Changelog

This is a major release. Unicis Platform gains a new module — Asset Inventory Management — backed by a new backend service, Unicis Fleet, a multi-tenant osquery TLS management server.

Instead of maintaining an asset register by hand, you install a lightweight agent on your endpoints and the inventory maintains itself: every enrolled machine reports its identity, platform, and configuration, answers scheduled queries, and can be queried live.

Asset Inventory Management

Available on the Ultimate plan under Asset Management in the team sidebar.

• Asset dashboard — total assets with a per-platform breakdown, asset task analysis, and a searchable, filterable asset table that stacks into cards on mobile. Each asset has its own page with overview, status logs, result logs, and the exact configuration the node received.
• Agent enrollment — the Add Asset dialog generates copy-paste install and enrollment commands for Windows, macOS, and Linux (deb and rpm), plus an advanced tab emitting the raw flag set for Ansible, Puppet, Intune, or MDM. Commands come pre-pinned to your tenant, on a fixed osquery version.
• Queries, packs, tags, and distributors — saved SQL on a schedule, grouped into packs and targeted with tags, plus distributed (live) queries for incident response. SQL is validated in the browser before it is saved, and results name the asset they came from.

Unicis Fleet

A new multi-tenant osquery TLS management server, deployed separately and scaled horizontally. It terminates the osquery protocol, isolates each team into its own tenant with its own enrollment secret and TLS material, and exposes a management API scoped by team ID.

Fleet is not yet in our public GitHub organisation. It is an Ultimate-plan capability, and we do not have licence and billing management in the platform yet — so for now the source sits in a private GitLab repository that Ultimate customers who self-host are given access to. Once that licence and billing management ships — giving us proper visibility over entitlements — Fleet moves to a public repository alongside the rest of Unicis. Unicis Cloud customers need none of this: Fleet is operated for them.

Access, Retention & Data

• Six new RBAC resources covering the dashboard, connection, assets, queries, packs, and tags. Auditors get a read-only view — no node controls, no enrollment secret, no agent commands.
• Fleet accounts are separate from platform accounts. Admins bootstrap the team, invite members by email, and can revoke access at any time; platform roles map to Fleet roles automatically.
• Disconnecting expires access immediately and schedules the team’s Fleet data for deletion after a configurable retention window, handled by a new background cleanup worker. Reconnecting before it elapses clears the schedule.
• Two new database models, FleetEnrollment and FleetConnection, both cascading on team and user deletion.
• Full fleet translations for all seven supported languages.

Documentation

• New Asset Inventory Management documentation — architecture, access model, enrollment, agent installation, queries, packs, distributors, retention, API reference, configuration, and troubleshooting.
• New Asset Inventory Management solution page.

Upgrading

Self-hosted deployments should run the new migrations and provide the Fleet environment variables:

npx prisma migrate deploy
npx prisma generate

Unicis Fleet is deployed separately, from a private GitLab repository available to Ultimate plan customers — contact us for access. The full environment variable reference and its Docker Compose setup are in the configuration documentation.

Security & Dependency Updates

• Patched Critical/High vulnerabilities found in a Grype scan of the SBOM: ws, form-data, protobufjs, hono, @grpc/grpc-js, and i18next-fs-backend bumped to their fixed versions
• xlsx switched from the abandoned npm registry package (unpatched ReDoS/prototype-pollution CVEs) to SheetJS’s own CDN distribution, which contains the actual fixes
• daisyUI upgraded to the latest release — compiled CSS diffed against the previous version to confirm no breaking changes
• Added security.txt with our disclosure contact, policy, and OpenBugBounty program links
• Fixed a path traversal vulnerability in attachment download by sanitizing stored filenames before joining them with the upload directory
• Added Content-Security-Policy, Referrer-Policy, and Permissions-Policy headers globally
• Fixed a callbackUrl handling bug that caused NextAuth to silently ignore the post-login redirect parameter
• Added server-side URL protocol validation to the IAP course create/update endpoints, blocking javascript: and data: scheme payloads
• Sandboxed the IAP course content iframe to prevent it from navigating the top frame or accessing cookies
• Rendered markdown now blocks any link that isn’t https?:, mailto:, #, or /
• Pinned quill to a safe version to block a known XSS vulnerability in a later release
• Updated regulatory compliance assessment (GDPR, SOC 2, ISO 27001
  , NIS2)

Fixes

• Duplicate module page titles removed across Risk Management, PIA, TIA, RoPA, IAP, and CSC
• Record of Processing Activities naming unified — the module was showing two different names (“Record of Processing Activities” vs “Register of Procedures”) across the app
• Cybersecurity Management System now shows a record-count badge on its page heading and sidebar entry
• All Tasks sidebar and page title now always show the total task count
• Task detail page breadcrumb unified with the rest of the modules
• Fix due date in EU style DD/MM/YYYY

Enhancements

• Module title and record-count badge moved into the shared sticky header across RPA, TIA, PIA, RM, IAP, and CSC, freeing up vertical space on every module page
• Settings sub-pages now show “Settings: {team name}” in the header instead of repeating it as an in-content heading on every tab
• Cybersecurity Management System’s record count reflects the currently selected framework tab; the tab selection is now synced to the URL and deep-linkable
• Sidebar navigation gained a neutral “total items” badge for RoPA, TIA, PIA, and IAP, alongside the existing “needs attention” badges

Translations

• Added a Weblate translation status badge to the project README, making it easier to see translation coverage at a glance and contribute new languages via Hosted Weblate — no code required

Documentation

• Community Edition (Self-Hosted) guide updated with an Upgrading section covering npx prisma migrate deploy and npx prisma generate
• Settings and Introduction pages updated to link to the Hosted Weblate translation project
• RoPA dashboard column table corrected to use the current field name

New Features

MCP Server

• New MCP (Model Context Protocol) server, letting AI assistants such as Claude read and act on Unicis Platform data directly — Tasks, RoPA, TIA, PIA, Risk, CSC, comments, attachments, and API keys
• Authenticates with an existing API key, generated from Team Settings → API Keys
• Available on Premium and Ultimate plans only — not available on Community

Documentation

• New MCP Server page added to the platform documentation
• API Reference updated with a section linking to MCP server setup
• Integrations page updated with the MCP Server entry
• Pricing page and plan comparison table updated to list MCP Server availability by plan

New Features

Dashboard

• Domain Health Row — three live status cards (Data Protection, Cybersecurity, Risk Management) appear above the dashboard tab switcher; clicking a card switches to the corresponding tab
• IAP KPI card — now shows the non-compliant member count, colour-coded (amber/red), with a direct link to IAP admin
• Needs Attention panel items deep-link directly to the individual task
• TIA “at risk” badge in the dashboard header — displays the count of non-authorised transfers or ”✓ All permitted”

Webhooks

• New Last delivery column in the webhooks table showing the most recent Svix attempt status and timestamp (success / pending / failed)

Enhancements

Design System

• Direction B design language applied across all modules — unified card shell, panel headers, table header typography, tab bar, and hover states (All Tasks, RPA, TIA, PIA, CSC, RM, IAP, Dashboard)
• Module Create buttons and empty-state CTAs migrated from DaisyUI to Shadcn <Button>
• ModuleBadge rewritten as a pure Tailwind component; rendered inline in All Tasks and the Dashboard task matrix
• Module page headings with record count pill added to RPA, TIA, PIA, RM, and IAP
• Comments redesign: single-column layout, hover-reveal edit/delete, Direction B typography
• IAP completion summary banner added above the course grid

Risk Management

• RM table header redesigned — replaced rotated VerticalHeader with a two-row grouped header (Raw Risk / Treatment / Target Risk / Current Risk) for improved readability

Cybersecurity Controls

• StatusesTable and SectionRail wrapped in a single Direction B card; SectionRail is hidden below the lg: breakpoint for better mobile usability

All Modules

• All table action columns standardised to icon-only buttons with aria-label (Tasks, RPA, TIA, PIA, RM, Members, Invitations, IAP admin, Webhooks)
• TIA country fields now display translated country names (previously rendered raw lowercase stored keys)
• AuditTimeline generic component wired to all modules (RPA, TIA, PIA, CSC, RM)

Accessibility (WCAG 2.1 AA)

• <html lang> attribute set from SSR locale on every page
• All Chart.js canvases wrapped in role="img" containers with descriptive aria-label
• Mobile sidebar (Drawer) rewritten as an accessible dialog: role="dialog", aria-modal, focus-on-open, Escape key, Tab focus trap, aria-hidden backdrop
• Dashboard tab bar wired with full ARIA tab pattern (tablist, tab, tabpanel)
• Notification bell aria-label is dynamic with unread count; badge carries aria-hidden
• Webhook form: events fieldset wrapped in <fieldset><legend>; inputs wired with aria-invalid, aria-describedby, and role="alert" error messages
• All icon-only buttons and interactive cards carry aria-label; active domain health cards carry aria-pressed
• External navigation links include a visually-hidden “(opens in new tab)” label
• Content text colour raised to meet 4.5
  contrast ratio across KPI strip, task analysis, risk analysis, and webhooks table

Billing

• Monthly / Annual billing toggle with a 20% discount on annual plans
  • Premium: €15.20/mo billed monthly · €182.40/yr billed annually
  • Ultimate: €39.20/mo billed monthly · €470.40/yr billed annually
• Annual billing stored on the subscription (isAnnual field); next invoice date advances 12 months instead of 1
• Payment card reflects the annual discount, shows “/yr” billing cycle and “Annual” badge
• Pricing page redesigned — “Most Popular” badge on Premium, plan descriptions, colour-coded feature checkmarks
• Post-request confirmation toast now shown in all 7 supported languages

Mobile & Responsive

• Teams table: overflow-x-auto inner wrapper added for horizontal scrolling on small screens
• Risk matrix chart: wrapped in overflow-x-auto to allow horizontal scrolling on mobile
• All Tasks toolbar: stacks vertically on mobile, aligns inline on lg:+
• Task filter dropdowns: flex-1 min-w-[150px] applied so selectors share width evenly on narrow viewports
• All remaining tables audited against the nested two-div overflow pattern

Translations & Internationalisation

• Italian, Japanese, and Portuguese added as fully supported locales — 880+ keys translated per language across all modules (Tasks, RPA, TIA, PIA, CSC, RM, IAP, Dashboard, Settings, Fleet, Auth)
• Language switcher added to Profile → Account settings; all 7 locales are now selectable in-app without touching the URL
• iap.json namespace created for all 7 locales; dashboard labels (“Your completion”, “Total”, “Completed”, “In progress”) now translate correctly
• Hardcoded English labels replaced with t() calls in CscStatusBadge, CompletionResultsChart, and StatusResultsChart
• Dashboard task matrix column headers migrated to i18n keys
• Domain health card tab-switch aria-labels fully translated across all 7 locales
• CSC bulk-action toast messages split into distinct keys with proper {{count}} / {{status}} interpolation

API

• PUT /api/teams/{slug}/csc (single control status update) added to OpenAPI spec — previously undocumented; public/openapi.json regenerated

Testing

• 62 Jest unit and API handler tests added: status-key regression guard, CSC helper invariants, dashboard counting logic, full CRUD coverage for /tasks and /tasks/[taskNumber], and both CSC endpoints
• 3 Playwright E2E test suites added: dashboard task matrix + tab switching, task list / kanban usability, CSC bulk status change and task assignment

Fixes

• TIA: Legal Analysis column was rendering DataExporter instead of LawImporterCountry
• PIA: First column header labelled with the wrong translation key
• CSC: Dark mode inactive tabs appeared selected due to unconditional dark:text-slate-200
• RM: Asset Owner column showed “Not found” due to invalid Map bracket access; fixed to .get()
• RM: Unstable row keys (key={idx}) changed to key={task.id}
• CSC: Bulk status change was updating only the last selected control — root cause was mutateStatuses() called after every individual write, causing SWR re-fetches to race with Prisma; fixed by writing all controls first, then mutating once
• CSC: Task assignment required a full page refresh to appear; fixed by await-ing mutateTasks
• Dashboard: Task matrix status counters showed 0 for In Progress and In Review — STATUS_COLS keys mismatched DB-stored values; fixed across dashboard, TeamTasksAnalysis, GlobalSearch, and TaskKanbanBoard

Improvements

Task

• Added task import templates that generate tasks from enabled CSC framework controls
• Added a dialog to set a CSC control status after linking a task to an unknown-status control
• Kanban tasks board
• Recurring tasks
• Import/Export for RoPA/TIA/PIA/RM

Enhancements

• Added bulk and per-control linking of tasks to mapped CSC controls across enabled frameworks, including status propagation from the source control
• Emojis for comments and reaction
• Prioritizations for tasks
• Import/Export supports OpenDocument standard
• Audit logs for tasks changes
• Notification team identifier
• PIA/RM links for dashboard matrix
• Links added for RoPA/TIA/PIA/RM steps

Fixes

• Task attachments visible only on overview tab
• Hide the CSC matrix mapping view from the task-level CSC issue panel

Improvements

User Registration

• Added Zod validation for user registration forms
• Improved input validation and error handling consistency

Fixes

SAML

• Fixed React version compatibility issue on the SAML page

Settings & Permissions

• Fixed OWNER role having incorrectly restricted permissions in Settings

Training

• Fixed Training start button label capitalization

API Documentation

• Fixed Notification API documentation specification inconsistencies

Audit Logs

• Fixed Audit Log service not working on both development and production servers
• Improved Audit Log service reliability and stability

New Features

Notifications

• In-app notification bell with real-time unread count
• Email and web push notification channels
• Per-user notification preferences
• Notification events (each configurable per channel — in-app, email, push):
  • Task due
  • Task created
  • Task updated
  • Task commented
  • Task deleted
  • File uploaded

REST API

• OpenAPI 3.0 specification (Swagger UI available at /api-docs)
• API Key Bearer Token authentication — generate keys in Team Settings
• Consistent JSON response envelope: { "data": ..., "error": null }
• Endpoints covering Tasks, Cybersecurity Controls (CSC), Risk Management, PIA, RPA, TIA, API Keys, and AI Chatbot

New Frameworks

• Added OWASP ASVS v5 — Application Security Verification Standard
• Added PCI DSS v4.0.1 — Payment Card Industry Data Security Standard
• Added ISO/IEC 42001 — AI Management System Standard

Tasks

• Added task.due_date webhook event — triggers when a due date is set or changed on a task

Security

• Bearer token verification: expiration checks and team-scoped access
• SBOM (Software Bill of Materials) generated and published
• Bearer SAST scan — vulnerabilities reviewed and resolved
• npm audit fix applied

Fixes

• Fixed Team Create button missing from Teams interface
• Fixed Billing modal: country (en) key returning object instead of string

New Features

Tasks

• Added export functionality for Tasks in HTML, PDF, Excel, and CSV formats.
• Added bulk import capability and task template support via Excel or CSV files.

Cybersecurity Management System

• Added export functionality for the Statement of Applicability (SoA) in HTML, PDF, and Excel formats.
• Introduced Controls Mapping across multiple frameworks and standards, including:
  • Visibility of the number of mapped controls
  • Detailed view of relationships between mapped controls
  • Display of Tasks linked to mapped controls
• Added Controls Mapping Matrix to visualize the mapping status between different frameworks and standards.

Security

• Updated Prisma and Next.js to their latest stable versions.

Fixes

• Fixed issues affecting Cybersecurity controls selection.
• Updated platform pricing display.
• Fixed issues in the Risk Management dashboard.

New Features

• Added localization support: The platform is now available in French, German, and Spanish alongside the default English. Check the status on the translation platform.
• Added theme toggle on login page
• Added copy action for API keys
• Added ENV variable for AI custom integration with different models and providers

Enhancements

• Improved chart labels and readability in localized views
• Improved responsiveness across key pages and forms
• Refreshed UI consistency in navigation, cards, and tables
• The minimum Risk value can be set to 0%
• Better behavior of multiselector
• Improved 404 page
• Updated features plan: AI Chatbot now available for Premium and Ultimate

Fixes

• Fixed visual issues in dark theme and legacy browser cases
• Fixed navigation and layout issues on mobile
• Fixed issues in selectors and filtering behavior
• Fixed description editor in Interactive Awareness Training module
• Fixed task comments behavior
• Library updates npm audit fix

Vulnerability fixed:

• HIGH: Unsanitized user input in HTTP response (XSS) CWE-79
• Unsanitized user input in dynamic HTML insertion (XSS) CWE-79

New Features

• Added SOC 2 compliance framework
• Added C5
  compliance framework
• Introduced multiple framework support for improved flexibility

Enhancements

• Improved permission schema for better access control management
• Added Markdown shortcuts for task comments and descriptions
• Introduced “Resend verification email” button for easier user onboarding
• Added “Copy” button for invitation links
• Enhanced chart readability
• Improved mobile view layouts for better responsiveness
• Docker hub repository for Unicis Platform

Access & Security

• Audit logs are now available exclusively for Ultimate plan users
• Improve security with introducing CI/CD pipeline by adding Bearer code security scanning tool (SAST) to discover, filter and prioritize security and privacy risk in Unicis Platform

Fixes/Bugs

• Email service reliability improvements with introducing Resend intergation for email delivery

Bug Fixes & Enhancements

• Dark theme display issues
• Improved chart color schemes
• Applied multiple UI style adjustments
• Layout and interaction issues in Dashboard views
• Functionality bugs in Interactive Awareness Training module
• Issues with task attachments handling and display

Security & Vulnerability Updates

Upgraded several key dependencies to their latest major versions, including:

• react-email
• next
• next-auth

Authentication Improvements

• Fixed and enhanced SSO SAML authentication flow

Security

• Security vulnerability fix: Improper Session Management - Lack of Request Validation

Dependency libraries

• Tailwind CSS upgrade from v3 to v4
• daisyUI ugrade from v4 to v5
• react-daisyui removed
• Atlaskit library removed
• Shadcn library introduced

New features and improvements

• New controls added: EU NIS2; GDPR; CIS
• Badges and filters introduced to the task list
• Logs list redesign
• Pagination redesign
• General dashboard graphical enhancements
• Dark theme improvement

Enhancements

• Record of Processing Activities creation new behavior - Depending on specific input, an automatic triggering of Transfer Impact Assessment and Privacy Impact Assessment creation
• Add titles to modal view
• Security vulnerability fix: Next.js middleware authorization bypass fix

Bug fixes

• Strong password improvement
• Firefox styles fixes
• Permissions scheme improvements
• Emails logo image fix

This is the biggest and more enhances GRC release of Unicis.

Highlights

Billing and Payment

• Easy payment with Wise and Credit Card

Supply chain

• Generate SBOM - regulatory requirements

AI Chat Bot

We introduced new AI Assistance Chat Bot module

• AI Chat Bot module

New modules

• Privacy Impact Assessment module
• Risk Management module
• Interactive Awareness Program module
• Added steps on modal

Bug fixes

• Responsive dashboard
• Dark mode
• Library updates npm audit fix
• Permission fix
• Prisma latest

Security fixed and patched vulnerabilities from pentest report per severity:

Severity

• High: API accessible without authentication
• Medium: No rate limit on forgot password request
• Medium: No account lockout implementation
• Low: When an unexpected input was supplied to the API
• Low: Cookie lacks HTTP-Secure attribute
• Low: Excessive info disclosure
• Low: Clickjacking on login page
• Low: HSTS header missing from response
• Low: Check for excessive information disclosure in API response (OWASP A01-Broken Access Control)

We’re excited to announce Unicis Platform Beta 2, our biggest release yet. This major update brings a completely redesigned compliance hub, new cybersecurity modules, and an open-core community edition that’s free forever.

Highlights

Tasks

• Add Breadcrumbs for better navigatio

Dashboard

Tasks

- Total number of tasks
- Pie chart per status

Record of processing activities:

- Total number of records
- Total number of enabled data transfer
- Total number per Country

Transfer Impact Assessment

- Total number of assessment
- Total number of assessments per country (only the listed countries)
- Number per authorizations: PERMITTED and NOT PERMITTED

Cybersecurity Controls (only for selected control)

- Total number of controls
- Pie chart
- Spider chart

Billing

• Add billing feature

Bug fix

npm audit fix

This release introduces first BETA 1 release of Unicis Platform

New Features

Task Management

• Comments
• Audit
• Attachment

Record of Processing Activities

• Bug fix and UI fix

Transfer Impact Assessment

• Bug fix and UI fix

Cybersecurity Controls

• ISO 27001
  and 27001
• NIST CSF 2.0

Enhancement and Bug fixes

• Bug fix
• Documentation link
• Feedback link
• Dark mode

Unicis Platform Alfa release.

Features

• Task Management — Create, Delete, Update
• Record of Processing Activitiess — Import Atlassian RoPA App into Unicis Platform
• Transfer Impact Assessment - Import Atlassian TIA App into Unicis Platform
• Cybersecurity Controls - Import Atlassian CSC App into Unicis Platform, and add MVSP framework
• API

Documentation

• Website documentation