v0.2.11

What's Changed

• docs: every way into a fresh instance, not just Resend by @simonorzel26 in #159
• seo: front-load and trim meta titles and descriptions on ranked pages by @simonorzel26 in #163
• fix(security): hardening pass from the 2026-09-10 audit by @simonorzel26 in #164
• partner: ACS Teilnehmer badge and five programme logos by @simonorzel26 in #165
• landing: partner logo strip, all seven marks in one colour by @simonorzel26 in #166
• chore(i18n): drop the dead landing.regLine key by @simonorzel26 in #167
• platform-admin: Graphs tab, supplier questionnaire completeness by @simonorzel26 in #168
• platform-admin: weekly insights panel on the Graphs tab by @simonorzel26 in #169
• platform-admin: stop the insights panel repeating itself by @simonorzel26 in #170
• fix(ci): pull the minio images from quay.io, not Docker Hub by @simonorzel26 in #173
• fix(auth): a correct sign-up code has to end with the person signed in by @simonorzel26 in #172
• fix(auth): resend-verification honours the sign-up quality gate by @simonorzel26 in #174
• Journey: a guided path for companies where one person implements NIS 2 by @simonorzel26 in #176
• NIS 2 framework: incident handling after the inventories, and the four non-negotiables first by @simonorzel26 in #175
• Sign-off: a past signature no longer locks everyone else out by @simonorzel26 in #178
• Make a redeploy cheaper than a first build by @simonorzel26 in #177
• gdpr: correct five citations and credit Art. 32 from the NIS 2 work that earns it by @simonorzel26 in #180
• Unsubscribing from one email stops all optional email by @coryhighsea in #179
• Referral requests: a form where the mailto was, and somewhere to count them by @simonorzel26 in #181
• chore(deps-dev): bump react-email from 6.9.3 to 6.9.5 by @dependabot[bot] in #171
• grc-data-model: content CC BY 4.0, code MIT (AI use expressly permitted) by @simonorzel26 in #182
• Platform-admin scoreboard: discharged duties, paid referrals, drop-off, invite lists by @simonorzel26 in #183
• Cap static generation at one worker, so the builder stops being OOM-killed by @simonorzel26 in #185
• Centre the guided path on the section dividers, and crop the hero tighter by @simonorzel26 in #186
• Billing foundation: Qonto invoicing, VAT checks and the order page by @simonorzel26 in #190
• Billing accounts and company membership (multi-company, release A) by @simonorzel26 in #191
• Several organizations per login: switcher, add another, invites (multi-company, release B) by @simonorzel26 in #192
• Tenant isolation hardening by @simonorzel26 in #193
• Hotfix: organization and onboarding forms fail on billingAccountId by @simonorzel26 in #194
• Order service: one placeOrder, /bestellen on tRPC, billing page (slice 4) by @simonorzel26 in #195
• MinIO from Chainguard: MinIO's own images can no longer be pulled by @simonorzel26 in #196
• Slice 5: access gate, per-person grandfathering, one-time pricing launch by @simonorzel26 in #197
• Slice 6: door two (close on the call) and account setup links by @simonorzel26 in #198
• Remove the AI question from organization onboarding by @simonorzel26 in #199
• Legal pages can be copied again by @simonorzel26 in #202
• Block further orders on the server after an unclear Qonto answer by @simonorzel26 in #200
• Report: print each not-applicable reason with its date and signer by @simonorzel26 in #201
• Slice 9: cancel, the Subscriptions tab, and 2.400 for grandfathered people by @simonorzel26 in #204
• Legal pages: correct the TOMs to the code, drop xAI by @simonorzel26 in #206
• TOMs: one US service left, not two by @simonorzel26 in #207
• Paid terms, AVV and order acceptance (draft for review) by @simonorzel26 in #205
• Pricing page: the paid offer, the grandfathered price, what you get by @simonorzel26 in #203
• Pricing page: platform admins see the paid offer before the launch by @simonorzel26 in #208
• Guided form, slice 1: schema for BSI controls and control decisions by @simonorzel26 in #187
• Journey: one order everywhere, prerequisites win; Durchgang walks the first ten items by @simonorzel26 in #189
• Landing page: hero for the 50 to 150 ICP, behind the launch flag, admins preview by @simonorzel26 in #209
• Pricing page: three tiers, the paid one in the middle by @simonorzel26 in #210
• Close CRM: keep every account up to date in Close, on a schedule inside the app by @coryhighsea in #211
• Close sync: read the new contact from the create-lead response Close really sends by @simonorzel26 in #212
• Promo link that grandfathers on sign-in, and translated slugs for pricing and ordering by @simonorzel26 in #213
• Tighten sign-in callback check, atomic OTP attempts, per-IP login limit by @simonorzel26 in #216
• Certificates for every course, and more than one admin per organization by @coryhighsea in #214
• Say "too many attempts" when a rate limit blocks; drill verifyOtp on Postgres by @simonorzel26 in #217
• Server-attributed risk acceptance, member-checked approvers, own-folder file keys, admin-only new companies by @simonorzel26 in #222
• Sign-off integrity: intake authorization, approved rows, removed members by @simonorzel26 in #221
• Supplier portal: keep each side's data on the shared relationship row by @simonorzel26 in #218
• Keep platform-admin actions out of tenant audit logs; audit trail for reviewers and admins by @simonorzel26 in #220
• Training: quiz lessons complete only by passing; lesson locale allowlist; AI and upload limits by @simonorzel26 in #223
• Instrumentation: keep the CRM import inside the nodejs branch by @simonorzel26 in #225
• Durchgang for paid accounts only by @simonorzel26 in #226
• Requirement page: Reopen, not Sign off, on a signed row that needs review by @simonorzel26 in #229
• Supplier register: lock the supplier's clause answers on linked rows; localized upload limit message by @simonorzel26 in #228
• Supplier invites: the customer's address on the relationship, one row per inviting customer by @simonorzel26 in #227
• BSI default corrections (Durchgang shot 1 of 7) by @simonorzel26 in #231
• Rate limits counted in Postgres instead of per process by @simonorzel26 in #230
• tRPC transport: no internal error text, batch cap, JSON-only mutations; vendor input checks; blank env as unset by @simonorzel26 in #233
• Invite redirect, CSV formulas, newsletter link protocols, no analytics on token pages by @simonorzel26 in #234
• Supplier portal mail: no attacker-written text, per-company budgets, invite re-send cooldown by @simonorzel26 in #235
• Close tab in the platform admin: sync settings, progress, runs, and Run now by @simonorzel26 in #238
• Bound intake answers; erasure deletes the organization's files and scrubs addresses by @simonorzel26 in #236
• Auth: pin the Google account, revoke on sign-out, 12-hour session cap, no account enumeration by @simonorzel26 in #237
• Import isSuppressedSendId from mail/delivery (fixes 4 unit tests on main) by @simonorzel26 in #239
• Durchgang core: script, copy, item state, one BSI 200-3 module (shot 3a of 7) by @simonorzel26 in #232
• Guided step illustrations: brand theme, Recraft prompt and SVG finishing script by @simonorzel26 in #224
• Privacy policy: Close as our sales system (CRM), in all ten languages by @simonorzel26 in #240
• Durchgang copy for the other seven v1 items (shot 3b of 7) by @simonorzel26 in #241
• Correct NIS 2 facts in the CEO course, wiki and guidance (all locales) by @simonorzel26 in #242
• Durchgang shot 4: the walk on real data, assets named and rated, old /durchgang removed by @simonorzel26 in #243
• Order page: the invoice they will receive, beside the form by @simonorzel26 in #245
• After the order: confirmation with the way into the Durchgang; invoice email links the invoice by @simonorzel26 in #246
• Erasure: email the certificate to the erased person by @simonorzel26 in #247
• Order page: a paid account goes to its billing page by @simonorzel26 in #248
• Delete account from the user menu, with the erasure certificate emailed; review fixes by @simonorzel26 in #249
• Erasure hardening: re-sign-in for self-deletion, IP and browser scrubbed, admin notes redacted by @simonorzel26 in #251
• Order form country picker; journey rail and sections keyed uniquely by @simonorzel26 in #252
• Account deletion and privacy paragraph in seven more languages; operator lines on ethik and finanzierung by @simonorzel26 in #253
• Session: refuse a token by account id, not by sign-in time; lock what self-erasure counts; no query params in the tRPC log by @simonorzel26 in #254
• Daily deadline run scheduled inside the app, like the Close sync by @simonorzel26 in #258
• Platform admin: how many people have been erased by @simonorzel26 in #260
• Self-service deletion for accounts with invoices; the certificate names what tax law keeps by @simonorzel26 in #261
• Deleting an account cancels its open licence; Billing opens for a draft organization by @simonorzel26 in #262
• Privacy policy: billing data, Qonto, and invoices kept after account deletion by @simonorzel26 in #263
• Intake: merge a save into answers read under a row lock by @simonorzel26 in #244
• CEO course: the right NIS 2 articles, and the CIR only for CIR providers, all locales by @simonorzel26 in #259
• Customer emails: one layout that names the sender, billing letters with the document's facts, a refund confirmation by @simonorzel26 in #274
• One letter when a licence holder deletes their account, and a sale email to the operators by @simonorzel26 in #276
• Remove two mail exports nothing uses by @simonorzel26 in #277
• Replies to the nudge, course follow-up and newsletter reach contact@nisd2.eu by @simonorzel26 in #278
• Email footer names the company's seat, Köln by @simonorzel26 in #279
• Durchgang: the guided walk through every NIS 2 item, in one PR by @simonorzel26 in #275
• Sidebar: the walkthrough shown as coming soon by @simonorzel26 in #280
• Free accounts land on an offer inside the portal, not a full-page order form by @simonorzel26 in #281
• The walkthrough is the NIS 2 walkthrough, at /durchgang/nis2 by @simonorzel26 in #282
• Portal breadcrumb in the visitor's language; the gate redirects instead of logging FORBIDDEN by @simonorzel26 in #283
• Keep webpack's build cache in memory, so the Coolify build stops being OOM-killed by @simonorzel26 in #284
• The walkthrough in English at /walkthrough/nis2, its home inside the portal, the sidebar link for platform admins only by @simonorzel26 in #285
• The courses open inside the portal's own sidebar by @simonorzel26 in #286
• The training portal keeps its own sidebar, reached from the portal switcher by @simonorzel26 in #288
• A picture for every course and every lesson by @simonorzel26 in #289
• The walkthrough's approval signs off the requirements, and the journey shows what waits for it by @simonorzel26 in #287
• The offer gets its own layout, so entering the portal from another portal no longer loops by @simonorzel26 in #290
• A sign-off never credits another requirement of its own framework, and the management review is signed last by @simonorzel26 in #292
• The walkthrough lives in the portal and becomes its front at launch: flag, access by plan, a new walk home with screenshot previews by @simonorzel26 in #291
• Every account signs in to the walk; an unpaid one sees it locked with "Jetzt bestellen" by @simonorzel26 in #293
• Everything in one document: the complete export page, a realistic demo walk, and German throughout by @simonorzel26 in #294
• Unpaid accounts land on the locked walk, the company is set up in its first step, and free accounts see the registers as examples by @simonorzel26 in #295
• Retire the billing and walkthrough switches by @simonorzel26 in #297
• Landing page: the NIS 2 walkthrough shown screen by screen by @simonorzel26 in #296
• Pricing: one English name (NIS 2 walkthrough) and the gap analysis anchor by @simonorzel26 in #298
• Pricing: talk first, a page for the approver, buyer FAQ by @simonorzel26 in #300
• Walkthrough: UI notes from 04.10 (blocked Continue, waiting sheet, course progress, in house or cloud) by @simonorzel26 in #301
• Landing: first-step picture, step 6 screenshot, walk title above the fold by @simonorzel26 in #302
• About page in the landing page's design; one Get started block on landing, about and wiki by @simonorzel26 in #304
• Landing in all ten languages, home OG card per language by @simonorzel26 in #303
• Locked walk: each step previews its own screen on hover by @simonorzel26 in #299
• Share previews show the current landing page in every language by @simonorzel26 in #306
• Landing page: 517 KB to 196 KB, og:url, theme-color, manifest, SVG icon, contrast by @simonorzel26 in #307
• CEO course: every link into the product leads to the walk by @simonorzel26 in #308
• Supplier questionnaire 4.0.0 (legal review, any supplier, ISO 27001), and the operator as every customer's first supplier by @simonorzel26 in #305
• Walk: set up the company right after the registration by @simonorzel26 in #309
• Hold back the AI prefill button on every form (the prefill itself stays) by @simonorzel26 in #310
• Example activity log entries by Max Mustermann / John Smith, not the viewer by @simonorzel26 in #311
• Supplier side: questionnaire landing in the home page's form, nav link, supplier portal in German, organization id to copy by @simonorzel26 in #312
• Wiki: timeline shows the newest 5, wiki pages end on the landing headline by @simonorzel26 in #313
• Wiki status pages: EU tracker, EU implementation and Germany brought to October 2026 by @simonorzel26 in #314
• Wiki NIS2 roadmap rebuilt around the walkthrough; review fixes for #310 to #312; platform supplier listed as nisd2.eu by @simonorzel26 in #315
• Platform supplier also lands in each customer's asset register as the cloud service nisd2.eu by @simonorzel26 in #317
• Wiki status follow-ups: Denmark, Sweden, Italy, Lithuania, Dutch Germany page by @simonorzel26 in #316
• Pricing page in seven more languages by @simonorzel26 in #321
• Wiki facts: France, Netherlands, Spain, CIR, significant incident, IT security duty, logistics (10 languages) by @simonorzel26 in #318
• Wiki facts, part 2: Ireland, Sweden, Finland, Belgium and four more countries; nine implementation pages (10 languages) by @simonorzel26 in #319
• Landing: 'Lieber erst mit uns sprechen?' button under Jetzt starten; booking links keep campaign tags by @simonorzel26 in #322
• Wiki: 50 pages end on the walkthrough's own steps (merge after #318 and #319) by @simonorzel26 in #320
• Walk home: 'Lieber erst mit uns sprechen?' beside 'Jetzt bestellen' by @simonorzel26 in #323
• Signup notice: Follow up opens a prepared offer mail in the signup's language by @simonorzel26 in #324
• Wiki: each search points to the page that answers it by @simonorzel26 in #325
• Pricing and help pages: current prices, register from the landing page by @simonorzel26 in #326
• Signup keeps the utm tags of the page it started from by @simonorzel26 in #327
• Hand the order to management from the walk's lock by @simonorzel26 in #328
• Signup and order buttons open registration and keep the page's utm tags by @simonorzel26 in #329
• /nis2-tool: correct pricing claims, retitle as NIS2 Software, add next steps by @simonorzel26 in #330
• GetStarted on wiki, /about, /nis2-tool: show the app like the landing hero by @simonorzel26 in #331
• Hero image requests a width that fits the screen by @simonorzel26 in #332
• Wiki: four implementation pages answer their search in plain words by @simonorzel26 in #333
• Booking calendar opens in a dialog on every talk-first link by @simonorzel26 in #335
• Landing zoom: gentler hero zooms, questionnaire stops land on whole questions by @simonorzel26 in #334
• Courses: pictures, links to the overview, honest free line, next step after the course by @simonorzel26 in #336
• Wiki: popular pages answer their search in plain words by @simonorzel26 in #337
• About page: founders' phone numbers by @coryhighsea in #338
• Security review fixes: cal.com without script, invite cap, first signup campaign kept, Cal.com in privacy policy by @simonorzel26 in #339
• Homepage: 'NIS2 Software' in the eyebrow and page title (DE, EN), so the software search finds its words on the page the ad lands on by @simonorzel26 in #340
• Ad landing pages open like the homepage: app shot and programme logos by @simonorzel26 in #341
• Approval page: the decision on the first screen by @simonorzel26 in #342
• Walk: header and bar stay above the sliding screen by @simonorzel26 in #343
• Landing: the walk's video replaces the hero shot once it has loaded by @simonorzel26 in #344
• Sign-in: a terms notice instead of a checkbox, so Google sign-in is never blocked by @simonorzel26 in #345
• Walk overview: the four promise cards are plain, without screenshot previews by @simonorzel26 in #346
• Portals: language switcher in the top bar beside the help by @simonorzel26 in #347
• Partner agreements: offer one from platform admin, the partner accepts on a link by @simonorzel26 in #348
• Partner agreements come with a login: accepting gives the partner the Durchgang by @simonorzel26 in #349
• Partner agreement page opens with a short product brief by @simonorzel26 in #350
• Partner access comes with the offer, before signing by @simonorzel26 in #352
• Landing: sell the outcome first by @simonorzel26 in #351
• Landing: drop the 'What you get' block after the close by @simonorzel26 in #353
• Course pages: titles, meta and headings match how people search for the training by @simonorzel26 in #354
• OG images: full re-render after the course page headings changed by @simonorzel26 in #355
• Platform admin: reissue an unpaid invoice with an agreed service period by @coryhighsea in #356
• feat(partner): list the Claude for Startups membership on /partner by @simonorzel26 in #357
• copy: talk-first label becomes 'Book a call' by @simonorzel26 in #358
• Admin graph: new accounts per month, CEO course versus platform only by @simonorzel26 in #359
• Second-login dialog: one sentence and a Book a call button by @simonorzel26 in #360
• feat(partner-agreement): branded top block and trial access line by @simonorzel26 in #362
• feat(onboarding): help dialog uses the founder card for Book a call by @simonorzel26 in #363
• fix(auth): registering with an existing account's credentials signs in, code screen links to sign-in by @simonorzel26 in #364
• feat(durchgang): each open point at the approval gets who and by when by @simonorzel26 in #365
• fix(i18n): Czech as a full language, citing Czech law where German pages cite the BSIG by @simonorzel26 in #366
• Graphs: where signups come from, and traffic above the funnel by @simonorzel26 in #367
• Graphs: default to a month, tell real visits from automated ones by @simonorzel26 in #368
• MCP: AI assistants read and fill the NIS 2 walkthrough by @simonorzel26 in #361
• timeline: 16 October sweep, 4 events added, France and Germany portal entries refreshed by @simonorzel26 in #369
• Settings: remove the AI Data Sharing card, link Settings from the profile menu by @simonorzel26 in #370
• Wiki: 33 pages on AI assistants and MCP (NIS2, GDPR, ISO 27001, CRA), released 3 to 4 a day; MCP docs up to date by @simonorzel26 in #371
• Search: real sitemap dates, DE/EN-only pages point other languages to English, one site name, a real logo by @simonorzel26 in #372
• Wiki: 14 GDPR pages and a waitlist for the DSGVO Durchgang by @simonorzel26 in #374
• Search Console: moved wiki pages leave the sitemap and 308 per language, mistyped URLs redirect by @simonorzel26 in #373
• Sitemap: list only the language versions that have their own text; Czech dated 15.10 by @simonorzel26 in #375
• www.nisd2.eu answers 308 for every path; sicherheitsfragebogen.de goes to the apex in one hop by @simonorzel26 in #376
• Locked Durchgang: a click or tap on a step keeps its screenshot open with the way on under it by @simonorzel26 in #377
• llms.txt: describe the product as it is now, link only pages that answer 200 by @simonorzel26 in #379
• Language copies name the original as their canonical and leave every hreflang set by @simonorzel26 in #378
• Public descriptions: drop "free", "management liability protection", "cut the bill in half" and two unsourced figures by @simonorzel26 in #380
• README: add a section on the MCP endpoint by @simonorzel26 in #381
• README: reference the MCP in the intro, folder tree and tech stack by @simonorzel26 in #382
• Wiki: Richtlinien schreiben, first guide on the risk assessment methodology by @simonorzel26 in #383
• Exit pages: the course, a call and the walkthrough as ways forward by @simonorzel26 in #393
• Walkthrough: § 28(5) BSIG exemption in full, § 35(2) BSIG, Art. 21(4) as directive text by @simonorzel26 in #397
• Signing: done only by a signature, no admin in a role's place by @simonorzel26 in #394
• Evidence: deleting it sends a signed requirement back to needs review by @simonorzel26 in #395
• Credit across frameworks only for the same record by @simonorzel26 in #396
• One list of the package's frameworks, and an integrity test over all of them by @simonorzel26 in #392
• Requirement copy in parts, one per framework, read as one namespace by @simonorzel26 in #386
• Glossary generated from the dictionaries, with a fact-check of every entry by @simonorzel26 in #398
• Pricing: self-hosting as one line under the cards, not a third card by @simonorzel26 in #400
• Third-party standards: ISO titles and descriptions excluded from the licences, LICENSE-DATA.md by @simonorzel26 in #385
• GDPR data checked against the Official Journal: copy, references, intervals by @simonorzel26 in #387
• ISO 27001 clause copy in our own words, our own German titles, Amendment 1:2024 by @simonorzel26 in #388
• Sign-off wording: the app's rule, not the law's by @simonorzel26 in #391
• One source for the done status list; sign-off role narrowed, not cast by @simonorzel26 in #401
• CRA data checked against the Official Journal by @simonorzel26 in #389
• ISO 27001 Annex A descriptions in our own words by @simonorzel26 in #390
• Pricing: cards use the page width, the offer fits the first screen by @simonorzel26 in #402
• Info, wiki, funnel and course pages: article and point citations checked against the primary texts by @simonorzel26 in #399
• Pricing: no 'recommended' badge on the only offer by @simonorzel26 in #404
• Pricing: say each thing once by @simonorzel26 in #405
• Cross-framework credit rule tested; README pair counts from REFERENCE.md by @simonorzel26 in #403
• File size check: no hand-written file over 5,000 tokens, in a pre-commit hook and in CI by @simonorzel26 in #384
• Pricing: two equal cards, built the same way, order and call side by side by @simonorzel26 in #407
• Pricing: 400 € a month, invoiced yearly by @simonorzel26 in #408
• NIS2 to ISO 27001 links from ENISA's mapping table v1.2 by @simonorzel26 in #406
• Order page: the terms before the button as accordion rows by @simonorzel26 in #409
• Google sign-in links to a password account on Gmail and Workspace addresses by @simonorzel26 in #410
• Pricing: the offer on the left, NIS2 as one word, the site mark before it by @simonorzel26 in #412
• CI: database drills in one job, plus a drill for cross-framework credit by @simonorzel26 in #411
• Pricing: the paid offer lists the MCP server by @simonorzel26 in #413
• Pricing: the free tier is Self Serve and includes self-hosting by @simonorzel26 in #415
• Analytics: keep partner agreement links out of Umami by @simonorzel26 in #417
• Pricing: order button says 30 days, money back by @simonorzel26 in #418
• Sign-off history helpers take a transaction; drill covers assigned signers by @simonorzel26 in #416
• Package licences: Kardashev Catalyst UG as copyright holder by @simonorzel26 in #414
• Landing: the main button says 30 days, money back, like the pricing card by @simonorzel26 in #422
• e2e: fix the flaky later-login tour test by @simonorzel26 in #421
• NIS2 review intervals: none without a legal basis for every entity by @simonorzel26 in #419
• MCP: the assistant sends suppliers on the list the security questionnaire by @simonorzel26 in #426
• NIS2 citations: the BSIG row cites the BSIG, the CIR gets its own row by @simonorzel26 in #420
• What was signed and what was approved, kept for good by @simonorzel26 in #423
• Walkthrough copy in parts: one per walk item, three for the shared screens by @simonorzel26 in #424
• Information security policy: the all-hazards approach covers the rooms the IT is in by @simonorzel26 in #425
• Every button that starts the product makes the order button's promise by @simonorzel26 in #427
• Emails: the nudge names the walkthrough, a shorter welcome, sender nisd2.eu by @simonorzel26 in #428
• Emails: free course wording, questions about the reader's last time, signed nudge by @simonorzel26 in #429
• Homepage hero: NIS2 Frist verpasst? Fangen Sie heute an. by @simonorzel26 in #432
• Mail: every email in English until the per-language copy is reviewed by @simonorzel26 in #434
• Remove the help dialog by @simonorzel26 in #431
• Mail: only approved languages are sent; the walk's own text keeps the account's language by @simonorzel26 in #435

Full Changelog: v0.2.10...v0.2.11