What's new

Product updates

Notable shipped work, features, security improvements, and the quiet polish that compounds over time. Updated on every material release.

April 2026Feature
Plan-level feature gating, marketing site launch, and the command palette
- Plan tiers now enforce capability packs at the API layer. Starter tenants physically cannot enable Growth-only features (AI assistants, AFAS, custom domain) even if they guess the endpoint
- Public marketing site live at hall.colport.io with pricing, compliance details, trainer directory, and FAQ, all EU-indexed and AVG-compliant
- Cmd+K opens a keyboard-first command palette across the app, three grouped sections (Admin / Learner / Settings) plus live search of courses, paths, trainers, and people
April 2026Polish
Accessibility and performance pass
- Skip-to-content link added to every page; all landing-page `<main>` elements now carry proper landmark IDs
- Loading states replaced across admin list pages, skeleton rows instead of spinners for perceived-performance gains
- Relative time display on announcements, leads, certificates, and notifications, locale-aware via Intl.RelativeTimeFormat
March 2026Feature
B2B signup rebuild, domain-based self-join and SSO
- Open self-signup replaced with three flows: sales-led org creation, domain-based employee self-join via a shareable link, and explicit manager invites
- Magic-link email verification for new employees, no passwords stored server-side until the learner sets one
- OIDC SSO presets for Microsoft Entra ID, Google Workspace, Okta, and generic OIDC IdPs (Enterprise plan)
March 2026Security
GDPR hardening
- AES-256-GCM encryption for SSO client secrets at rest; encryption key rotated via ENCRYPTION_KEY env var
- Lead capture pipeline documents lawful basis per field and auto-purges rejected leads after 30 days
- Articles 15/17/20 (access, erasure, portability) fulfillment moved to /me/my-data self-service endpoint
February 2026Feature
Autonomous compliance engine
- Renewal reminder cadence (90, 60, 30, 14, 7, 3, 1 days) fully automated with manager escalation at the 14-day mark
- Cryptographic proof vault for compliance evidence (Enterprise plan), tamper-evident hash chain, 7-year retention
- Weekly regulatory change monitoring for workplace safety, GDPR, HACCP, NIS2, and regional labour-law updates
January 2026Platform
Platform foundations
- Multi-tenant RLS enforced on every table at the database layer, zero cross-tenant leak exposure
- pg-boss async queue for email, SMS, AI processing, certificate generation, nothing slow blocks the request cycle
- EU data residency pinned end-to-end: Supabase Frankfurt, Hetzner EU, Vercel EU, Resend EU, CM.com Netherlands

Subscribed customers get release notes by email. No separate sign-up needed.

Plan-level feature gating, marketing site launch, and the command palette

Plan tiers now enforce capability packs at the API layer. Starter tenants physically cannot enable Growth-only features (AI assistants, AFAS, custom domain) even if they guess the endpoint

Public marketing site live at hall.colport.io with pricing, compliance details, trainer directory, and FAQ, all EU-indexed and AVG-compliant

Cmd+K opens a keyboard-first command palette across the app, three grouped sections (Admin / Learner / Settings) plus live search of courses, paths, trainers, and people

Accessibility and performance pass

Skip-to-content link added to every page; all landing-page `<main>` elements now carry proper landmark IDs

Loading states replaced across admin list pages, skeleton rows instead of spinners for perceived-performance gains

Relative time display on announcements, leads, certificates, and notifications, locale-aware via Intl.RelativeTimeFormat

B2B signup rebuild, domain-based self-join and SSO

Open self-signup replaced with three flows: sales-led org creation, domain-based employee self-join via a shareable link, and explicit manager invites

Magic-link email verification for new employees, no passwords stored server-side until the learner sets one

OIDC SSO presets for Microsoft Entra ID, Google Workspace, Okta, and generic OIDC IdPs (Enterprise plan)

GDPR hardening

AES-256-GCM encryption for SSO client secrets at rest; encryption key rotated via ENCRYPTION_KEY env var

Lead capture pipeline documents lawful basis per field and auto-purges rejected leads after 30 days

Articles 15/17/20 (access, erasure, portability) fulfillment moved to /me/my-data self-service endpoint

Autonomous compliance engine

Renewal reminder cadence (90, 60, 30, 14, 7, 3, 1 days) fully automated with manager escalation at the 14-day mark

Cryptographic proof vault for compliance evidence (Enterprise plan), tamper-evident hash chain, 7-year retention

Weekly regulatory change monitoring for workplace safety, GDPR, HACCP, NIS2, and regional labour-law updates

Platform foundations

Multi-tenant RLS enforced on every table at the database layer, zero cross-tenant leak exposure

pg-boss async queue for email, SMS, AI processing, certificate generation, nothing slow blocks the request cycle

EU data residency pinned end-to-end: Supabase Frankfurt, Hetzner EU, Vercel EU, Resend EU, CM.com Netherlands