Release Notes

Launch readiness and trust surface

• Published app-specific Privacy Policy and Terms of Service.
• Added public status, documentation, release-notes, and data-request references for SOC2 evidence collection.
• Recorded SOC2 control mapping for RBAC, tenant isolation, MFA, audit logging, sensitive access, and encryption posture.
• Verified cookie consent behavior and removed the testing banner after hosted checks passed.

Modern Treasury sandbox pipeline

Modern Treasury sandbox flows were completed for counterparty sync, employer funding, employee disbursement, webhook status updates, reconciliation, returns, ledgers, statutory-remittance tracking, and post-run reporting. Live money movement remains disabled until contract, KYB, credentials, approval rules, and go-live smoke checks are complete.

Privileged access and audit controls

MFA is required for admin, platform admin, and platform support roles. Sensitive tables use secure read flows and role checks. Activity logs, step-up events, sensitive-field access logs, and litigation-hold records support auditability.