What we're shipping
and what's coming next.

90-day uptime bars on /status, backed by our own probes every five minutes stored in Postgres. Days we weren’t measuring show as "no data" — never as uptime.

View and download every invoice from your billing page — no bounce to an external portal.

The signed-in app is fully localized in English, Dutch, German, and French, with an in-app language switcher that remembers your choice.

A config-driven CSV mapping engine with an admin mapping builder. ICS Visa ships as a preset next to Amex; any issuer's export becomes clean transactions.

Pay per active card, not per employee. Archived cards return proration credit automatically; 14-day trials on paid tiers; seats reconcile nightly against Stripe.

The ivory + teal design system this page uses — rolled out across the web app, the iOS app on TestFlight, and a new native macOS app.

Tamper-evident audit hash-chain, legal hold, a retention engine, CI-gated production deploys, and a nonce-based CSP — SOC 2 groundwork shipped as code, not paperwork.

Rotating refresh tokens with reuse detection, Face ID unlock on iOS, and verified email domains so teammates auto-join the right workspace.

Missing-receipt and pending-approval nudges with per-transaction cooldowns, plus close-of-books reminders keyed to your statement cycle — not the calendar month.

Generate a Twinfield Transactions XML for any period. One temporary journal per card transaction; finance promotes to final inside Twinfield.

Surfaces transactions with no provenance trail and lets admins/finance scrub them. Cascades to matches, comments, approvals, and explanations.

Long-lived device cookies bucket sign-ins from the same physical device under one collapsible row, even across changing IPs.

Postgres RLS active on every tenant-scoped table; reserved tenant pool with app.company_id GUC; CI guard prevents regressions.

Sessions inactive longer than the configured window get revoked on a daily sweep, with an audit trail per revoke.

Queue and request metrics exported over /metrics; daily encrypted audit-log archive to S3-compatible storage.

Subject access + erasure requests handled in-product; signed PDF receipt issued on completion.

Admins can freeze a workspace; deletes enter a configurable grace period before hard removal.

Invoices issued with location-aware tax. Reverse-charge for B2B EU, EU OSS for B2C consumers, US sales tax handled by Stripe.

Per-department default workflows + per-member overrides; finance-only, two-step (manager → finance), and auto-approve thresholds.

Multi-cardholder Amex CSVs (NL + EN headers) split per card. Foreign-spend + FX rate parsing; per-row occurrence index keeps real duplicate charges.

The verification core is merged: per-connection policy, signed-assertion checks, and replay protection held in Postgres. Login routes and the admin connection UI are landing now. Works with any standard IdP — Okta, Entra, Google Workspace, JumpCloud.

A full US data plane — US receipt storage, US database, regional routing — is deployed and dark today. Opens with a gated rollout for US-resident workspaces.

The capture app is submitted and in review with Apple. TestFlight build is live today: snap, match, approve, Face ID unlock.

Flip the framework stub on: OAuth round-trip + token rotation + SOAP ProcessXmlString. One-click "Push to Twinfield" replaces manual XML upload.

Read the customer's chart of accounts so the export modal validates GL codes before submit instead of failing at the wire.

Hardened prompt + streaming with cancellation, per-tenant rate limits, and a transparent action log inside the chat.

SCIM keeps team membership and roles in sync from your IdP; step-up MFA enforced on privileged actions.

The engines shipped in July. This adds the controls: per-workspace retention windows and a legal-hold switch that suspends every deletion path while it's on.

Sister to the Twinfield work — promote the Exact Online exporter from stub to a real GeneralJournalEntries + Documents API push.

Trace a receipt from upload through OCR, matching, approval, export. Configurable sink (Tempo, Honeycomb, Datadog).

Extend the tenant-pool policy contract to background workers so every tenant query runs under the same enforcement as the API.

Same skeleton as the Exact/Twinfield work. Priority depends on which non-NL geographies pull hardest.

Bring-your-own-key for receipt + secret blobs. Customers rotate, revoke, or freeze data from their own AWS account. Schema groundwork exists; the key-per-tenant crypto path is the research.

Receipt capture, push notifications for approvals, offline-tolerant queueing — the Android counterpart to the iOS app. Web capture covers Android today.

TrueLayer integration is already scaffolded — research is what happens when the card-statement and bank-feed views start to overlap.