bestellen on tRPC, billing page (slice 4) by @simonorzel26 in #195
• MinIO from Chainguard: MinIO's own images can no longer be pulled by @simonorzel26 in #196
• Slice 5: access gate, per-person grandfathering, one-time pricing launch by @simonorzel26 in #197
• Slice 6: door two (close on the call) and account setup links by @simonorzel26 in #198
• Remove the AI question from organization onboarding by @simonorzel26 in #199
• Legal pages can be copied again by @simonorzel26 in #202
• Block further orders on the server after an unclear Qonto answer by @simonorzel26 in #200
• Report: print each not-applicable reason with its date and signer by @simonorzel26 in #201
• Slice 9: cancel, the Subscriptions tab, and 2.400 for grandfathered people by @simonorzel26 in #204
• Legal pages: correct the TOMs to the code, drop xAI by @simonorzel26 in #206
• TOMs: one US service left, not two by @simonorzel26 in #207
• Paid terms, AVV and order acceptance (draft for review) by @simonorzel26 in #205
• Pricing page: the paid offer, the grandfathered price, what you get by @simonorzel26 in #203
• Pricing page: platform admins see the paid offer before the launch by @simonorzel26 in #208
• Guided form, slice 1: schema for BSI controls and control decisions by @simonorzel26 in #187
• Journey: one order everywhere, prerequisites win; Durchgang walks the first ten items by @simonorzel26 in #189
• Landing page: hero for the 50 to 150 ICP, behind the launch flag, admins preview by @simonorzel26 in #209
• Pricing page: three tiers, the paid one in the middle by @simonorzel26 in #210
• Close CRM: keep every account up to date in Close, on a schedule inside the app by @coryhighsea in #211
• Close sync: read the new contact from the create-lead response Close really sends by @simonorzel26 in #212
• Promo link that grandfathers on sign-in, and translated slugs for pricing and ordering by @simonorzel26 in #213
• Tighten sign-in callback check, atomic OTP attempts, per-IP login limit by @simonorzel26 in #216
• Certificates for every course, and more than one admin per organization by @coryhighsea in #214
• Say "too many attempts" when a rate limit blocks; drill verifyOtp on Postgres by @simonorzel26 in #217
• Server-attributed risk acceptance, member-checked approvers, own-folder file keys, admin-only new companies by @simonorzel26 in #222
• Sign-off integrity: intake authorization, approved rows, removed members by @simonorzel26 in #221
• Supplier portal: keep each side's data on the shared relationship row by @simonorzel26 in #218
• Keep platform-admin actions out of tenant audit logs; audit trail for reviewers and admins by @simonorzel26 in #220
• Training: quiz lessons complete only by passing; lesson locale allowlist; AI and upload limits by @simonorzel26 in #223
• Instrumentation: keep the CRM import inside the nodejs branch by @simonorzel26 in #225
• Durchgang for paid accounts only by @simonorzel26 in #226
• Requirement page: Reopen, not Sign off, on a signed row that needs review by @simonorzel26 in #229
• Supplier register: lock the supplier's clause answers on linked rows; localized upload limit message by @simonorzel26 in #228
• Supplier invites: the customer's address on the relationship, one row per inviting customer by @simonorzel26 in #227
• BSI default corrections (Durchgang shot 1 of 7) by @simonorzel26 in #231
• Rate limits counted in Postgres instead of per process by @simonorzel26 in #230
• tRPC transport: no internal error text, batch cap, JSON-only mutations; vendor input checks; blank env as unset by @simonorzel26 in #233
• Invite redirect, CSV formulas, newsletter link protocols, no analytics on token pages by @simonorzel26 in #234
• Supplier portal mail: no attacker-written text, per-company budgets, invite re-send cooldown by @simonorzel26 in #235
• Close tab in the platform admin: sync settings, progress, runs, and Run now by @simonorzel26 in #238
• Bound intake answers; erasure deletes the organization's files and scrubs addresses by @simonorzel26 in #236
• Auth: pin the Google account, revoke on sign-out, 12-hour session cap, no account enumeration by @simonorzel26 in #237
• Import isSuppressedSendId from mail/delivery (fixes 4 unit tests on main) by @simonorzel26 in #239
• Durchgang core: script, copy, item state, one BSI 200-3 module (shot 3a of 7) by @simonorzel26 in #232
• Guided step illustrations: brand theme, Recraft prompt and SVG finishing script by ...

v0.2.10

What's Changed

• fix(mail): the footer speaks the language the email is written in by @simonorzel26 in #156
• feat(self-host): get in without a mail provider, and see the sends that fail by @simonorzel26 in #157
• fix(i18n): restore German umlauts and Italian accents in translated copy by @simonorzel26 in #158
• fix(i18n): persist the language switch so email can read it by @simonorzel26 in #160
• refactor(i18n): one source for the locale set, and fix three defects from #160 by @simonorzel26 in #162
• fix(self-host): a reinstall says what went wrong instead of throwing 28P01 by @simonorzel26 in #161

Full Changelog: v0.2.9...v0.2.10

v0.2.9

What's Changed

• feat(pricing): self-hosting is free, the licence is gone by @simonorzel26 in #116
• docs: trim the search trigger to 32px by @simonorzel26 in #117
• fix(wiki): general NIS 2 registration is Art. 3(4), not Art. 27 by @simonorzel26 in #118
• fix(seo,i18n): give wiki pages a next step, stop MISSING_MESSAGE 500s by @simonorzel26 in #127
• chore(deps): bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #120
• legal(impressum): name Simon Orzel as the responsible party by @simonorzel26 in #133
• legal: replace the UG with Simon Orzel across the codebase by @simonorzel26 in #134
• fix(audit): record the sign-off invalidations the trail was dropping by @simonorzel26 in #136
• fix(supplier-portal): show customers the service and the incidents meant for them by @simonorzel26 in #137
• test(e2e): make the suite prove what it claims, and cover the supplier portal by @simonorzel26 in #138
• fix(compliance): close the gaps dogfooding found, and the same classes elsewhere by @simonorzel26 in #142
• Lifecycle emails: bring quiet signups back, at most once by construction by @simonorzel26 in #141
• fix(guidance): four wrong legal claims, and the guard holes that hid them by @simonorzel26 in #144
• Per-message email preferences: a consent gate that cannot be skipped by @simonorzel26 in #143
• Let people reach the preference centre without signing in by @simonorzel26 in #146
• wiki: Vanta and Drata alternative pages (10 locales) by @simonorzel26 in #145
• A sender people recognise, and subjects worth opening by @simonorzel26 in #147
• chore(deps-dev): bump vitest from 4.1.11 to 5.0.0 by @dependabot[bot] in #140
• chore(deps): bump actions/attest-build-provenance from 2 to 4 by @dependabot[bot] in #139
• courses: state the CC BY licence on the book's imprint page by @simonorzel26 in #132
• fix(ci): sync bun.lock with the vitest 5 bump dependabot left half-applied by @simonorzel26 in #148
• Email console: per-row sends, previews, digest tests, honest graph by @simonorzel26 in #149
• Overdue means overdue: honest deadlines in emails, badges and counts by @simonorzel26 in #150
• Digest CTA is the next step, not the dashboard by @simonorzel26 in #151
• Digest review findings: deterministic assignee, one truth for open items by @simonorzel26 in #152
• feat(mail): SMTP transport, so self-hosting needs no email SaaS account by @simonorzel26 in #154
• Repo cleanup: duplicate assets, duplicated docs, and a linter nobody ran by @simonorzel26 in #153

Full Changelog: v0.2.8...v0.2.9

v0.2.8

What's Changed

• release: make releasing a decision rather than a side effect of merging by @simonorzel26 in #112
• migrations: prove the failure path, and make rule 3 possible to follow by @simonorzel26 in #113
• release: give the upgrade gate data to trip over by @simonorzel26 in #114
• ci: run shellcheck, and fix what it found by @simonorzel26 in #115

Full Changelog: v0.2.7...v0.2.8

v0.2.7

What's Changed

• e2e: run the suite against a published image, in the published stack by @simonorzel26 in #111

Full Changelog: v0.2.6...v0.2.7

v0.2.6

What's Changed

• docs: list all three npm packages, and correct the counts against the data by @simonorzel26 in #109
• ci: cancel superseded runs, and stop re-testing main twice by @simonorzel26 in #110

Full Changelog: v0.2.5...v0.2.6

v0.2.5

What's Changed

• chore: correct what drifted, now that the packages are actually published by @simonorzel26 in #108

Full Changelog: v0.2.4...v0.2.5

v0.2.4

What's Changed

• packages: let the dts builds finish so npm publishing can run by @simonorzel26 in #107

Full Changelog: v0.2.3...v0.2.4

v0.2.3

What's Changed

• release: keep latest tracking stable instead of leaving it stranded by @simonorzel26 in #106

Full Changelog: v0.2.2...v0.2.3