Release highlights
This is a consolidation release. Rather than introducing new capabilities, it deepens the audit trail around two-factor authentication, overhauls the System events log, completes the task notification work begun in the previous release, and resolves a significant set of issues in Editable cases and user import.
- System events log renamed and extended with new filters and an Author column
- Full event logging for the two-factor authentication lifecycle
- Automated daily reminders for tasks approaching their due date
- Task authors now notified of updates to their own tasks
- Clearer reporter visibility states in the Involved tab
- Six bug fixes, including Editable cases at scale and profile accessibility
No new features are introduced in this release.
Improvements
1. System events log
The event log has been reworked to make investigation and troubleshooting faster.
- The page is now called System events log (previously Logs / events)
- A new Author / Initiator column shows who triggered each event, and is also available as a filter
- A new Created date filter lets you narrow events to a specific time period
- A new Event type filter lets you isolate a single category of event
- The User filter has been renamed to Involved users to better reflect what it matches
Taken together, these let you answer questions like "who changed this, and when" directly from the log rather than by cross-referencing other screens.
2. Two-factor authentication event logging
Two-factor authentication activity is now recorded in the event log. The system captures:
- Activation of 2FA by a user
- Login attempts using 2FA
- Changes to a user's 2FA status
- Failed 2FA attempts
Each event carries detailed context — including origin, method, outcome, timestamp, and identifiers — which supports both security monitoring and audit review. This builds on the authenticator-app support introduced in version 2026-04 and the administrative controls added in version 2026-07.
3. Easier 2FA setup
When configuring two-factor authentication, the manual setup code can now be copied with a single click. This removes a common source of transcription errors and speeds up enrolment, particularly for users pasting the code into an authenticator app on the same device. Clipboard and accessibility handling have been improved alongside it.
4. Task lifecycle notifications
Task notifications have been extended in two directions.
Expiry reminders. A daily process now identifies tasks approaching their due date and sends reminders ahead of time — to the assignee for their own tasks, and separately to the original assigner for delegated tasks. The notification window is configurable.
Author notifications. Task authors now receive updates on tasks they created, including when a task is updated or deleted. The same handling has been applied to conclusions, so conclusion updates and deletions now trigger events consistently. Existing event types are unchanged and no action is required for current integrations.
5. Editable cases
Editable cases now include Originator and contact phone fields, which can be viewed and updated directly from the grid. Existing cases display the new fields, and permissions and validation follow the same rules as the rest of case editing.
6. Clearer reporter visibility in the Involved tab
Pseudonymisation states in the Involved tab are now easier to read and no longer depend on hovering.
- Users authorised to see reporter identities have a reveal control that is always visible. When a reporter is revealed, the full name is shown; when hidden, a ribbon with a lock icon and the label "Hidden" is displayed instead.
- Users without that authorisation always see the lock icon and the "Hidden" label in place of the reporter's name.
This standardises how hidden identities are presented and makes it immediately clear whether a name is concealed or simply absent.
7. Analytics navigation
The Analytics section now appears in the sidebar as nested navigation, so analytics pages can be reached from the menu rather than by direct link.
Bug fixes
- Fixed rendering failures and errors in Editable cases when an access role covered a large number of cases. Editable cases now work correctly as role scope grows.
- Fixed an issue where editable cases did not render correctly in certain scenarios. Editing states now display consistently, fields initialise with accurate values, and permissions are respected.
- Fixed an exception that made all user profiles inaccessible across roles. Additional checks were added to prevent recurrence.
- Fixed an "Access denied" error when reordering organisational units. Permission checks now correctly respect the unit management permission.
- Fixed an issue where reporters were shown as Anonymous in the Involved tab when a custom contact question was used instead of the standard one.
- Fixed user import so that organisation and unit fields populate and update reliably, and so that profile changes are recorded in the activity log for auditing.
Why this release matters
The common thread here is traceability. Two-factor authentication events, the reworked System events log, and the restored activity logging on user imports all serve the same purpose: making it possible to reconstruct who did what, and when, without leaving the platform. For organisations with audit or evidentiary obligations, that is the substance of this release.
The task notification work closes a practical gap — people responsible for work were not being told when it changed or when it was about to come due. And the Editable cases fixes remove a scaling limit that affected exactly the organisations with the most cases to manage.
Recommended next steps
Review the new filters in the System events log and confirm which roles in your organisation should have access to it.
If you use two-factor authentication, check that the new 2FA events are visible to whoever is responsible for security monitoring in your organisation.
Confirm the task expiry reminder window suits your workflows, and check that task authors are receiving the notifications you expect.
Review your reporter pseudonymisation settings against the clarified visibility states in the Involved tab.