What's shipped — and what's coming.

Enterprise SSO — OIDC & SAML

Connect Okta, Azure AD, Google Workspace, or any SAML 2.0 IdP. Domain enforcement locks your team to SSO login. JIT user provisioning on first sign-in. Full config UI under Settings → SSO.

Continuous Monitoring + GitHub Connector

Install the Evolve Edge GitHub App to automatically scan repos for AI library usage (OpenAI, Anthropic, LangChain, 12+ providers). Automated checks run every 6 hours: assessment cadence, open findings staleness, evidence expiry, and GitHub AI scan.

Admin Impersonation (Login-As)

Super admins can log in as any customer org to debug issues. Full audit trail on every start and end. Billing actions blocked during impersonation. 60-minute auto-expiry with red banner.

Role-Based UI Feature Gating

Dashboard actions enforce org roles end-to-end. VIEWER cannot create assessments or update findings. MEMBER and above get full access. OWNER and ADMIN manage team and billing.

Onboarding Checklist

New users see a 7-step first-run checklist: run first assessment, invite team, upload evidence, view report, activate monitoring, connect GitHub, configure SSO. Progress bar auto-hides on completion.

Weekly AI Governance Posture Digest

Every Monday, paid org owners receive an automated email with their posture score, open findings count, findings resolved that week, and next assessment recommendation.

Public Product Tour (/demo)

New public product tour page covering frameworks, features, how-it-works, pricing, and trust signals. Linked from marketing nav. Includes direct CTA to book a demo or start free.

Finding Remediation Workflow

Assign findings to team members, set due dates, track status (Open / In Remediation / Resolved / Accepted Risk / Won't Fix), add remediation notes, and generate management responses.

Shared Report Links

Generate a password-protected shareable link for any report. Third parties can verify blockchain integrity without logging in. Links can be rotated or disabled at any time.

Bulk Evidence Upload

Upload up to 20 files (50MB total) at once from the evidence dashboard. Per-file progress indicators and status badges. Evidence expiry tracking with EXPIRED and Expiring Soon alerts.

Self-Serve Subscription Cancellation

Customers can cancel their subscription directly from Settings. Two-step confirmation with clear end-of-period messaging. Audit-logged. No support ticket required.

Rate limiting across all 72 API routes

Every customer-facing and admin route now has appropriate rate limits. Sign-in: 5/min. SSO callbacks: 10/min. Data APIs: 20-30/min. GitHub webhook: 100/min.

Admin Monitoring Dashboard

New /admin/monitoring page shows GitHub installations, SSO configurations, and monitoring check health across all orgs. Failing checks surface as alerts at the top.

NIST AI RMF 1.0 framework coverage

Full GOVERN / MAP / MEASURE / MANAGE function coverage with 23 controls. AI workflow now maps findings to specific NIST AI RMF control codes. Onboarding selector and framework catalog updated.

ISO 42001:2023 AI Management System

ISO 42001 added as a full framework with 7 clauses and 20 controls. International AI governance certification pathway now available. Appears in onboarding, AI analysis, and report compliance mapping.

NIST SP 800-171 Rev 3 for federal contractors

CUI protection framework with 6 control families — Access Control, Audit, Configuration, Identification, Risk Assessment, System Integrity. Unlocks the federal contractor and DoD supply chain segment.

Governance Maturity Score in every report

Reports now include a circular maturity score badge (0–100), level label (Initial → Optimizing), gradient progress bar, and per-finding maturity drivers.

AI Systems Inventory section

Every report now includes a structured AI inventory section listing the tools, platforms, and frameworks the organization uses, tagged by industry and org size.

EU AI Act countdown on dashboard

Dashboard banner shows dynamically calculated days remaining until EU AI Act enforcement deadlines (Annex III: August 2, 2027; Annex I: August 2, 2028), color-coded green → amber → red as deadlines approach.

Evidence Basis and Notable Strengths in reports

Each finding now lists the specific evidence items supporting it. Reports also surface a Notable Strengths section (green checkmarks) to balance risk findings with positive signals.

Management Response placeholder

Every report includes a dashed-border Management Response section with a 14-business-day response window — matches enterprise and board audit expectations.

AI framework mapper now covers all 9 frameworks

The AI workflow framework-mapper node now explicitly evaluates NIST AI RMF, ISO 42001, NIST 800-171, EU AI Act, SOC 2, HIPAA, GDPR, NIST CSF, and PCI DSS — with exact catalog codes, not just names.

Board Brief route

One-page printable board packet at /api/reports/{id}/board-brief — maturity score, top 3 risks, peer benchmark, and immediate actions formatted for trustee or board presentation.

Peer Industry Benchmark

Every report now shows how your organization compares to the industry median (61/100) with percentile ranking and interpretation.

Governance Domain Heatmap

Dashboard now visualizes risk coverage across all governance domains — color-coded green/amber/red so compliance leaders see gaps at a glance.

Assurance Letter in every report

Every exported report opens with a formal Attestation & Assurance section including date, organization name, patent pending notice, and Evolve Edge advisory signature.

AI Governance Maturity Score

0–100 governance maturity score across 5 weighted components: governance structure, data governance, vendor risk, control readiness, and evidence readiness. Five maturity levels: Initial → Optimized.

Critical severity finding tier

Added Critical above High in the finding severity model — for findings with immediate regulatory or operational consequences.

Scope & Methodology section in reports

Every report now includes a formal Scope and Methodology section describing the assessment approach, frameworks evaluated, and pipeline architecture.

Print-ready report export

Report HTML exports now include full @media print CSS — letter portrait layout, page break controls, clean typography for browser Print → Save as PDF.

Quarterly reassessment reminder

Dashboard shows an amber banner when the last report is more than 75 days old — prompting Scale plan customers to start their next assessment cycle.

Remediation owner badges

Roadmap items now show color-coded priority, owner role, and effort level badges for scannable at-a-glance triage.

Welcome email on signup

New accounts now receive a welcome email immediately after account creation with dashboard link and next-step guidance.

Shadow AI as first-class governance concept

Shadow AI is now tracked as a named intake concern, risk flag, AI analysis dimension, and finding tag throughout the platform.

AES-256-GCM field encryption

Sensitive intake fields are now encrypted at rest using AES-256-GCM field-level encryption with FIELD_ENCRYPTION_KEY.

Vendor risk register (TrustLedger AI)

Scale plan customers can maintain a living registry of every AI tool and vendor — scored, governed, and auditable.

EU AI Act compliance module

Tracks Article 9–14 gap posture with live August 2026 deadline countdown. High-risk AI classification built in.

Provisional patent filed

U.S. Patent Application No. 64/057,822 filed May 5, 2026. Six-node LangGraph AI scoring pipeline is Patent Pending.

Full security audit — all 33 API routes protected

Comprehensive security audit completed. All routes enforce authentication and organization scoping. Audit log export, typed audit events, and vendor register all deployed.

Anthropic Claude provider abstraction

AI provider abstraction layer allows switching between OpenAI and Anthropic Claude via AI_PROVIDER env var with no code changes.

LangGraph 6-node AI scoring pipeline

End-to-end LangGraph pipeline: intake normalization → risk analysis → compliance mapping → finding generation → roadmap synthesis → report writeback. Confirmed working in production.

n8n AI dispatch workflow

Production n8n workflow for AI analysis dispatch confirmed end-to-end with full report writeback.

Management response workflow

Management must formally respond to every finding before a report enters review — consistent with professional audit practice.

Audit trail export (CSV/JSON)

Customer-facing audit trail export for every report. PII masked. Satisfies customer right-to-inspect in compliance engagements.

Blog system — 3 SEO posts live

Blog launched with initial posts targeting law firm, fintech, and healthtech compliance buyer keywords.

Google Search Console verified — sitemap submitted

16-page sitemap submitted. Google Search Console ownership verified.