What shipped, and when
Dated, in the reader’s favour: an entry appears here on the day the change reached production, not on the day somebody wrote it up. Where something shipped switched off, the entry says so rather than counting it as delivered.
September 2026
The long documents became readable on a phone
The terms, the privacy policy, the security page, the sub-processor register and every documentation guide now carry a jump bar that follows your reading position. Footer and navigation targets were resized for a thumb rather than a mouse, and three documentation pages stopped scrolling sideways.
Inbound filters, with a record of what they removed
A project can now say what not to keep. Rules apply at ingest, after scrubbing and before storage, so a filtered event is never written and never counted. Each rule shows what it dropped, because a filter nobody can see cannot be told apart from a broken SDK.
The sub-processor register became a page
Every third party this deployment sends data to, published and linked from the footer of every page rather than available on request. Backup artifacts also moved off the disk they are meant to protect, and the register says so.
AI code review crossed the wire for the first time
A real change was posted to the review endpoint and a real finding came back. The first one did not survive review — which is the reason findings arrive as model output for a person to weigh, rather than as verdicts to act on.
The platform started tracing itself
Our own services now emit spans to our own ingest endpoint. A monitoring product that is not monitored is a claim rather than a demonstration.
August 2026
SAML single sign-on, proved against a real identity provider
SAML 2.0 joined OpenID Connect on one connection, and was exercised against a real provider rather than against a test double: signature, audience, conditions and request binding all verified by real traffic. Three defects were found doing it, none of which any test had caught.
One header and one footer, on every public page
The site had two of each, and they had drifted: two pages written specifically to be found were reachable only from the sitemap. Both are now shared components, and a test fails the build if a page becomes unreachable again.
Session replay follows the plan it is sold on
The pricing page said the free plan excluded replay and the platform did not. Now it does, and refuses at the door with a message naming the plan rather than by silently discarding an upload.
Invitations, and seats that are checked twice
Teams can be invited by email. The seat is checked when the invitation is issued and again when it is redeemed, because how many seats are free is a fact about now rather than about last Tuesday.
Email alerting went live in both languages
Alerts, digests and password resets are delivered through a verified sending domain, in the recipient’s own language, and delivery was confirmed by looking at delivery records rather than at configuration.
Payments went live
Card payment reached production with signature verification, an idempotent purchase ledger, plan expiry checked when data is read, and a retention grace period after a lapse so nothing disappears the moment a payment fails.
The pricing page was brought in line with the catalogue
The page described enforcement, automatic renewal and annual billing, none of which the product does. All three are gone from both languages, and tests now fail the build if that class of claim comes back.
The roadmap is the other half of this
A changelog only lists what exists. The roadmap lists what does not, including the things a buyer would be right to hold against us.