What's new

This page summarises what changed since the previous edition of this documentation. Each item links to the page that describes it in full.

Security

Encryption at rest. Every stored document version, preview, thumbnail, quarantined upload, upload chunk and signing rendition is encrypted with its own data key. Storage paths no longer reveal anything about content. Existing content converts in the background. Security hardening
Tamper-evident audit log. Audit rows are fingerprinted, sealed into signed chained ranges, and verified on a schedule and on demand from the new Audit integrity page. Governance and retention
Mandatory two-factor for administrators, configurable per role, and session revocation that takes effect within two minutes. Security hardening
Breached-password refusal against an offline Pwned Passwords corpus or the range API, and a 12-character minimum password length.
No self-registration. Accounts are created by administrators and activated by invitation. Users and roles
Separation of duties. Administrative screens are gated by capabilities, and Auditor cannot be combined with the roles it reviews. Actions authorised by the administrator override are marked in the audit log. Security hardening
API request forgery protection with a required header on mutating requests. HTTP API
Content isolation. Document bytes are always served with a sandboxing policy, and an optional cookieless content host serves them through short-lived signed links that renew themselves. Security hardening
Per-user rate limit on signed-in pages that verify a password or authenticator code.

Network identifier retention. IP addresses and user agents are cleared after a configurable lifetime, 90 days by default. Governance and retention
Erasure. Administrators can replace a person’s identity with a pseudonym everywhere it is stored while keeping business records. Redactions are recorded in a signed ledger, so audit verification tells them apart from tampering. Users and roles

Signing requirements with several signers: people, roles, departments or organization units, in sequence or in parallel, with an optional threshold and deadline.
Requirements react to declines, restart on new versions, withdraw requests nobody needs any more, and distinguish required from additional signatures.
A Signing requirements report. Signatures

Mail is held rather than failed until email is configured, and suppressed if it waited too long.
Notifications for new versions, metadata changes and documents moved, deleted or restored reach the people watching them.
Emails and in-app notifications use the recipient’s language, and link to the document or folder. Email

Restore and verify in the backup tool, with a confirm-target gate, automatic file relocation, orphaned-user repair and resumable runs. Backup and restore
Encrypted downloads support range requests and resume.
New background jobs for audit sealing and verification, privacy retention, encryption backfill and antivirus backfill; a disabled job no longer runs instances already queued. Background jobs