Skip to content

Release notes

What changed in each published version of the HodeiShield console, told from the point of view of the person using it. The most recent come first.

What this page covers

It starts at 2.39.0 (2 October 2026), the first version that includes the beta programme in the console. Earlier versions are not listed here. Each entry describes only what the version published under that number contains. Security fixes are described without technical detail.

2.43.1 — 14 October 2026

A security hardening release, with no new features.

Improvements and fixes

  • Password change. We closed an alternative password-change route that accepted passwords meeting only the minimum length, without going through the complexity, common-password and context-word checks. Every password change and reset now goes through the console screens, which apply the full policy. Changing your password in the console works as before.
  • Per-address usage limits. Request limits per IP address now apply to the whole network in the case of IPv6, so a single machine no longer gets a fresh allowance for every address it uses. This affects agent enrolment, observation uploads, public routes, sign-in, and the Trust Center and questionnaire pages.
  • Database permissions. The application's privileges on several global catalogues and on the deployment records were reduced; those are now read-only for it.
  • Verifiable deployments. The counts from the compliance re-evaluation that runs on each deployment are now stored in the deployment record, instead of being lost with the job log.

2.43.0 — 13 October 2026

New

  • MSSP: own staff. An MSSP can now add its own team as organisation administrators or analysts, instead of only inviting users of a single tenant.

Improvements and fixes

  • Hodeitek platform administration accounts can no longer sign in without a second factor (MFA): until now only the tenant policy enforced it.
  • Beta with an MSSP. Tenants of a child organisation of a beta MSSP inherit the beta, and the notice that the provider includes HodeiAI now names that provider.
  • Quotas. One MSSP client's usage is no longer charged to the shared organisation pool to the point of blocking another client's invitations and HodeiAI messages. The plan screen and the public Trust Center AI meter are also fixed.
  • Isolation between clients of an MSSP. Several isolation defects between clients of the same MSSP were fixed: two lookups (the NIS2 art. 21 responsible person and the HodeiAI dictionary) and the invitation flow. A client administrator can now only add users from their own scope.
  • Re-inviting a staff member the MSSP had removed no longer answers "already a member".
  • An MSSP invitation sent without a role no longer shows the administrator text.
  • Compliance coverage for all tenants is recalculated when control mappings are loaded or changed; before, it only updated on the next evidence event.
  • The application build no longer downloads Google fonts at build time.

2.42.2 — 12 October 2026

  • The states emitted by version 2.12.4 of the endpoint agent (reasons and persistent storage) now have their own text in the console instead of showing the raw value, and the console stops describing the retired retention rule.
  • Public API: portfolio reads no longer advertise a 1500/min quota when the 100/min per-key limit applies first.
  • Two size-limit texts corrected in Italian and Spanish.

2.42.1 — 11 October 2026

No visible changes for you: internal verification and deployment fixes.

2.42.0 — 11 October 2026

New

  • Public API v1 for MSSPs. A portfolio credential lets an MSSP work across all its clients with a single key or a single CLI profile, instead of one key per client.

Fixes

  • Legal. The public subprocessors page and the privacy notice claimed assurances (Mistral EU residency, zero retention, universal pseudonymisation, a mail region, absolute scrubbing in Sentry) that were not backed by evidence, and left out five subprocessors. They now say "under verification" where there is no provider commitment and list all five. The documentation no longer promises AI Act compliance, and three domains now publish their security.txt.
  • Access to organisation API credentials was hardened: the value derived from a key is no longer readable by the application.
  • Portfolio tokens (hsp_) are now redacted, like the others, in data that leaves for error monitoring.
  • Expiry and overlap labels in Basque and German on the portfolio key dialogs.
  • A format rule for organisation and tenant identifiers (slugs) is applied without breaking the editing of older records.

2.41.4 — 11 October 2026

  • Less data travels to error monitoring: traces no longer include sign-in emails, client IPs or session cache keys.

2.41.3 — 11 October 2026

  • More sensitive data removed from error monitoring and session replays: addresses carrying tokens in trace names and attributes, and the tail of token pages.

2.41.2 — 10 October 2026

  • Security (SAML SSO). The SAML signature library was updated to a security release, and the pre-check now rejects responses with more than one signature element.

2.41.1 — 10 October 2026

  • SENSE ingestion now recognises the agent's closed vocabulary of reasons why a probe could not run, and no longer mistakes it for a bad value.
  • Vendors without a domain no longer stay "due for scanning" forever.

2.41.0 — 8 October 2026

  • API v1. Alert severity is returned and filtered as critical/high, as the published documentation says; before, severity=high matched nothing.
  • The retired attestation key is published with its retirement date, so a document dated after the rotation no longer verifies against it.
  • Internal work on measuring platform usage and on the licence ledger (tier changes on conversions and plan changes).

2.40.3 — 8 October 2026

  • An external logo host that is no longer used was removed from the application image (logos are served from our own storage).
  • The health probes of the API, MCP and the application now say which version is being served.

2.40.2 — 7 October 2026

  • Redesigned emails. New header and footer (with legal address and public link), time with time zone in invitations and expiry notices, correct date format per language, and a button that also renders well in Outlook.com. The subject and text of error notices no longer mix languages.
  • Daily backup of the automation database.

2.40.1 — 7 October 2026

  • Beta. The end-of-beta notices (14 and 3 days) of an MSSP also reach its clients' administrators, and the notice to an MSSP client points to its MSSP, not Hodeitek, for the offer.
  • With online billing switched on, a tenant in beta can no longer open a payment: it is directed to the sales contact.
  • Switching HodeiAI off no longer hangs for 30 s or returns a 500 error.
  • The MCP licence check takes a running beta into account for an MSSP on a starter licence.
  • The bundled attestation verifier was updated (v1.2.1).

2.40.0 — 6 October 2026

New

  • Beta. The console and welcome emails explain how to ask for support and how quickly we reply; organisations in the beta see full access while it lasts, not the trial level; tenants in the beta on a trial licence have HodeiAI on by default.
  • Questionnaires. Sending a questionnaire now really sends it to the vendor, instead of only giving a link to copy.
  • Endpoints. The console shows the code signature of the agent installers.

Fixes

  • Isolation and audit. Authentication events without a tenant, and those of an MSSP, were filed where an MSSP client could see staff email and IP; the sign-ins of a client administrator landed in the MSSP's internal tenant. Fixed. More actions (MFA enrolment and removal, invitations, evidence, DORA incidents, vendor responses) now leave an audit trail.
  • Authentication. The user sign-up link no longer says "reset password"; the recovery request limit can no longer be evaded by rotating IPv6 addresses; disabling MFA no longer shows a false error.
  • Invitations. An expired MSSP invitation has a way out and can be resent; the acceptance page states the organisation and the invited email; resending to the same person no longer leaves two live links.
  • Alerts. The critical CVE email is no longer resent every day, nor lost for a CVE that escalates in under 24 h; the owner mailbox is no longer hard-coded as the SOC of every tenant.
  • Vendors. Moving a vendor to the bin no longer returns 500; the score is the same in the list and in the detail page; onboarding asks for the contact email that pre-fills the questionnaire.
  • Reports. The board and ENS reports (PDF, Excel and Markdown) come out in the user's language; the ENS evidence index is no longer empty; only reports for active frameworks are offered.
  • Translations. About 560 strings still in English or Spanish in the other languages, and the tab titles of 86 pages.
  • Monitoring security. Filtering of personal data and secrets before events are sent to Sentry was greatly strengthened, and the /monitoring tunnel only forwards to fixed destinations.
  • Support. The support addresses the console offered belonged to a domain with no mail and bounced; fixed.
  • The console's security.txt is served without authentication.
  • Several legal and privacy texts corrected (OVHcloud, Cloudflare and Resend subprocessors).

2.39.4 — 5 October 2026

  • DORA incidents. A DORA incident can be closed and the assessment of a possible major incident recorded; notification to the authority can be declared with a date and reference (recording is not notifying).
  • The engine no longer calculates NIS2 art. 23 deadlines without knowing whether the entity is essential, important or out of scope; AI Act art. 73 deadlines only apply to high-risk systems; report drafts come out in your language and say they are drafts.
  • A tenant acting as processor no longer receives the controller's notification to the supervisory authority as a GDPR draft.
  • New privacy information for the console itself (the role in which it processes data, and its subprocessors).

2.39.3 — 5 October 2026

No visible changes for you: an internal formatting fix.

2.39.2 — 5 October 2026

  • DORA. Incident severity is now calculated on the server with the thresholds of Delegated Regulation (EU) 2024/1772, not in the browser, and is re-evaluated after 24 h. The "possible major incident" notice is not repeated every 7 days for ever and reaches the right people.
  • Deadlines. The console says the calculation is an aid and not legal advice, and that classifying and notifying is the entity's responsibility.
  • GDPR. The deadline of a data subject request runs from receipt (art. 12.3), not from registration, and the receipt date can be entered.
  • A scope change, or editing only the title, no longer deletes the deadlines of an incident saved under the previous rule.
  • The trial plan no longer promises 15 days: the beta lasts three months.
  • Regulatory texts reviewed in the six languages.

2.39.1 — 3 October 2026

  • The criteria and recommended actions of the incident classification engine appear in the user's language (before, they showed in English in all six languages), in the console and in four reports.
  • The anchors panel stops offering "classified as major" where DORA does not apply.
  • More careful demo incident data.

2.39.0 — 2 October 2026

New

  • Three-month beta programme. The platform can enrol an organisation in the beta and record its discount. The console shows beta testers that they are in the beta and how many days are left, with notices at 14 and 3 days (in addition to email).
  • A beta tester can send feedback to Hodeitek from the console.
  • Trial licences of a beta organisation last as long as the beta, instead of 15 days.
  • The platform panel can manage an organisation's beta without losing a partner's trial licence quota.

Fixes

  • Incidents. DORA and NIS2 deadlines run from classification as major or from submission of the previous report, not from detection; a warning is sent before they expire.
  • An incident classified as major can no longer be left without DORA deadlines.
  • CVE emails are no longer lost when a tenant has no recipients.
  • The beta mark in the top bar no longer adds about 325 kB to the first load.