---
title: "AuditBadger changelog"
description: "What’s new in AuditBadger: product improvements, fixes, and the details that make compliance work easier."
canonical: "https://auditbadger.com/changelog/"
last-updated: "2026-10-16"
---

# AuditBadger changelog

What’s new in AuditBadger: product improvements, fixes, and the details that make compliance work easier. Newest first. Subscribe: https://auditbadger.com/changelog.rss

## Review, approve and publish your SOC 2 system description

Released 2026-10-16 • [Permalink](https://auditbadger.com/changelog/2026-10-16/)

Your SOC 2 system description can now move from draft to review, approval and publication. Generated descriptions use more of your vendor information, and exports look cleaner.

### Review, approve and publish a SOC 2 system description

The system description page now shows its status and the next step. Submit it for review once every section is marked reviewed, then approve and publish it. Approval records who approved it and when, and the exported cover page shows this. Sections are locked during review, approval and publication. This is available to people who can edit the project, in the web app only.

### More accurate vendor and software details in generated descriptions

Generated system descriptions now read your vendor assurance reviews, not just vendor questionnaires, when describing which vendors have current assurance. The Section 3 check now asks only about high-risk, critical-risk and infrastructure vendors. Managed SaaS and cloud services now show Managed service instead of a version placeholder.

### Cleaner system description exports

PDF exports now have the AuditBadger footer on every page and a single title in the header. The cover page in the PDF and ODT exports shows the full framework name instead of the raw code.

### AI assistants can add evidence to controls shared across projects

Connected AI assistants can now propose evidence and implementation updates for a control attached under a parent in another project of the same account. Status rolls up into every parent, as it does in the web app. Each proposal still goes through your review. Controls outside your account are still refused.


## Reuse documents across projects, record past continuity exercises and get fuller GCP evidence

Released 2026-10-15 • [Permalink](https://auditbadger.com/changelog/2026-10-15/)

Reuse a policy in more than one project, record continuity exercises after they happen, and see GCP evidence gaps as clear errors instead of empty results. ENS clauses are also easier to tell apart.

### Add existing documents to more projects

Reuse a policy in another project without copying it. On a project's Documents list, use Add existing document and search by title. You can remove a document from a project when it is also in another project, but it always stays in at least one. Connected AI assistants can propose the same changes, and you review them first.

### Record a continuity exercise after it has happened

The completion form for a business continuity exercise now has a Completed on date. It defaults to today and does not accept a future date. You can complete a planned exercise without starting it first. Connected AI assistants can propose completing or cancelling an exercise, and you review each one.

### GCP evidence finds more resources and reports permission errors

GCP key checks now cover every KMS location in your project, and collectors read all pages of results. If GCP denies a permission, the collection now fails with a permission error instead of showing zero resources. If your GCP role is missing a permission, you may see a failed collection. The Default region field is removed from GCP connection forms.

### ENS clauses have titles that say what they require

ENS clauses are easier to tell apart. They now have Spanish and English titles that name the requirement and keep the legal label, and Spanish descriptions lead with what differs. Control pages show the verbatim legal text in a collapsible block. Existing ENS projects can be refreshed to the new wording, and text your team edited is kept.

### Fewer outdated prompts and better policy drafts

Replaced document versions no longer show as pending acknowledgement. Opening one shows that it was replaced and links to the current version. Groups can now have a description, which AuditBadger can use with active members when drafting a policy that names a committee. Approving a risk snapshot now saves its approved status.


## ENS system hub and Declaración de Aplicabilidad export

Released 2026-10-14 • [Permalink](https://auditbadger.com/changelog/2026-10-14/)

ENS projects now have one place to manage the system, applicability and decisions, plus a downloadable Declaración de Aplicabilidad. Progress counts only the clauses you need to do, so totals are easier to read.

### Manage an ENS system from one page with tabs and a next step

ENS projects now have a single ENS system page with tabs for Overview, System, Applicability, Decisions, Declaración de Aplicabilidad, Maturity and Assurance. A status header shows the categorization state, who must confirm it, counts and the next action. Applicability can be searched and filtered, and decisions are recorded from a clause picker. This applies to accounts with ENS enabled.

### Download the Declaración de Aplicabilidad in Spanish or English

ENS projects can generate a Declaración de Aplicabilidad as PDF or XLSX, in Spanish or English. It lists each Annex II measure, whether it applies, the exclusions and compensating measures in force, and a signature block for the security officer. It can be generated only when the categorization is confirmed and current.

### See ENS progress based on required clauses only

On ENS projects, control cards and totals now count only required clauses. Excluded clauses leave the total, and compensated clauses count as done. Controls lists have an Expanded and Compact view, remembered per user. A blocked measure with clauses already started now shows In progress instead of Not started.

### Implementation notes no longer change a control's status

Adding or editing implementation notes now leaves a control's status as it is. Before, notes on a Not started control moved it to In progress, which could overstate progress. Change status explicitly instead. Controls that already moved keep their current status. This applies in the app and through connected AI assistants.

### Acknowledge documents without leaving the page

Accepting or rejecting a document from the profile Compliance tab, the documents list or the document page now happens in a modal. You stay where you were, and statuses, badges and pending counts update in place. Document type labels are translated, and instructions explain what each acknowledgment type needs.

### Hide measures that do not apply in ENS control lists

Once your ENS profile is confirmed and current, measures marked Not applicable no longer appear on the controls list or section screens. A line tells you how many are hidden, and Show lists them for that page view. Counts, section summaries and progress still include these measures. Nothing is hidden before the profile is confirmed or while it is out of date.

### Hide clauses that are not required in Expanded view too

Clauses your profile does not require were hidden only in Compact view. They are now hidden in both Compact and Expanded views. The Show clauses not required toggle appears in both views once the profile is confirmed, and it also reveals hidden measures. Your choice is remembered.

### Open ENS projects in Compact view by default

If you have not chosen a view, ENS projects now open in Compact view. Other frameworks still open in Expanded view. Once you pick a view, it is kept on every framework.

### Save the ENS system draft faster

Saving the ENS system draft now recalculates measure statuses once instead of one measure at a time. Saves that used to take several seconds are now much quicker.


## Connect Heroku for read-only evidence, and safer control deletion

Released 2026-10-13 • [Permalink](https://auditbadger.com/changelog/2026-10-13/)

You can now collect read-only configuration evidence from Heroku for your controls. Deleting a control that still has sub-controls is now blocked, so notes and evidence links are not removed by mistake.

### Collect read-only configuration evidence from Heroku

Connect a Heroku team or personal account from Integrations to collect configuration evidence for your controls. Use Heroku sign-in or paste a token with the read scope. Wider tokens are refused. You choose which apps to include and which are production. AuditBadger does not request config vars. Sources your connection cannot run are not offered, and evidence is collected on a schedule.

### See what Heroku read access can expose before you connect

Know what you are granting before you connect Heroku. A notice before connecting, and on the connected page, explains that Heroku's read scope can return sensitive metadata. AuditBadger removes known sensitive fields before saving evidence, but filtering cannot guarantee every secret is removed. The notice recommends a dedicated Heroku user with minimum app access.

### Controls with sub-controls can no longer be deleted by mistake

Deleting a control that has sub-controls is now refused, so sub-controls with their notes and evidence links are no longer removed silently. The control actions menu tells you to move or delete the sub-controls first. Framework template syncs also keep outdated controls that have notes, evidence or document links.

### Review AI assistant proposals to delete a control

A connected AI assistant can now propose deleting a control, for example one imported into the wrong project. A person must decide each proposal. The review lists what goes with the control. Linked evidence, documents and risks stay, and only their links to the control are removed. Only controls without sub-controls can be proposed.


## AI assistants can now work with Compliance History and recurring cadences

Released 2026-10-12 • [Permalink](https://auditbadger.com/changelog/2026-10-12/)

Connected AI assistants can read Compliance History and propose record, cadence and document date changes for your review. This release also fixes batch control assignments, Linear sign-in errors and ENS deletion.

### Let AI assistants read and propose Compliance History changes

Connected AI assistants can now read Compliance History records and propose new meeting, note and milestone records, edits, confirmations and links to evidence. You review every proposal before it applies. Access needs the new Compliance history scope on the agent token, and existing tokens do not gain it. Voiding, restoring, deleting and transcript import stay in the web app.

### Let AI assistants propose recurring activity cadences

Connected AI assistants can now read recurring activity cadences, including the next due date and overdue state. They can also propose setting or clearing a cadence. You review each change before it applies. As in settings, cadence changes need account administrator rights, and cadences remain advisory.

### Keep real dates when importing policies through an AI assistant

An AI assistant can now propose an effective date, next review date and review cadence of 3, 6, 12 or 24 months on a working document version, or clear them. Dates set on a draft are kept when it is published. Published versions are not changed this way.

### Assign several controls to one person in a single batch

A batch of proposed control assignments to the same person now applies in full. Before, only the first applied and the rest failed as changed. Refusals for outdated versions now list every affected item with its current value. Proposals made earlier for these actions may need to be proposed again.

### Fixes for Linear sign-in errors and ENS deletion

A Linear connection or sign-in that returns a missing or invalid state now shows an invalid state alert on the main page instead of an error page. Deleting an ENS project, or an account with ENS records, now works. The related ENS records are removed with it.


## Use your own control identifiers and map controls to several criteria

Released 2026-10-11 • [Permalink](https://auditbadger.com/changelog/2026-10-11/)

Subcontrols can keep the identifiers your team already uses, such as AC1. Connected AI assistants can also propose placing one control under several criteria or moving it to a new main criterion.

### Keep your own identifiers on subcontrols

Name subcontrols with identifiers your team already uses, such as AC1, instead of numbers that extend the parent, like CC6.1.4. An identifier must be unique in the project and can be up to 64 characters. Saving a subcontrol no longer renames it, and a duplicate is refused. If you leave it blank, the next free number is suggested. This works in the app and through connected AI assistants.

### Map one control to several criteria through connected AI assistants

A connected AI assistant can propose creating a control under its main criterion and attaching it under other criteria in the same proposal. It can also attach an existing control from the same project to another parent, remove an attachment, or move a control to a new main criterion. Each change goes through your review first. The app has no screen for moving a control yet.


## Compliance calendar, recurring activity settings and stronger readiness checks

Released 2026-10-09 • [Permalink](https://auditbadger.com/changelog/2026-10-09/)

A new calendar puts compliance due dates in one place, and admins can set how often recurring activities should happen. Readiness checks now trace risks to controls, and access controls for partners and roles are tighter.

### See compliance due dates in one calendar

A new Calendar page lists due dates in one place, grouped by month with overdue items first. It covers recurring activities, document reviews, continuity tests, vendor reviews, risk reviews and more, and you can filter by source. Each person sees only what they are allowed to read. Subscribe gives you a personal calendar link for your calendar app. You can replace or delete it. Treat the link like a password.

### Set how often recurring activities should happen

Account admins can set an interval, grace days and a start date for security oversight, risk review and change review meetings in Account settings, under Compliance. Each activity shows a suggested interval you can use. Cadences are advisory and are not set by default. Where the experimental, AI-assisted document consistency check is enabled, it can also offer to update the cadence instead of editing documents.

### Readiness checks trace risks to controls and vendors to risks

Audit readiness now flags risks that need treatment but have no linked control, or no implemented linked control. It also flags risks whose treatment actions are done but whose residual risk is not accepted. High or critical risk vendors with no linked open risk are flagged too. Each framework now has its own checks. Expect new gaps on your first run, because every open risk in the account is now checked.

### Get clear reasons when an AI assistant proposal is refused

Changes proposed by a connected AI assistant are now checked against the same rules as the matching screens before anyone reviews them. A refused proposal lists each problem and the field it concerns, so the assistant can fix it and propose again. Reviewers can cancel a change set that holds outdated items. Some pending proposals made before this update may need to be proposed again.

### Tighter access controls for partners and role changes

Partner users must now sign in with two-factor authentication. Account admins that work with a partner can see locked and lapsed access requests, get emails about request changes, revoke suspended access and see partner events in the audit log. Only account admins can now set roles, manage custom roles or change another person's sign-in email. Teams that delegated people management through custom roles may notice this.

### See and change which template an uploaded document replaces

During project setup, each analyzed upload now shows the template it was matched to and whether AI or you set the match. Click the match to choose another template, or choose none to keep the file as context only. Your choice saves right away. A summary above Continue shows how many templates your documents cover. Reused documents from other projects may cover more, so the final number generated can be lower.

### See what unblocks an Implemented claim on Trust Center posture cards

When a posture card cannot show as Implemented, the Security posture tab now lists the steps to fix it. Steps name the evidence source and cover failing checks, paused or errored sources, stale, unverified or rejected evidence, and missing sources or reviews. The card also says when evidence was marked obsolete and that the next collection replaces it. Steps appear in English, Polish, German, Spanish and Dutch.


## Check your documents for drift and gaps (experimental)

Released 2026-10-08 • [Permalink](https://auditbadger.com/changelog/2026-10-08/)

An experimental, AI-assisted check helps you find where your documents disagree or may have gaps, so your team can review and decide what to fix. It is enabled per account and is not available to every account.

### Check your documents for drift and gaps

Find places where documents in a project disagree, are unclear or may have gaps, then decide what to change. The check reports its findings for your team to review. This experimental feature is AI-assisted, so findings need human judgment and do not guarantee compliance. It is enabled per account and may not appear in yours yet.

### See missed recurring meetings and the next expected date

Accounts can set an expected cadence for each meeting purpose, such as security oversight every month. Purposes are security oversight, risk review, change review and post-incident review. The meeting evidence snapshot then shows periods with no confirmed meeting and the next expected date. Cadence is an account-level setting and is not set by default, so a purpose without one shows only counts and dates.


## Link security objectives and management reviews to ISO 27001 clauses

Released 2026-10-07 • [Permalink](https://auditbadger.com/changelog/2026-10-07/)

You can now link security objectives and management reviews to ISO 27001 workbook clauses yourself. AI drafting and suggestions also stop counting a policy twice when it has both a published version and a working draft.

### Link security objectives and management reviews to workbook clauses

Link security objectives and management reviews to ISO 27001 workbook clauses that are not linked automatically, such as 5.2 or 9.3.2. Open Manage links on a clause and use the new pickers. They list records from the current project and leave out cancelled objectives, inactive management reviews and anything already linked.

### Get cleaner AI drafts when a policy has a draft and a published version

AI document drafting and regeneration now read one version of each of your other policies, preferring the working draft over the older published text. Control suggestions and the ISO 27001 document inventory also count each policy once, using the published version.


## Trust Center redesign with NDA-gated documents and evidence-backed practices

Released 2026-10-06 • [Permalink](https://auditbadger.com/changelog/2026-10-06/)

Share Trust Center documents behind an NDA and show security practices that follow your evidence. Meeting records and an approved infrastructure diagram can now serve as evidence, and users can acknowledge legal updates in the app.

### Share Trust Center documents behind an NDA with a redesigned public page

Your public Trust Center has a new design with your logo, brand colour and a choice of four page layouts. Visitors can request access to NDA-protected documents and files by confirming a work email and accepting an NDA. Admins approve or reject requests and see an access log. NDA access stays unavailable until your legal name, legal address and privacy notice URL are set. The built-in NDA text is an example, and you are responsible for providing a valid NDA.

### Show security practices that follow your evidence

Trust Center admins can publish security practice cards. A card shows Implemented only while current automated evidence or a recorded internal review supports it. Admins are notified if a published practice no longer qualifies. Programs in progress can optionally show a roadmap.

### Use meeting records as evidence

Tag meeting records in Compliance History with a purpose: security oversight, risk review, change review or post-incident review. AI suggests a purpose and a person chooses it. You can upload up to 10 files at once, including VTT, SRT and DOCX transcripts, and follow them in a review queue. Evidence stays submitted until a person accepts it.

### Approve your infrastructure diagram and use it as evidence

You can approve the infrastructure relationship diagram with a short review summary. Approval saves a numbered snapshot with a downloadable PDF. A monthly evidence source collects the latest approved snapshot and shows whether the live diagram has changed since. Approval needs permission to edit infrastructure assets. Deleting an asset that has relationships no longer causes an error.

### Acknowledge legal document updates in the app

When a terms, privacy or DPA update needs acknowledgement, active users see a banner with a short summary and the effective date. They can acknowledge it in one click. Admins see how many users acknowledged each version. Scheduled versions appear on the public legal pages before they take effect.


## Mark evidence obsolete and manage data classification levels

Released 2026-10-02 • [Permalink](https://auditbadger.com/changelog/2026-10-02/)

Keep outdated evidence on record without it counting as proof. Set up data classification levels with handling rules and record reviews. Linked documents now count as proof on subcontrols.

### Mark outdated evidence obsolete instead of deleting it

You can now keep out-of-date evidence on record without it counting as proof. Mark it obsolete from the Actions menu and give a reason. Its files, versions and control links stay in place. Obsolete evidence no longer counts toward control totals or progress, and you can restore it later. The evidence register can hide obsolete items or show only them.

### Set data classification levels and handling rules

Account settings now has a Data classification tab under Compliance. You can add, edit, reorder and delete levels. Each level can have plain-text handling rules for access, storage, sharing and retention. A level that assets still use cannot be deleted. You can also record a review of your scheme, which is saved with the date, reviewer and notes.

### Linked documents now count as proof on subcontrols

A subcontrol backed by a linked policy no longer shows No Evidence. The Evidence column now shows how many documents are linked. It shows No Evidence only when a subcontrol has neither an evidence item nor a linked document.

### Use approved data flow maps as evidence

Approved data flow maps can now be collected as an evidence snapshot. The snapshot uses the latest approved version of each map and shows approval details and whether a map changed since approval. A map must be approved before it can be collected, and collection runs on a schedule, so new approvals may not appear right away.

### Policy drafts use more of your own records

When AuditBadger drafts or regenerates a policy, it can now look up facts from your account instead of guessing. These include your organization profile, training courses, incident types, vendors, systems, integrations, continuity plans and risk register. ISO 27001 projects can also use security objectives and the Statement of Applicability. Where no source covers a value, the draft keeps a placeholder.


## AI control verification is now live!

Released 2026-10-01 • [Permalink](https://auditbadger.com/changelog/2026-10-01/)

AI control verification gives you an AI review of a control. It is in test mode and turned on per account. This update also fixes a Quick Wins error and adds a core framework flag to MCP document reads. This is a test feature, if you'd like access, please contact Maciej.

### AI control verification is available (in beta / ghost mode)

You can ask AI to review a control and give you a plain-English opinion. The review reads the control description, implementation notes, subcontrols, current evidence and linked documents. It shows a score band, whether the control looks designed to meet its requirement, and whether there is proof it operates. It also lists gaps, missing activities, recommendations and questions an auditor may ask. For controls with subcontrols, it shows how each subcontrol fits. Evidence and document rows get a short review mark. The panel says when a result may be out of date after the control, evidence or documents change. From the project Actions menu, you can verify all controls or only new and changed ones. You can filter the controls list by verification status or score band. Access is limited. This feature is in test mode and is turned on per account, so it will not appear for every account. AI must also be enabled for the project. Results are AI-generated advice. They are not an audit opinion or legal advice. They do not change any control status, evidence or link. A daily usage limit applies per account. For accounts that have the feature, MCP-connected assistants can read the latest verification of a control, including when it was last verified and its score.

### Quick Wins opens for projects without a framework

The Quick Wins page showed an error for a project with no framework selected. It now loads. For these projects, the suggestion text leaves out the line about which framework it supports.

### MCP document reads show the core framework flag

If you use AuditBadger with an MCP-connected assistant, document lists and single document reads now say whether a document is a core framework document. This matches the Core framework badge in the web document list. Your assistant can now tell these documents from custom ones.


## Link several ISMS workbook items at once, and fewer false PDF refusals

Released 2026-09-30 • [Permalink](https://auditbadger.com/changelog/2026-09-30/)

Your AI assistant can now apply a batch of evidence links in an ISO 27001 workbook in one approval round. PDFs with screenshots are no longer refused by mistake.

### Apply many ISMS workbook evidence links in one approval round

Your connected AI assistant can now link several documents to ISO 27001 workbook requirements in one batch. Before, only the first link applied after approval and the rest failed as changed. You can now link several documents to the same requirement in one batch. You can also unlink several links on one requirement. Pending clause changes stay approvable when a different requirement is edited. Asking for the same document and requirement pair twice in one batch is still refused. Changes proposed before this update may need to be proposed again.

### Outdated proposals now tell your assistant to propose again

If a proposed change became out of date when you tried to approve it, it used to keep showing as waiting for review. It is now marked as out of date, and your assistant is told to propose it again.

### PDFs with screenshots are no longer refused as active content

Some PDFs with compressed images were refused as containing scripts, even though they had none. The check now skips image and page data and looks at the document structure. PDFs with real scripts, launch actions or embedded files are still refused.

### Editing a risk keeps its owner

The owner field on the risk form now shows the owner already assigned to the risk. Before, saving an edit could quietly make you the owner. New risks still start with you as the owner. If a risk's current owner is no longer available to select, the field is blank and you choose an active user.

### Clear errors when the risk form cannot be saved

If the title, category or owner is empty, the form now lists what is missing and opens the tab that holds the field. Before, saving could fail with no message when you were working in another tab. This helps most for users who are managed by a partner, who could be blocked from saving a risk.


## Data flow maps with AI drafts and approved snapshots

Released 2026-09-29 • [Permalink](https://auditbadger.com/changelog/2026-09-29/)

You can now build data flow maps, get an AI-suggested first draft, and approve versions you can keep as records. Risks can also link to vendors and continuity processes, and project setup can use only your own documents.

### Create data flow maps from a description or an example

Under Assets, you can now add data flow maps. Describe a process in plain words and get a suggested diagram to review. You can also start from an editable example or build one by hand. Each transfer lists the source, target, data and protection. The suggestion can use the vendor and infrastructure asset names you already have. You can answer its questions or ask for changes, and your manual edits are kept. If a suggestion fails, you can retry. Saving creates a draft.

### Approve a data flow map and keep a fixed version

When a map is ready, you can approve it with a short summary. Approval saves that exact version with the approver's name and the time. Later edits do not change an approved version. Each approved version can be downloaded as a PDF, and you can retry if the export fails. In an ISO 27001 workbook, you can link an approved version to a requirement as evidence.

### Link risks to vendors and continuity processes, and create controls from a risk

On a risk page, you can link the vendors it concerns and the business continuity processes that treat it. Linked processes show their active recovery plans. Vendor and process pages list the risks linked to them. These links are for context and do not change a risk's score or treatment. You can also create a control from a risk and link it in one step. Control suggestions can now include drafts of new controls.

### Set up a project with only your own documents

Project setup now has a Use only my documents option. When you choose it, setup does not generate template documents. Without it, templates that your uploaded documents already cover are no longer generated again. The setup summary lists the documents you imported.

### AI risk suggestions use what is already in your account

Suggested risks now take your documents, control status, registers and open risks into account. Suggestions no longer call a policy or plan missing when you already have it. They also avoid repeating risks already in your register.


## Clearer evidence collection and audit readiness

Released 2026-09-25 • [Permalink](https://auditbadger.com/changelog/2026-09-25/)

Audit readiness now flags documents waiting on approval. Evidence collection is more honest about failures and easier to retry. Adding sources and managing users in pickers work more predictably.

### Audit readiness shows documents waiting on approval

If a draft policy is waiting for its approver, audit readiness now says so and shows how many days it has been waiting. If the approver sent it back, the gap says changes were requested. This replaces the generic "publish the document" gap, so the next step is clear. It counts as a blocker when the document was never published, and as a warning when an earlier version is still in force.

### Denied AWS calls no longer produce empty evidence

When AWS denies a request during evidence collection, the collection now fails with a clear permission error. Before, some AWS checks recorded an empty result, which could read as "nothing found" or "all configured correctly". This covers checks such as security groups, RDS, S3, IAM, KMS, CloudTrail, CloudWatch, EBS, VPC flow logs, Backup, AWS Config and Security Hub. If your AWS role is missing a permission, you will now see a failed source instead of misleading evidence.

### Retry failed evidence sources and keep your place in the list

You can now use Collect now on an evidence source that is in an error state. The run acts as a retry, and a source that collects again starts with a fresh failure count. The button is available in account settings, on the control page and on the evidence page. In the Evidence sources list in account settings, Pause, Resume and Collect now keep your current page and status filter. The current page is now shown as selected in page navigation, and a page number past the end shows the last page instead of an error.

### Clearer feedback when adding an evidence source

Adding an evidence source that fails now shows an error message instead of leaving the dialog open with no explanation. If the source is already enabled on the control, you are told so. If the source already collects evidence for another control, you are told its first evidence will be linked to your control after the first collection, and that link is now made. When you add several sources at once, any that failed are listed.

### Active users only in pickers, and a billing label fix

The incident Assign user picker, the incident type Add responsibility picker and the department manager picker now list only active users. People with the same name are no longer dropped from the incident pickers. Automatic incident assignment also skips users who are no longer active. On the Billing tab, the Plan label no longer shows raw text, and the plan descriptions are now translated.


## Risk register controls, org chart PDF, document Markdown view, and compliance experience setting

Released 2026-09-24 • [Permalink](https://auditbadger.com/changelog/2026-09-24/)

This update makes it easier to keep your risk register accurate, gives you a downloadable organization chart, lets you view any document as raw Markdown, and adds a setting so AI guidance matches your team's compliance experience. We also fixed a couple of small form issues on employment types.

### Link and unlink controls directly on a risk

Risk pages now support linking and unlinking controls through a shared, consistent action, including removing all linked controls from a risk at once. This makes it easier to correct risks that ended up with too many or too few linked controls.

### Download your organization chart as a PDF

The people structure page now has a Download PDF option that produces the full organization chart, along with a table listing each person's job title, manager, and direct reports. This can help as supporting material for controls that ask about reporting lines.

### View document content as Markdown

You can now switch a compliance document between a formatted view and a raw Markdown view, wherever document content is shown, including the employee acknowledgment page. Your choice is remembered for next time.

### Set your team's compliance experience level

A new account setting lets you tell AuditBadger whether your team is new to compliance or experienced. AI-generated guidance adjusts its wording and detail level to match, while still covering the same requirements either way.

### Employment type form fixes

The employment type edit form now displays correctly in dark mode, and you can select or deselect all required documents and contracts at once instead of checking them one by one.


## Document approvals before publication

Released 2026-09-23 • [Permalink](https://auditbadger.com/changelog/2026-09-23/)

You can now require a designated approver to sign off on a policy or procedure before it is published, separate from employee acknowledgment. The documents area has also been reorganized so status and next steps are clearer.

### Require sign-off before a policy is published

You can turn on a setting that requires a designated approver to sign off on a policy or procedure before it can be published. Submit a draft to the approver, who can approve it or send it back with a note explaining what to change. The document's text locks while a request is pending, so the approver reviews an exact, unchanged version. Editing an already-approved draft automatically clears the approval so it can be re-reviewed. Every request and decision is recorded with who acted and when, and people are notified when they're asked to approve something or when a decision comes back.

### See who is waiting on your approval

The documents list now shows approval status next to each document and includes a filter for versions awaiting your approval, so approvers can quickly find what needs their attention.

### Redesigned documents list and document page

The documents list is now a denser view with clear status labels, such as draft, pending approval, changes requested, approved, and published. The document page is reorganized into clearer panels for status, version history, and actions, and editing a document now uses a tabbed form covering content, settings, and publishing options.


## Fewer document generation timeouts and better cross-project template accuracy

Released 2026-09-21 • [Permalink](https://auditbadger.com/changelog/2026-09-21/)

This release fixes two reliability issues in AI-assisted document generation: rewriting long policies now completes without timing out, and shared templates now update against the correct project template instead of a stale one.

### Fewer failed AI document rewrites on long policies

Regenerating a long policy document from scratch could time out and fail after several minutes, sometimes leaving an error message in the document. Document generation now streams its progress internally so long documents complete reliably instead of timing out.

### Template update notices now match the right template when documents are shared across projects

When a policy document was reused across projects in different frameworks, the update notice and the regenerate-from-template action could reference an outdated template instead of the one that actually applies to that project. This is now corrected so the notice and refresh always use the project's own current template.

### AI document regeneration can now read other documents you reference

When you ask the assistant to align a document with another one during regeneration, it can now read that document's full content instead of relying on a short summary, and it sees the full existing document rather than just the beginning.


## Review policies without new versions, and get automatic policy evidence

Released 2026-09-17 • [Permalink](https://auditbadger.com/changelog/2026-09-17/)

You can now record that a published policy was re-read and still applies, without creating a new document version. New document versions also get sensible default effective and review dates instead of copying the old ones. Policy governance can now feed an automated evidence source for your audit, and training enrollment now keeps up automatically when coverage changes after a course is published.

### Mark a policy as reviewed without publishing a new version

When a policy or procedure is due for its periodic review and nothing needs to change, you can now record that review directly on the current published version. This captures who reviewed it, when, and the outcome, and moves the next review date forward without creating a new draft. If changes are actually needed, recording the review can open a new draft for editing instead. The document activity view now shows one combined timeline of versions and reviews.

### New document versions get sensible default dates

When you publish a new version of a policy, its effective date and next review date are now calculated automatically, based on your review cadence, instead of simply copying the previous version's dates. A blank effective date is filled in with the publication date.

### Documents now link only to specific controls, not top-level criteria

Policies and procedures can no longer be attached directly to top-level criteria, such as SOC 2 trust service categories. Document forms, control pickers, and policy generation now guide you to link documents to the specific controls underneath those criteria instead.

### Policy governance can now generate its own evidence automatically

A new evidence source can generate a snapshot of your project's policies and procedures: which version is in force, when it was published and last reviewed, whether a review is overdue, and how much of the workforce has acknowledged it. This reduces the need to manually attach documents one by one to show they are current and acknowledged.

### Training enrollment now keeps up with team changes after a course is published

Previously, people were only enrolled in a training course at the moment it was published. Now, if you add coverage to an already-published course, or someone's employment type or group membership changes afterward, they are automatically enrolled if not already covered by an active or recent completion.


## Vendor types bring structured assurance reviews

Released 2026-09-16 • [Permalink](https://auditbadger.com/changelog/2026-09-16/)

Vendor assurance reviews can now adapt to the kind of vendor you're assessing, prompting for the right facts, evidence checklist, and suggested risks automatically. We also fixed the training quiz question edit modal so it works correctly from every screen.

### Assign a vendor type to get tailored assurance questions

You can now assign a vendor type, such as an AI or model provider, cloud provider, or managed database provider, to any vendor. The assurance review form then shows questions specific to that type of vendor, so you capture the details that actually matter instead of filling out a generic form.

### Evidence checklist tailored to each vendor's type

Recording an assurance review now shows an evidence checklist specific to the vendor's type. You can mark a requirement as not applicable with a note, and the checklist reflects what evidence already satisfies each item.

### Suggested risks and control coverage for typed vendors

Based on the facts you record for a typed vendor, AuditBadger can suggest relevant risks, which you can accept, dismiss, or defer. You can also see which controls that vendor type supports and whether your evidence is reaching them.

### Vendors are flagged when they need another look

If the underlying evidence behind a vendor type changes, the vendor is flagged as needing review, so you can check the evidence and related risks before marking it reviewed again.

### Quiz question edit modal now works from every screen

Editing a training quiz question previously failed on the question preview page: the Edit button did nothing, and saving could break the modal. The edit modal now opens correctly from the question list, course overview, and preview page, and saving updates the page in place.


## Cleaner training control picker, quieter GuardDuty collection, and steadier partner agent access

Released 2026-09-15 • [Permalink](https://auditbadger.com/changelog/2026-09-15/)

This update stops training courses from linking to controls that can never hold evidence, tightens AWS GuardDuty pagination and evidence collection scheduling, fixes an OAuth sign-in failure for Claude Code on localhost, and closes remaining gaps so partner-managed users can sponsor agent tokens consistently across reads, uploads, and cancellations.

### Training courses no longer link to controls that cannot receive evidence

Course control pickers, the course form, and AI control suggestions now skip criteria roots and parent controls with sub-controls, since those cannot actually hold training completion evidence. Already-linked controls of this kind are preserved on save and now show a warning so you know to link the underlying controls instead.

### Simpler change-management evidence for Shortcut and Linear

Evidence previews and audit exports for Shortcut and Linear now focus on completed tickets and their linked pull requests. The separate reviewer-lookup checks and related metrics have been removed, so summaries and exports are simpler and load without depending on extra GitHub permissions.

### Partner-managed users can now use agent tokens as expected

Partner shadow users can sponsor, connect, and use agent tokens while their grant is active, including MCP reads, staged uploads, and cancelling proposed changes. Ending or suspending a grant now revokes those tokens right away, the same way removing a team member does.

### Fixed OAuth sign-in for AI assistants using localhost redirects

Some AI assistants, including Claude Code, redirect to a localhost address with a random port during sign-in. This previously failed with a redirect mismatch error. Any port on a localhost redirect is now accepted, so connecting these assistants works reliably.

### More reliable AWS GuardDuty evidence collection

AWS GuardDuty finding collection now caps how many pages it will fetch per region, preventing a rare case where collection could loop far longer than needed. Evidence collection jobs also now avoid running more than one copy for the same source at a time, keeping evidence versions consistent.


## Find and manage every evidence collector in one place

Released 2026-09-10 • [Permalink](https://auditbadger.com/changelog/2026-09-10/)

This release makes it easier to see and control the automated evidence AuditBadger collects for you, cleans up a confusing branding leftover, and fixes a crash in the infrastructure asset register.

### New evidence sources tab for managing collectors

Account integrations now has an Evidence sources tab that lists every configured collector in one place, grouped by type and by project. You can search, filter by integration or status, and pause, resume, or trigger a collection directly from the list.

### Any evidence source can be added to a control, not just suggested ones

When adding an evidence source to a control, you can now choose from the full catalog of available sources, including AuditBadger's own internal sources, instead of only the ones recommended for that control.

### Search the evidence source picker

The Add Evidence Source screen now has a search box, so you can quickly filter the list of sources by name, description, provider, or integration.

### Automated evidence gets a clear expiry instead of looking stale

Evidence collected automatically now gets an expiry date one month out, renewed with each collection. It no longer shows up in your list of evidence missing an expiry date or as expiring soon; if a collector stops running, its evidence correctly shows as expired instead.

### Fixed a crash when filtering infrastructure assets by vendor

Selecting a vendor in the infrastructure asset register filter used to cause an error. This is now fixed and filtering by vendor works correctly.


## UK Cyber Essentials and Swedish NIS2 framework support

Released 2026-09-07 • [Permalink](https://auditbadger.com/changelog/2026-09-07/)

This update adds UK Cyber Essentials and Swedish NIS2 framework support, improves AI-generated implementation notes for controls with subcontrols, fixes AWS evidence cards that were showing blank metrics, and lets ISMS workbook progress count toward your overall ISO 27001 score.

### Humadroid is now AuditBadger in the in-app assistant

The in-app AI assistant previously referred to itself and the product as Humadroid in its responses, tool messages, confirmation prompts and composer placeholder. It now consistently identifies as AuditBadger throughout the chat experience.

### UK Cyber Essentials framework added

You can now set up a compliance project for UK Cyber Essentials (v3.3), covering scope and assets, firewalls, secure configuration, security updates, user access control and malware protection. Work already done for ISO 27001 or SOC 2 can be reused as supporting evidence.

### NIS2 support for Swedish entities

AuditBadger now supports Sweden's NIS2 cybersecurity law. A classification questionnaire builds out the relevant obligations, controls and evidence mappings for the Swedish rules.

### Fixed AWS evidence cards showing blank metrics

Evidence cards for several AWS checks, including S3 public access, GuardDuty, security groups, IAM access keys, backup jobs and RDS snapshots, were showing dashes instead of real numbers. These cards now display the correct metrics.

### ISMS workbook progress now counts toward your overall score

For ISO 27001 projects with an ISMS workbook, completing and reviewing workbook clauses now contributes to your overall project progress score and appears as its own line in the progress breakdown.


## GitHub connection now verifies organization admin access

Released 2026-09-06 • [Permalink](https://auditbadger.com/changelog/2026-09-06/)

This release strengthens how GitHub is connected to AuditBadger and fixes a couple of rough edges in agent evidence review. There is no product rebrand in this batch.

### GitHub connection now verifies organization admin access

Connecting GitHub now sends you through GitHub's own sign-in and authorization flow before AuditBadger accepts the installation. AuditBadger checks that the installation belongs to your organization and that you are an organization administrator before saving the connection, instead of trusting an installation ID passed directly from the browser.

### Link your Microsoft work account to sign in

From your profile integrations, you can now link your Microsoft Entra work account and use it to sign in afterward. You can reconnect it at any time if needed.

### Approving evidence for a control no longer blocks other pending evidence

Approving one piece of evidence for a control used to mark other pending evidence for that control, or for a sibling control, as out of date, forcing you to resubmit it. Separate pending evidence items for the same control now stay approvable after one is applied.

### Attachments uploaded by your AI assistant now preview correctly

Files your connected AI assistant uploaded as evidence sometimes failed to display a thumbnail and showed a generic filename. Attachments now show correctly and display the original filename.

### Review queue shows the related project, and approvals no longer reload the page

Each item in your agent review queue and review detail now shows which project, control, or other record it relates to, with a link to open it. Approving remaining safe items from the queue now updates the queue in place instead of reloading the page.


## Connect AI assistants with sign-in, plus review and risk fixes

Released 2026-09-02 • [Permalink](https://auditbadger.com/changelog/2026-09-02/)

You can now connect AI assistants like Claude and ChatGPT to AuditBadger with a standard sign-in flow instead of pasting a secret token, and manage which ones stay connected. We also fixed several bugs affecting how proposed changes are reviewed and how risk treatment decisions are tracked.

### Connect AI assistants with sign-in instead of pasting a token

You can now connect supported AI assistants such as Claude, ChatGPT, Cursor, and Codex by signing in and approving access, instead of copying a long token into your client's configuration. On the consent screen you choose which modules the assistant can read or propose changes to, set an expiry, and decide whether it can approve its own safe changes. Pasting a static token remains available as a fallback for scripts that cannot open a browser.

### Manage connected AI assistants from account settings

A new page under account settings lists every AI assistant connected through sign-in, so an administrator can see which are active and revoke access to any of them at any time.

### Outdated proposals are now clearly labeled instead of hidden

If a change proposed by your AI assistant becomes outdated because the underlying item was updated before you reviewed it, the review screen now shows it as superseded and tells you to cancel the change set and have the assistant propose it again. Previously such items were simply hidden, which looked like a permissions problem.

### Approved and applied changes keep their preview

After you approve, reject, or apply a proposed change, the review screen now continues to show what was actually changed instead of the preview sometimes disappearing. A failed approval or rejection now shows a clear alert as well.

### A risk with no chosen treatment strategy is now shown as undecided

New risks no longer default to a treatment strategy like Accept before anyone has actually made that decision. Risk pages, the risk register, and exports now clearly show a risk as undecided until a strategy is chosen, and the risk form requires a strategy before you can save it. We also fixed a bug that could stop proposed risk treatment updates from being applied.


## Approve AI-generated implementation notes, review content history, and issue agent tokens

Released 2026-09-01 • [Permalink](https://auditbadger.com/changelog/2026-09-01/)

This release adds a human approval step for AI-drafted implementation notes and ISMS workbook narratives, lets you view a version history for control content, introduces scoped agent tokens for connecting AI coding assistants, and improves how bulk changes and control creation report problems.

### Approve AI-generated implementation notes and view their history

When the assistant drafts or enhances implementation notes for a control, or narrative content for an ISO 27001 ISMS workbook requirement, a person can now explicitly approve the exact text, with the approver and timestamp recorded. You can also open a version history to see prior versions, who changed them, and whether they were AI-generated and approved. Editing a note by hand clears any outdated approval automatically.

### Create multiple controls at once, with notes included

Proposals that create several controls in the same project or section can now be batched together and approved without conflicting with each other. Controls can also include implementation notes right at creation, saving a separate review step.

### Clearer messages when bulk approvals or proposed changes fail

When approving a batch of proposed compliance changes, any items that fail now show the specific reason, such as the item having changed since it was proposed or already being decided, along with which items were affected. If a single proposed change expires or fails to save before you confirm it, you now see a specific explanation instead of a generic error.

### Issue scoped agent tokens for AI coding assistants

You can now issue and manage agent tokens from your profile, each scoped to specific compliance modules such as controls, evidence, documents, risks, and vendors. Tokens can be set to read-only or read-and-propose access, and you can rotate or revoke them at any time.


## Trust center setup shows when you're ready to publish

Released 2026-08-25 • [Permalink](https://auditbadger.com/changelog/2026-08-25/)

We fixed a bug affecting how the trust center readiness check interacted with saving your settings, and added a clear signal for when your trust center is ready to be made public.

### Trust center now clearly tells you when it's ready to publish

The trust center settings page now shows a distinct message once you have at least one visible project, letting you know your trust center is ready to be made public and reminding you to enable it and save. This is separate from the message you see when a project is still missing, so it's clearer what your next step is.


## Not-applicable rollups and clearer progress percentages

Released 2026-08-24 • [Permalink](https://auditbadger.com/changelog/2026-08-24/)

We fixed how progress percentages and rollup statuses are calculated for controls that use sub-controls, so readiness numbers reflect reality more accurately.

### Controls no longer show as implemented when everything under them is out of scope

If every sub-control under a parent control is marked not applicable, the parent now correctly calculates as not applicable instead of implemented. This prevents your readiness numbers from overstating how much work is actually done, especially when you exclude optional criteria that don't apply to your scope.

### Project and trust center progress percentages only count applicable controls

Implementation progress on project lists and on your trust center now measures implemented controls against the applicable ones only. Controls marked not applicable or excluded no longer pull the percentage up or down, giving you a more honest picture of how close a project is to done.


## Fixes for trust center forms and section deletion

Released 2026-08-23 • [Permalink](https://auditbadger.com/changelog/2026-08-23/)

This release fixes a few bugs that could show errors instead of the expected result: adding a trust document visibility rule, submitting some trust center forms, and deleting a compliance section.

### Fixed an error when adding a document visibility rule

Adding a new visibility rule from your trust center could show an error page if every published document already had a rule. You now see a clear message explaining there is nothing left to add, instead of an error.

### Fixed an error submitting trust center forms

Submitting the document visibility rule or project inclusion forms in your trust center with an invalid selection could show an error page instead of the expected inline validation message. Both forms now correctly show what needs to be fixed.

### Delete a compliance section without losing its controls

You can now delete a compliance section from a project. Any subsections are deleted along with it, but the controls in those sections are kept and simply become unassigned, so their evidence and history are not lost. This applies whether the section is deleted through the app or directly at the database level.


## NIS2 support and faster project setup

Released 2026-08-19 • [Permalink](https://auditbadger.com/changelog/2026-08-19/)

This update adds support for the Polish NIS2 (KSC) compliance framework, speeds up new project setup, and improves translation coverage for wizard questions, documents, and controls.

### Evidence provider labels now consistently show AuditBadger

Evidence collected directly by AuditBadger, rather than through an external integration, now consistently shows the AuditBadger name wherever a provider badge appears, including evidence lists, evidence source setup, and suggested control groupings. This replaces an inconsistent internal label that could previously show up alongside external provider names like AWS or GitHub.

### Track NIS2 (KSC) obligations for your Polish entity

You can now set up a compliance project for the Polish NIS2 (KSC) framework. A short questionnaire classifies your organization as essential, important, or out of scope, and AuditBadger builds a calendar of statutory obligations with due dates. You can mark obligations as complete, and recurring duties roll forward automatically.

### New project setup finishes right away

Creating a new compliance project no longer leaves you waiting for every policy to generate. Setup now completes immediately with a summary of the documents being prepared, while the rest continue generating in the background.

### Fixed crashes in progress updates and Statement of Applicability details

Fixed a bug where live project progress updates could fail to display, and a separate issue where projects with a Statement of Applicability could error out when loading control context for document generation.

### Better translations for wizard questions, documents, and controls

Compliance wizard questions, generated documents, and control content now have improved translation coverage and stay better synchronized with the underlying English source as content is updated.


## Faster asset entry, a combined asset view, CSV import, and register attestation

Released 2026-08-13 • [Permalink](https://auditbadger.com/changelog/2026-08-13/)

This release makes it easier to build and maintain your asset register. You can quickly add assets, view physical and infrastructure assets together, import assets in bulk from a CSV file, and formally record a review of your register.

### Add an asset in seconds with quick add

Both the physical and infrastructure asset lists now have a quick-add row above the table. Only the name is required, so you can add a device on the spot and fill in details like category, classification, manufacturer, or serial number later.

### See all your assets in one combined list

A new All Assets view brings physical and infrastructure assets together in a single searchable, filterable list, showing classification, owner, and completeness for each item, with links to the full record. Lifecycle events, controls, and relationships still live on each asset's own record.

### Import your asset register from a CSV file

You can now upload a CSV file to bulk-add or update physical and infrastructure assets. Before anything is written, you get a preview showing what will be created, what will be updated, and any rows that need review because something in them does not match your account. A downloadable template shows the columns it accepts.

### Formally record that you reviewed your asset register

You can now attest that you have reviewed your asset register, capturing counts of assets, classified assets, and incomplete assets at the time of review. If everything is complete the review can be recorded outright; if gaps remain, you are prompted to document the exceptions. Each review is timestamped, and index pages show when the register was last reviewed and by whom.

### Manufacturer field, disposal notes, and asset-to-hardware links

Assets now have a dedicated, searchable manufacturer field alongside the existing make field. When you move an asset to a terminal lifecycle state you are asked for a disposal note, and retired assets appear in a dedicated appendix on the classified inventory PDF export. You can also connect a logical infrastructure asset to the physical device that supports it, and see related systems listed on that device's page.


## Custom attributes now work across every asset type, with a new gap report

Released 2026-08-11 • [Permalink](https://auditbadger.com/changelog/2026-08-11/)

You can now define custom attributes once and apply them to physical, infrastructure, or digital assets by setting rules for where each attribute applies. A new gap report shows every asset missing a required value or a classification, and saving an asset is never blocked while you catch up.

### Define one attribute and apply it across asset types

Attribute types now support applicability rules: you can make an attribute apply to physical assets, infrastructure assets, or digital assets, and narrow it to a specific physical category. Each rule can set a default value, a display order, and whether it is required for the asset to count as complete.

### Asset forms show the right fields automatically

Physical and infrastructure asset forms now render one field for every attribute that applies to that asset, prefilled with the configured default. Values you already entered continue to show. You can still save an asset even if required fields are missing.

### New gap report for missing attribute values and classifications

A new gap report lists every physical and infrastructure asset that is missing a required attribute value or a data classification. You can filter by asset type or search by name, and jump straight to the asset from the report.

### Category-level custom fields are now read-only

The old per-category custom fields editor is frozen. Existing values still show on the category and asset pages, with a link to the new account-level attribute types where you manage attributes going forward.


## Classify your assets and act on groups of them at once

Released 2026-08-10 • [Permalink](https://auditbadger.com/changelog/2026-08-10/)

Asset management now supports data classification levels and bulk actions, making it easier to organize and update your inventory for audits.

### Classify physical and infrastructure assets by sensitivity

Every physical and infrastructure asset can now be assigned a data classification level, such as Public, Internal, Confidential, or Restricted. Default levels are set up automatically for your account, and you can filter your asset lists by classification, including an option to find unclassified assets.

### Download a classified asset inventory as a PDF

You can now export a single PDF that groups all your physical and infrastructure assets by classification level, including an unclassified section. This is available from the export menu on both asset list pages and only includes assets you are allowed to view.

### Update many assets at once

On the asset list pages you can now select multiple assets with checkboxes and apply a change to all of them at once, such as setting their classification level, environment, or owner. You'll see a summary of how many were updated and any that were skipped.

### More filter options on asset lists

Asset list pages now group secondary filters, like location, department, acquisition method, and warranty status, into a More Filters panel, keeping the main filter bar focused on the filters you use most.


## Vendor management and control updates now available through your AI assistant

Released 2026-08-06 • [Permalink](https://auditbadger.com/changelog/2026-08-06/)

If you connect AuditBadger to an AI assistant over MCP, it can now manage vendors and update controls on your behalf. We also fixed a bug that could stop AI-generated conversation summaries from running, and added a background job label to your audit log so it's clearer where changes came from.

### Manage vendors through your connected AI assistant

If you use AuditBadger with an MCP-connected AI assistant, it can now list and look up vendors, create new vendors with contacts, update vendor details, and record vendor assurance reviews on your behalf. Vendors linked to a known vendor automatically pick up that vendor's published evidence artifacts on the review.

### AI assistant can now update control status and details directly

Your connected AI assistant can now update a control's implementation status and notes, as well as its title, description, identifier, type, and responsible user. If a control is shared across multiple projects, the assistant now warns you that the change applies everywhere the control is used.

### Audit log entries show which channel made the change

Entries in your account audit log now show whether an action came from the web app, the API, an MCP-connected assistant, the AI assistant itself, or a background job, and you can filter the log by that channel.

### Fixed an error that could stop conversation summaries from generating

A bug in the assistant's background summarization process could cause it to fail with an error instead of producing a summary. This has been fixed so conversation summaries generate reliably.


## Attach evidence to incidents, safer user deletion, and EU AI Act support

Released 2026-08-05 • [Permalink](https://auditbadger.com/changelog/2026-08-05/)

This release lets you attach supporting files to incidents, adds a safer flow for deleting a team member so their work is handed off properly, and adds support for the EU AI Act as a compliance framework. It also fixes a page error on some compliance sections and improves reliability of AWS Config evidence collection.

### Attach supporting evidence to incidents

You can now attach files such as screenshots or investigation notes directly to an incident, and remove them again if needed. Uploads and removals show up in the incident timeline along with who made the change.

### Deleting a user now hands off their work safely

Deleting a team member used to just remove them, which could leave records pointing at nobody. Now a confirmation screen shows everything that member still owns, such as risks, documents, and assigned action items, and lets you pick who takes over before the deletion happens. The account owner and partner-managed accounts cannot be deleted this way; you are guided to transfer ownership or revoke access first.

### EU AI Act framework support added

AuditBadger now supports the EU AI Act as a compliance framework. You can set up a project against it, with dedicated controls, questionnaire prompts, and evidence mappings.

### Fixed an error viewing some compliance sections

Some compliance section pages could fail to load with an error. This has been fixed by removing an outdated document list that no longer applied to those pages.

### More reliable AWS Config evidence collection

Fixed an issue where retrieving AWS Config rule status could fail due to an unsupported request parameter, so this evidence now collects reliably.


## More accurate evidence progress and safer document publishing

Released 2026-08-02 • [Permalink](https://auditbadger.com/changelog/2026-08-02/)

This release fixes how control evidence progress is calculated and improves what happens when you publish a new version of a compliance document, so links, notifications, and status stay correct.

### Evidence progress percentages now update correctly

Control evidence progress used to lag or overstate readiness. It now recalculates after evidence is submitted, verified, or collected on schedule, correctly excludes controls marked not applicable or under an accepted exception, and properly weighs draft versus verified evidence so a control is not shown as fully covered just because a document was attached but never reviewed.

### Publishing a new document version keeps links pointed at it

When you publish a new version of a policy or document, links from controls, ISMS requirements, risks, and other related items now update automatically to point at the current version instead of staying pinned to the old one.


## AWS integration monitoring shows what is actually collecting

Released 2026-07-31 • [Permalink](https://auditbadger.com/changelog/2026-07-31/)

You can now see, at a glance, whether your AWS evidence collectors are working, not just installed. Admin and account integration screens flag sources that are failing, paused, or stuck without ever running, so problems surface before they affect your audit readiness.

### See which AWS evidence sources are actually collecting

AWS integration pages now show a clear health status for each evidence check: collecting, needs attention, failing, paused, or disabled. A new overdue indicator flags sources that are active and scheduled but have not run in over a day, so a source that only looks installed is easy to spot instead of appearing healthy by default.

### Admin AWS overview includes overdue and disabled counts

The admin AWS integrations list and detail pages now show counts for disabled and not-running sources alongside active, paused, and error counts, plus a next-run column showing when each source is due or overdue to collect again.

### More reliable retries for AWS collection failures

Evidence collection failures now retry based on the actual error rather than always giving up or always retrying blindly, and error reports keep the original failure details. This means transient AWS issues are more likely to resolve automatically instead of leaving a source stuck.

### More accurate GuardDuty finding counts

GuardDuty evidence now counts security findings by severity more accurately, including fractional severity scores and higher severity findings that were previously undercounted.


## Business continuity exercises now support evidence attachments, plus clearer control suggestions

Released 2026-07-27 • [Permalink](https://auditbadger.com/changelog/2026-07-27/)

This update lets teams attach supporting files to business continuity exercises, improves how evidence versions and control links are shown across projects, and makes risk-to-control linking more accurate.

### Attach supporting files to business continuity exercises

You can now attach files such as transcripts, sign-in sheets, screenshots, or after-action reports directly to a business continuity exercise, and view or download them from the exercise page.

### Better control suggestions when linking risks

Linking a risk to a control now correctly offers shared common controls in addition to project controls, and no longer offers controls that cannot actually be treated as fixes, such as top level SOC 2 criteria. If no relevant controls are found, you now see a clear message with guidance instead of an empty list.


## Weekly digest fix for compliance items without a due date

Released 2026-07-20 • [Permalink](https://auditbadger.com/changelog/2026-07-20/)

This update fixes an error in the weekly compliance digest that could occur when a critical item had no due date set.

### Weekly digest no longer errors on critical items without a due date

The weekly compliance digest could fail to prepare when a critical automated evidence item had no due date. It now falls back to the correct urgency label instead of erroring out, so your weekly digest generates reliably.


## New Compliance History timeline for meetings, notes, and milestones

Released 2026-07-16 • [Permalink](https://auditbadger.com/changelog/2026-07-16/)

This release adds a Compliance History feature so you can keep a single record of meetings, notes, milestones, and formal ISO 27001 management reviews, along with tools to link that history to evidence and export it for an audit. A small usability improvement also lets you preview certificate details without downloading the file.

### Track meetings, notes, and milestones in one Compliance History

You can now record meetings, notes, and milestones alongside formal ISO 27001 management reviews in one place. Records can cover your whole compliance program or a specific project, and each one can be edited, voided, or restored, with changes tracked over time.

### Link compliance history to the controls and evidence they support

You can connect a Compliance History record to the controls, risks, requirements, documents, or other items it supports. This makes it clear during an audit exactly what a given meeting or note backs up.

### Prepare compliance records faster from notes or a transcript

Instead of filling out a form from scratch, you can paste notes or upload a transcript and get a draft record prepared automatically. Nothing is added to your official history until you review and confirm it.

### Export your compliance history for an audit

You can export Compliance History records, including linked evidence, as a downloadable package for auditors.

### View certificate details without leaving the page

You can now click a certificate to open a detail view showing its issuer, course or topic, issue and expiry dates, and notes, with a preview of the file when possible and a download option otherwise. Previously you could only see a short summary line and had to download the file to see more.


## FleetDM integration for endpoint compliance evidence

Released 2026-07-10 • [Permalink](https://auditbadger.com/changelog/2026-07-10/)

You can now connect FleetDM to sync your device inventory and automatically collect endpoint compliance evidence for SOC 2 or ISO 27001, plus some small fixes to device selection screens.

### Connect FleetDM to sync your device inventory

You can connect a FleetDM server using a read-only API token. AuditBadger imports your Fleet-managed devices as assets, lets you choose which devices to bring in, and maps device platforms to your asset categories. AuditBadger does not change devices or Fleet policies, and disk recovery keys are never retrieved or stored.

### Automated endpoint evidence from FleetDM

Once connected, FleetDM automatically supplies evidence for device inventory, MDM enrollment status, disk encryption, and screen-lock policy compliance, so you have less manual evidence collection to do for your audit.

### See FleetDM device status on asset pages

Assets linked to FleetDM now show badges for sync and MDM enrollment status, along with details like hostname, platform, and last-seen time. You can trigger a manual refresh for a single device on demand.

### Cleaner selection counts in device pickers

Fixed a display issue with select-all counts and checkbox states in device and zone selection screens.


## Bulk-install evidence to new controls, Markdown document exports, and MCP feedback tool

Released 2026-07-09 • [Permalink](https://auditbadger.com/changelog/2026-07-09/)

This release lets you activate missing common controls while bulk-installing evidence from an integration, export compliance documents as Markdown, send feedback straight from the MCP assistant, and avoids a scoring error when you change your default risk scoring method.

### Bulk-install can now create missing common controls too

When bulk-installing evidence sources from an integration onto your common controls, you can now also create the common controls that integration could satisfy but that aren't activated yet. A checklist shows exactly which controls will be added before you confirm.

### Download compliance documents as Markdown

You can now export a compliance document as a Markdown file in addition to PDF, directly from the document view.

### Send feedback to us directly from the MCP assistant

If you connect AuditBadger to an AI assistant over MCP, it can now send us bug reports, feature requests, or questions on your behalf. You'll be asked to confirm before anything is sent.

### MCP connection reliability improved, with a new document update tool

We fixed issues that prevented connecting AuditBadger to MCP-based assistants in production. The assistant can now also update the content of editable compliance documents directly.

### Safer default risk scoring method changes

Switching your account's default risk scoring method no longer causes errors for previously scored risks. Existing scores stay as they are, affected risks are clearly marked as needing reassessment, and you get a warning before making the switch.


## New Scaleway and DigitalOcean integrations for automated evidence collection

Released 2026-07-08 • [Permalink](https://auditbadger.com/changelog/2026-07-08/)

You can now connect Scaleway and DigitalOcean to AuditBadger and get automated, read-only evidence collection for your cloud infrastructure. These integrations plug into controls and common controls you already use, and you get notified if an evidence source stops working.

### Connect Scaleway for automated compliance evidence

You can now connect a Scaleway account to AuditBadger using a read-only API key. AuditBadger automatically collects evidence covering IAM policies and API keys, instance and security group configuration, object storage settings, managed database backups and access, Kubernetes clusters, load balancer TLS, container registry visibility, VPC networks, and audit trail activity. The connection is read-only and does not modify your resources.

### Connect DigitalOcean for automated compliance evidence

You can now connect your DigitalOcean team to AuditBadger using a scoped, read-only personal access token. AuditBadger automatically collects evidence covering account and project setup, droplets, backups, SSH keys, firewall rules, VPC configuration, load balancer TLS, certificates, DNS security, storage, uptime checks, managed databases, Kubernetes clusters, and CDN endpoints.

### Apply a new integration's evidence to controls you already use

When you connect a new cloud integration, you can now install its evidence sources directly onto the common controls that are already active on your account, instead of setting up each control by hand.

### Get notified when automated evidence collection fails

If an automated evidence source stops collecting data correctly, you now get a notification so you can review and fix the connection before it affects your audit readiness.


## ISMS workbook redesign, SOC 2 system description upgrades, and AI language consistency

Released 2026-07-06 • [Permalink](https://auditbadger.com/changelog/2026-07-06/)

This update refreshes the ISO 27001 ISMS workbook with document control, revision history, and PDF export. It adds SOC 2 report type and reporting period tracking with a new section for significant incidents and system changes, and makes AI-generated content follow your account's configured language more consistently.

### Redesigned ISMS workbook with document control and PDF export

The ISO 27001 ISMS workbook has a new layout with a table of contents and easier navigation. You can track sections as written or reviewed, issue controlled revisions with a version number and summary, and export the workbook as a PDF alongside your gap analysis.

### Gap analysis lets you turn recommendations into action items

On the ISMS workbook gap analysis screen, you can create a project action item directly from an AI recommendation, and see which recommendations already have one.

### SOC 2 system descriptions capture report type and reporting period

When creating a system description, you can now choose Type 1 or Type 2 and set a reporting period. A new section covers significant incidents and system changes that occurred during that period.

### System description sections flag issues before you can mark them reviewed

Sections with unresolved problems, such as missing content or unclassified vendors, now show a clear message and block marking the section as reviewed until you fix the issue.

### AI-generated content follows your account's configured language

AI-generated notes, suggestions, risk and control descriptions, training material, and certificate upload messages now consistently use your account's configured policy language instead of sometimes defaulting to English.


## Evidence linking and risk matrix fixes

Released 2026-07-03 • [Permalink](https://auditbadger.com/changelog/2026-07-03/)

Three fixes this update: evidence suggestions now work with common controls, GitHub branch protection checks understand modern rulesets, and the risk matrix places risks accurately.

### Link common controls to evidence suggestions

Evidence suggestion actions now correctly recognize common controls that are attached to a project, so you can link and unlink evidence for these controls the same way you do for project-specific controls.

### GitHub branch protection checks now cover rulesets too

If you protect branches using GitHub repository rulesets instead of, or alongside, classic branch protection, AuditBadger now recognizes this. Review requirements and other protections from either system are combined so your evidence reflects the strictest rules that actually apply.

### Risk matrix now shows risks in the right cell

The risk matrix on risk details and the risk register now places each risk based on its actual probability and impact levels, matching what is shown elsewhere on the page. We also updated the risk score formula options to simpler presets and refreshed related labels for clarity.


## Bug fixes: translations and ISMS permissions

Released 2026-07-01 • [Permalink](https://auditbadger.com/changelog/2026-07-01/)

Fixed several translation issues in modals and corrected ISMS workbook permissions so project owners can properly manage related requirements and reviews.

### Fixed translation errors across several modals

We corrected translation lookups in a handful of forms, including training lessons and questions, absence balance requests, user agreements, and vendor evidence requests. These screens now show the correct labels and messages instead of missing translation text.

### Fixed ISMS workbook permissions for project owners

Users with permission to manage an ISO 27001 ISMS workbook can now correctly edit workbook requirements and related sections, reviews, and objectives. Previously, some of these actions were blocked even when the user had the right access.


## Cleaner documents, smarter risk acceptance handling, and translation fixes

Released 2026-06-30 • [Permalink](https://auditbadger.com/changelog/2026-06-30/)

This update improves interface translations, speeds up quick wins suggestions, fixes shared evidence on attached common controls, simplifies the document list for regular users, and stops resolved automated risk acceptances from looking like expired risks on the dashboard.

### Interface translations are more complete and consistent

We removed automatic fallback text for hints and placeholders that had no translation, so you no longer see raw, half-translated labels in forms across compliance evidence and document screens. The whole user facing interface has also received a broader translation pass.

### Quick wins suggestions load faster

Document suggestions on the quick wins screen now generate in the background instead of running during the page request, so the page responds faster while suggestions are prepared.

### Attached common controls now share one set of evidence

Common controls attached to multiple projects previously could build up separate, inconsistent sets of accepted evidence per attachment. They now share a single consistent set of linked documents and evidence acceptances across every project that uses them.

### Regular users see a simpler document list

Team members without document management permissions now see a cleaner document list without assignee details, acknowledgment counts, or other management-only information that isn't relevant to them.

### Resolved risk acceptances no longer look expired

When automated evidence stops showing a previously accepted issue, the related risk acceptance is now automatically marked resolved instead of appearing as an unresolved expired risk on your dashboard. You'll get a notification when this happens, and resolved acceptances remain visible in evidence history and exports.


## User management, automated evidence status, and cleaner acknowledgment tracking

Released 2026-06-26 • [Permalink](https://auditbadger.com/changelog/2026-06-26/)

This update makes it easier to manage users, spot failing automated evidence, and keep acknowledgment tracking accurate by excluding inactive people.

### Manage users without leaving the account page

You can now preview a user or open their details to edit directly from the account users list, using a simple actions menu on each user card. Termination dates are also shown on the card when set.

### Filter controls by automated check status

On the controls list you can now filter by monitoring status to quickly find controls with failing automated checks or ones where a risk has been accepted. This filter also applies to sub-controls and to control exports.

### Failing automated evidence is easier to spot

Evidence collected automatically now tracks a clear status such as fine, warning, failing, or risk accepted. Failing automated evidence shows up as a high priority item on your dashboard with a direct action to review the checks, and you can filter evidence by status and by automated provider.

### Document acknowledgment stats reflect only active people

Acknowledgment progress, pending counts, and completion percentages on documents and controls now count only currently active users. People who are deactivated, past their termination date, or not yet joined are kept in the history and clearly labeled as inactive, but no longer make it look like a document is unacknowledged.


## Agent chat improvements

Released 2026-06-25 • [Permalink](https://auditbadger.com/changelog/2026-06-25/)

We improved the AI assistant chat experience so it behaves more predictably and stays out of your way when you are not actively using it.

### Sidebar assistant no longer creates extra sessions

Opening the assistant sidebar or switching between pages used to start a new chat session each time, even if you never sent a message. Now a session is only created once you actually interact with the assistant, and the sidebar correctly reconnects to a session that was already started on the page.

### Press Enter to send a message to the assistant

In both the full assistant view and the sidebar, pressing Enter now sends your message right away. Use Shift+Enter if you want to add a new line instead of sending.

### Incident actions suggested by the assistant open in a modal

When the assistant suggests reporting or editing an incident, that action now opens in a modal window instead of navigating away from your current page, so you can complete it without losing your place.


## Humadroid is now AuditBadger

Released 2026-06-23 • [Permalink](https://auditbadger.com/changelog/2026-06-23/)

Our product has a new name, and we shipped several compliance workflow improvements. AuditBadger replaces Humadroid across the app, legal pages, and generated documents. We also added self-serve Data Processing Agreement signing, made legal pages embeddable, and fixed reliability issues with PDF exports and control breakdown previews.

### Humadroid is now AuditBadger

Humadroid has been renamed to AuditBadger. You will see the new name across the app, legal pages, generated documents such as PDF exports, account emails, and integration setup screens.

### Generate and sign your Data Processing Agreement online

You can now generate a Data Processing Agreement with your company details filled in and sign it electronically using an embedded signing window, then download the completed PDF.

### Legal pages are now be embedded, and always show the latest version

Terms, the Data Processing Agreement, and the data processors list are now be embedded on oru approved domains. Signup and checkout now always show the most current version of these documents.

### Fewer timeouts exporting PDFs and previewing control breakdowns

We increased PDF rendering timeouts and moved control breakdown previews to run in the background with a loading state, reducing failed exports and stalled previews.



What we're building next: https://auditbadger.com/roadmap/