Development in August 2026
189 entries
- Regular
phase-3b.178.238The history of an appointment – who did what, and when
Every appointment now keeps a history. It shows what has happened on that appointment – when the time was moved, when the invitations went out, who took over responsibility, who joined the audit team and who accepted or declined. In the Business Hub you will find it as its own tab on the appointment page.
Entries are only ever appended. For as long as your account exists there is no way to change them or delete them individually – not even for us. A record that can be tidied up after the fact is not a record.
ℹ The history goes with the account. If you delete your account, it is removed along with your appointments – a record without the events it records is no longer one.
🚨 A confirmation that someone entered by hand is shown as exactly that – with name and time. Entered is not the same as given, and in a dispute that difference is the whole point.
Your participants see a history too, on their own appointment page: the steps that concern them. What was agreed internally – whom you offered responsibility to, whom you asked onto the team – stays with you.
- Regular
phase-3b.178.236Handing over responsibility for an appointment – to any team member
You can now hand over responsibility for an appointment to any member of your audit team. Until now that person also had to be an owner or manager in your account; anyone with read-only rights was out of the question as a successor, even if they were already looking after the appointment.
Whoever is responsible for an appointment may also edit it. That one appointment, precisely: read-only rights everywhere else in the account stay as they were. Responsibility only comes about when both sides agree – you offer, the other person accepts.
ℹ Within your account. The person must still belong to your account; handing over to a team member from another company is something we are preparing separately.
- Regular
phase-3b.178.235Handing over responsibility for an appointment – with the successor’s consent
Whoever is responsible for an appointment can now hand that responsibility on. Until now it stayed for good with the person who created the appointment; in case of illness, holidays or a change in the team, the only option was to cancel and create it anew.
You offer the responsibility to someone on the audit team who has accepted the invitation to that appointment. The other person sees the question and decides: take it on, or decline.
🚨 The handover only takes effect once they agree. Until then the appointment stays with you – and you can withdraw your offer at any time or address it to someone else. An offer is a question, not a done deal.
ℹ Everything is recorded: who offered what to whom and when, and whether it was withdrawn, accepted or declined. Handing over responsibility remains possible for a cancelled appointment too – its history stays available, and a cancelled appointment still needs someone to be responsible for it.
- Regular
phase-3b.178.234My appointments – no account with the client required
If you work as an auditor for several clients, you now see your appointments in one place. Until now you had to be listed as a user of the organisation that invited you – and that showed you their entire planning. That is more than taking part in a single audit requires, and for many it was not wanted at all.
There is now a “My appointments” area. It shows every appointment you have been invited to, across all your clients – with title, client and period, each in its own time zone.
🚨 An invitation does not yet open anything. It appears to you as a question, with two buttons: accept or decline. You will see the planning for that appointment once you have accepted. And declining is not a “never again” – a new invitation remains possible.
ℹ For planners, inviting changes: you can now invite any person who has an account into an audit team, including someone from another company. Your own users are part of the team immediately, as before.
- Improvement
phase-3b.178.233Tidying up the engine room
We have reorganised part of our program. The place that checks who is signed in and what they may see used to sit in the middle of account management. It now stands on its own — which makes it easier to verify and prevents an entanglement that can cause outages when things change.
ℹ You will not notice any of it: no new screen, no changed procedure, no effect on your account or your appointments. We record rebuilds like this here because they are part of our work.
- Improvement
phase-3b.178.232One more check on our own tooling
We have added a check that runs before every release. It is not aimed at anything you see, but at our own notes inside the program text: every explanation must sit next to the thing it explains. Twelve places where that was no longer true came to light and have been put right.
ℹ Nothing changes for your account, your appointments or your data. We record work like this here so the history stays complete.
- Improvement
phase-3b.177.231The appointment page now has three tabs
Appointment planning, participant planning, settings – instead of one long column with everything below one another. The confirmation status sits above the tabs, because it concerns the whole appointment and applies in every view.
Your input survives a tab change. If you are typing a person and switch tabs, the text is still there when you come back.
And on the right there is now the status instead of a prompt. Until now it said “request the participant list below” – even when you had long since done so. Now it tells you when it was requested and how many people are entered, with those people below. From four entries on you can sort them by name or role. The field for entering someone by hand is still there, behind a button.
- Improvement
phase-3b.175.230An explanation of what a track is for
Next to the notice that no track has been assigned to a section, there is now a question mark. One click explains what a track carries: the people and the minutes per standard.
And it removes the worry that something is missing. A section without a track still counts with its full duration as audit time – unless it is marked as “not audit time”. You only need a track once you want to record who sits there, or which standard the minutes go to. You only need a second track when two sessions run in parallel within the same section; the time is then counted per session, so four hours with two tracks yield eight audit hours.
The notice itself now says so too: That is fine – the section still counts. Until now, a statement of fact read like a request.
- Security
phase-3b.175.229Mail log: addresses go after 90 days, the line after a year
For every mail we send on your behalf, one log line is created – recipient, purpose, delivery route and delivery state. It is the only way to tell whether an invitation arrived, or why it did not. From now on these lines have a retention period, and it is actually carried out.
After 90 days the recipient address and the bounce reason are removed; the line remains without any reference to a person. After one year it is deleted entirely. The period is counted from the end of the appointment the message belongs to – an invitation sent months in advance therefore remains traceable until the appointment. If there is no such appointment, or it has been deleted, the time of sending counts.
You can see this in your appointment's delivery overview. Where the address has gone, it says so explicitly instead of leaving an empty line: the delivery state stays, the recipient is removed. The periods are set out in the privacy policy.
- Improvement
phase-3b.175.228Standard hours: the notice now comes before the click
If a session still has time booked on a standard that is no longer on the appointment, the form now tells you right away – with the number of minutes affected. Until now you could save and only then received a refusal.
And you can get out of it again. Next to the notice there is a button that discards the orphaned bookings and saves the rest. It is needed because a newly added standard is a new entry and does not bring the old booking back – without it, this session's standard hours would stay unchangeable.
Nothing is discarded unless you say so. The booked time should not quietly disappear just because the form has no field for it – a decision you make is not the same as one the form makes for you.
- Regular
phase-3b.175.227A hint instead of a refusal when someone is booked elsewhere
If you assign someone who is booked with another client at that time, our service points it out – and lets you carry on. Until now the assignment was refused. That was too strict: you often know more than we do. An appointment ends earlier than planned, someone attends only in the morning, two locations are ten minutes apart.
**All you see is that someone is taken – never what with.** Which client, which appointment, which session: none of that reaches you, and the other side learns nothing about you either. Within your own account a double assignment is still refused – there you know the other session and can move it.
- Regular
phase-3b.175.226My availability: when you are booked and when you are not
You can now see in one place when you are booked across all your clients – and when you are not. The Business Hub has a new area for this: Availability. You choose a period, and below it you see what is taken and what stays free.
Every booking says what it is about. The client, the location including the room, and the standards being audited with their audit type. Because the question is rarely just “do you have time on the 14th”: someone finishing in Berlin the evening before does not start at eight the next morning in Zurich. Each row is shown in the time zone of its appointment, so you read the times that are in your own documents.
🚨 And you can enter what we cannot know. Holidays, public holidays and assignments you handle outside this platform go in as an absence; they then count as taken. These entries belong to you and to none of your clients – nobody else sees them.
ℹ What you see is exactly what the planning works with. There is no second list beside it that could say something different.
- Regular
phase-3b.175.225Blocked periods: times when nothing gets scheduled
You can now block periods in which no appointments take place at your organisation. Company holidays, a move, a stocktaking week – the Business Hub has a new area for this: Blocked periods. You enter a start and an end plus a short note of at most 80 characters, and that is it.
The note is for you alone. It appears in this list and never goes out in an e-mail – nobody but you learns why you blocked a week.
🚨 A blocked period is a bar, not a hint. No appointment can be created in it and none can be moved into it; the attempt is refused, quoting your own note. If you do want to schedule there, change or delete the block – the way to do so is right next to it.
ℹ Appointments already inside the period stay in place. We list them for you as soon as you set the block, but we cancel nothing on our own: a cancellation has consequences all the way into the mail to your participants, and that is your decision. The end is no longer part of the block – a block until Monday 00:00 releases Monday again.
- Regular
phase-3b.175.224Import appointments from a CSV file
You can now read your appointments in as a file instead of entering them one by one. The Business Hub has a new Import area: you choose a CSV file, we check it, and a preview shows you what would come of it – only then are the appointments created.
One row per appointment and participant. If three people attend an appointment, the file holds three rows with the same appointment reference; we combine them into one appointment. Five entries are required: appointment reference, title, date, and the participant's name and e-mail address. Everything else – time, time zone, place, language – is optional.
ℹ We read the file the way Excel writes it. We detect semicolon and comma as separators; quotation marks, line breaks inside a cell and the quirks of the Swiss Excel export are handled silently. Columns we do not know are skipped, and we tell you which.
No mail goes out. Imported appointments are drafts – invitations are sent only when you explicitly send an appointment. An import that triggered invitations because a column had slipped could not be taken back.
Whatever is wrong, we name with row and column. While one objection is open, nothing at all is imported: a half-read set is harder to put right than one that was never read.
ℹ And you can safely read the same file a second time. Appointments already created from it are recognised and skipped – they are not created twice and not overwritten.
- Regular
phase-3b.175.223Address book: enter participants once, invite them again and again
You no longer have to retype your contacts for every appointment. The Business Hub now has an address book: anyone who regularly attends your appointments is listed there once with name, company, role and language – and can be added to an appointment by picking them from a list.
You can filter by name, company and mail domain. The domain is the most useful of the three: in an audit almost everyone involved comes from a single organisation, and
@client.comfinds them all at once. You may also paste a full address into that field – we then take its organisation.The address book belongs to your organisation, not to your account. Your colleagues see the same entries, and when a team member leaves, the list you have maintained stays.
ℹ Two things an entry explicitly is not. It is not a link: when you add someone to an appointment, a copy is created there – if you change the entry later, the appointment you already sent stays as it was. And it is not a consent: anyone new in your address book receives the same request as everyone else before the first invitation. You see the state of that request next to each entry.
Also new: you can now add participants directly from the Business Hub at all – until now that was only possible through the entry link you sent to your business partner. Both now sit side by side.
And anyone not yet in the address book can still be entered by hand with address and name. You do not have to create an entry for that.
- Improvement
phase-3b.175.222Tidying up our operating documentation
We have worked on our internal operating documentation. What it describes concerns the setup of our own servers – not the software you use.
Nothing changes for your account, your appointments or your data, and the application behaves exactly as before. The only change is the version number under which we record this state.
ℹ We note such work here without going into detail, so that the history has no gaps.
- Regular
phase-3b.175.221What happens if an invoice remains unpaid
If an invoice remains unpaid after its due date, your account may be restricted. Since this concerns your account, here is how we go about it.
Nothing happens without notice. Before any restriction, at least one reminder goes to the account owner's address, and it names the day from which the restriction applies. If the restriction does take effect, we tell you that by e-mail too – and we say exactly what is affected.
Your data remains fully intact. A restriction because of an unpaid invoice deletes nothing. Once we have received your payment, we lift it again.
ℹ This concerns paid accounts with an overdue invoice only. If you have paid, or you are on the free plan, you will not notice any of it.
- Improvement
phase-3b.175.220More work on our administration tools
A settings page has been added to our internal administration console. It brings together rules that we could previously only change by rolling out a new version of the software – from now on we can see in one place what currently applies.
Nothing changes for your account, your appointments or your data.
ℹ We note work on our own tools here without going into detail, so that the history has no gaps.
- Improvement
phase-3b.175.219A sharper view of our own operations
Three overviews have been added to our internal administration console. They bring together what previously sat in three separate places and make it quicker for us to see whether everything is running smoothly – for instance when someone asks why an e-mail did not arrive.
No new data is created in the process: what is shown is only what is already being recorded, with the same retention periods as before. Nothing changes for your account, your appointments or your data.
ℹ We note work on our own tools here without going into detail, so that the history has no gaps.
- Regular
phase-3b.175.218We can now see whether our site is visited – and we say exactly how
Our public site now keeps a visit log, and because that touches your data, it belongs here and not only in the privacy policy. Recorded are the time, the path requested without its query string (everything after
?is discarded), your truncated IP address – the last field is replaced byxxx– and, where available, the name of your connection.What we deliberately do not do: we still set no cookies and create no identifier meant to tie a person's visits together. That does not rule out attribution entirely – the same truncated address can appear in several entries – but we do nothing to establish it. The full address is needed only to determine the connection name and is discarded within minutes. After 90 days the entry is deleted automatically – not truncated further, but removed.
The purpose is simple: to see whether and from where our site is being visited. The full wording is in our privacy policy, linked in the footer of every page.
- Improvement
phase-3b.175.217A new overview page for our administration
An overview page has been added to our internal administration console. It shows us at a glance how many appointments and how many invited people the platform holds in total, and how many emails have gone out on the current day. Every figure carries the time it was last determined – a figure without a time claims to be valid right now.
Your account, your appointments and your data are untouched by this. It simply becomes quicker for us to see whether everything is running smoothly.
ℹ Work on our own tools appears here without detail, so the log stays complete.
- Improvement
phase-3b.175.216A release day spent on the foundations
We have added a follow-up check to our release process – one that says right after every update whether all parts of the platform really are running on the new state. It is meant for us and is not accessible to you.
Nothing changes for your account, your appointments or your data. What changes is the time we need to notice an incomplete update.
ℹ Days like this appear here without technical detail, so the log stays complete.
- Regular
phase-3b.175.215Your own sender address now appears on the price overview
The price overview now states for every plan whether you can use your own email address for sending. Until now the feature appeared nowhere on the public site – you only found out inside the portal.
The entry is on all four cards, not only on the one that includes it: anyone comparing plans wants to see where something is missing, not only where it is present.
ℹ A separate section explains what belongs to it – setup with a confirmation code, your sender name and your footer, and what happens if your server fails once. Account and security mails to you personally always keep going through us.
- Regular
phase-3b.175.214If your mail server fails, we take over – and tell you
If your own mail server is unreachable, temporarily rejects our connection, or rejects our authentication, we switch off sending through it and send the message through our service. You receive an email about it, and a notice appears in the portal the next time you sign in.
Your message is not lost: it goes out as you submitted it – only the sender address is a different one until further notice.
🚨 A rejected recipient switches nothing off. If your server replies that a particular address does not exist, that concerns that one participant. A typo in an address must not take your whole mail route away.
ℹ Switching it back on works with a new confirmation code. We send it through your server – that test message is at the same time the proof that it works again.
- Regular
phase-3b.175.213Your appointment emails now really go via your server
If you have set up your own mailbox, your appointment emails now go out through it. Invitations, reminders, changes and cancellations leave from your sender address via your mail server – until now only the test email during setup did.
Mail to you personally still goes through our service, and that is deliberate: your sign-in code, and the notice if something is wrong with your mailbox. Were that notice to go via the disrupted route, the very message reporting the disruption would not arrive.
ℹ If your server fails, we do not quietly switch to ours. Your email carries your sender address; sending it from ours instead would be a different message from the one you handed over. You are told about it instead.
- Regular
phase-3b.175.212You can now set up your own mailbox for sending
On the largest plan, your appointment emails can go out from your own address via your own mail server. You will find the form in account settings: enter server name, user name, password and sender address – we send a test email to exactly that address, and the code in it switches sending on.
Sending the code to the sender address is deliberate. It establishes both things in one step: that your server sends, and that the address which will appear as the sender belongs to you.
ℹ Port and encryption cannot be configured – it is always 587 with STARTTLS. What you cannot choose, you cannot choose wrongly, and so nothing can go out unencrypted.
ℹ We never display your password again, not even shortened. You only see that one is set. You can also store your own footer text to appear below your emails – our own footer then no longer appears there, because it is your sender address.
- Regular
phase-3b.175.211A notice when an invoice is outstanding
If an invoice remains outstanding past its due date, a notice now appears at the top of the Business Hub. It names the date the invoice has been outstanding since, and the date by which we ask for settlement – seven days after the due date.
The notice can be dismissed, for the current sign-in. Anyone who has read it carries on working undisturbed; at the next sign-in it is back, as long as the invoice is outstanding. A notice you can switch off once would no longer be one the second time.
ℹ Only the account owner sees the outstanding amount. Everyone in the organisation learns that something is outstanding – the size of the claim belongs to the contract, and the owner is the one who entered into it.
- Regular
phase-3b.175.210Your sharing setting goes with your account
When an account is archived, we now also remove the setting for who may see your availability. It is tied to your email address rather than to the account, and so it used to stay behind once the account was gone.
This is more than tidiness. Your address becomes free again after archiving. Anyone who later signs up with the same address would otherwise have inherited your setting and shared their availability according to your wishes, without ever having seen a switch.
ℹ A global objection to mail does remain. It says „nothing from this platform at all“, and that is meant to hold even once the account is gone.
- Improvement
phase-3b.175.209Development behind the scenes
We worked on the management console we run our operation with. It is not accessible to you and has no effect on your account, your appointments or your data.
ℹ We record such days here without details, so the history stays complete.
- Improvement
phase-3b.175.208Work on the walls between accounts
We strengthened the safeguard that keeps one account's data available to that account only. Nothing changes for you – this is a protection below the surface that already applied and is now enforced in further places rather than assumed.
ℹ We list such work here without details, so the history stays complete.
- Regular
phase-3b.175.207We keep your invoices no longer than we must
We keep invoices for ten years – and then we delete them. The period is set by law and runs from the end of the business year in which an invoice was created. Anything beyond that is no longer a requirement, only a stockpile – and we do not keep one.
This applies even long after you have left. Invoices outlive the deletion of an account, because we have to be able to produce them. That is exactly why the other direction was needed: otherwise your name would still be sitting with us decades later, with no reason for it.
ℹ There is nothing for you to do. The deletion runs by itself, day after day.
- Improvement
phase-3b.175.206Work under the hood
We carried on building our internal workings – in places you never see and never have to operate. Nothing changes for your account, your appointments or your data.
ℹ We list such days here without details, so the history has no gaps and you can see when work was done.
- Regular
phase-3b.175.204Your country is now part of setting up an account
When you set up an account, you now select your country. That single detail decides more than it might seem: the currency of your invoice, which of our companies issues it, and how tax is shown on it. Without it, an invoice could not be written, only guessed at – and we would rather not put that on you.
The list shows the flag, the country code and the name – for example 🇩🇪 DE – Germany. If you know the code, just type it; if you are looking for the name, you will find it.
Your country's dialling code now sits right next to the phone number field. So you can see at a glance which code your number is filed under.
ℹ And you may write your phone number however you like. With brackets, slashes, dashes or with the country code in front – we bring it into one consistent format. Your number stays the same, no matter how you type it.
ℹ Nothing changes for existing accounts. The detail is required when setting up, not retrospectively.
- Regular
phase-3b.175.202Your term starts with your plan and ends on the confirmed cancellation date
Until now, a plan’s term was calculated from the day the account was created. That is not the same day a plan begins: if you create an account in March, try the free plan and subscribe in April, your year started in April, not in March.
From now on, the term starts with the plan. Your overview therefore shows the date that actually applies – and the 30-day notice period refers to it.
ℹ Nothing changes for existing accounts. They keep the term they have been shown so far. What was once promised is not recalculated after the fact.
And a cancellation now takes effect on its own. Until now your plan only ended on the agreed day if we switched it over. That now happens automatically: your plan runs through the day stated in your cancellation confirmation, and is switched over on the following day.
ℹ This does not change moving up to a larger plan: it starts a new term, with no credit for the current one. If you move to the free plan instead, your appointment allowance continues in its usual rhythm – it does not jump back.
- Regular
phase-3b.175.201Prices include VAT
The pricing page previously stated that the amounts were net, excluding VAT. That was not how we invoice.
Correct is: the amounts shown include VAT. You pay exactly the figure on the card – 99 CHF is 99 CHF, not 99 plus something.
ℹ The reason is the round figure. An amount you first have to do arithmetic on is not a statement but a task when comparing two offers.
ℹ The page now also states explicitly that our offering is aimed exclusively at business customers. That belongs with the price: a gross figure says something different to a company than to a private individual.
ℹ Nothing changes about the currency: CHF for Switzerland and Liechtenstein; for recipients of services in the EU, invoicing is in EUR at a 1:1 rate.
- Regular
phase-3b.175.200Drag people onto a track
Until now auditors and visitors could only be assigned using buttons. On a day with many sections that meant: find the person, find the right section, click – over and over for every assignment.
From now on you can drag a person from the audit team straight onto a track. The list is on the right and stays visible while you plan in the middle; the track you are over is highlighted.
ℹ Visitors can be dragged too – same gesture, same check.
ℹ The buttons remain. Anyone working with a keyboard or a screen reader still assigns exactly as before – dragging is an addition, not a replacement.
ℹ Anyone not available at that time is refused when dragged too, with the same reason as before: a blocked period, or another session at the same time.
- Regular
phase-3b.175.199Section planning gets a details column
Until now every section carried its full staffing underneath it. With twenty sections the plan was a very long list – and anyone wanting to check who was assigned to the first section had to scroll back up.
From now on the list of sections is on the left and everything about the selected section is on the right: times, state, staffing and standard hours. Clicking a row switches to it.
ℹ The state stays in the list. What a section is still missing remains visible at a glance, without clicking it.
ℹ A newly drawn section is selected right away – you can staff it immediately.
ℹ The page also loads faster, because only the selected section fetches its details. On narrow screens it stays a single column; the details then sit below the list and move into view when you select.
- Regular
phase-3b.175.198Distributing standard hours across sessions
The per-standard scale could not fill up. It showed the target hours and, below them, “still to be assigned in full” – correctly calculated, but there was nowhere to distribute those hours.
From now on every session carries its standard hours: “Change standard hours” below the track, one field per standard, and above them “3 hours of 4 hours assigned”. What you enter here fills the scale in the control bar on the right.
ℹ The hours belong to the session, not to the section. When two tracks run in parallel, each counts on its own – otherwise the doubled work would be counted only once.
ℹ An empty field here means: nothing is attributed to this standard. You cannot assign more than the session lasts; the button says so before you save.
ℹ Your chapter assignments are preserved, even when you only change the hours.
- Regular
phase-3b.175.197Seeing how full the plan is
How much time was already planned appeared nowhere. Anyone wanting to know whether an auditor still had room counted the sections by hand.
The control bar on the right now shows, for each person, “6 hours of 14 hours planned” – and their name moves slowly from green to red as it fills up. Green means time still free, red means fully planned; when planning, red is the goal and not a reproach.
The same per standard: “14 hours, of which 11 hours still to be assigned to auditors”. Standards and their target hours can now be added, changed and removed on the appointment itself.
ℹ The figure always stands beside the colour. Anyone who cannot reliably tell red from green reads the same information in the sentence.
ℹ Without promised time there is no scale – there the planned time stands without colour. A share needs a denominator.
ℹ Distributing the target hours across individual sessions comes next. Until then the standard scale shows the full target as still open.
- Regular
phase-3b.173.196Pre-assigning the lead auditor – if you say so
Anyone running an audit alone had to enter themselves into every section. One click per section, always the same name.
From now on the form asks when you add a section: “Pre-assign …” – but only when exactly one person is on the audit team, and with their e-mail address in the text. The box is not ticked in advance: it is a question, not a default.
ℹ If a second person joins the team in the meantime, the question disappears by itself – and the tick does not quietly go along with it.
- Regular
phase-3b.172.195A time axis above the schedule
Until now the timeline of an appointment only showed how the sections lie relative to each other. Whether a bar started at ten or at half past eleven had to be estimated from its width or looked up in the list below.
From now on there is a time axis above the bar with the clock times – as dense as the width allows, and in the appointment's time zone. For an appointment spanning several days it names the days instead of the hours.
ℹ And one word has been corrected: whoever leads an audit is now listed in the audit team as lead auditor rather than „Lead“ – a role, not a department.
🚨 Fixed: someone newly added to the audit team could not be assigned in the section next to it. A section read its staffing once when opened and never learned about a new arrival. Anyone who entered a lead auditor and wanted to assign them straight away still read that nobody was on the team – only reloading the page helped. The section now notices the change at once.
ℹ And the switch for collected schedule changes now says where it stands. It used to read just „On“, which can be taken as a state or as an instruction. Now a slider sits on the left or the right, with „Switched on“ or „Switched off“ beside it.
- Regular
phase-3b.169.194Sections now show what they are missing
Until now every section of an appointment looked the same. Whether a section was fully planned or still lacked its track, its auditor and every confirmation – the timeline painted both in the same colour, and that colour was green.
From now on each section says where it stands: no track yet, no auditor, ready to send, awaiting confirmation, change requested, confirmed or cancelled.
ℹ Not by colour alone. Each state has its own sign in the bar and its own word in the line below – anyone who cannot reliably tell red from green reads the same information in text.
- Regular
phase-3b.168.193Your planning now uses the whole screen
Until now everything sat in one narrow column – limits, calendar, people, notifications, delivery. On a large screen the space left and right went unused, and anyone working on the schedule had the related details far above or far below.
From now on planning has three areas: the menu on the left as before, the planning in the middle across the full width – and a new bar on the right for everything that changes: your plan limits, the people of the appointment and the notification settings. They stay in view while you work in the middle.
ℹ The bar slides in and out, just like the menu on the left, and remembers your choice for next time. On a phone or in a narrow window it lays itself over the content instead of squeezing it.
- Regular
phase-3b.167.192Invite co-users – and see who belongs to an appointment
Anyone who wanted to add a colleague to an appointment's audit team could not. Only a co-user of the organisation can join an audit team – and there was no screen for co-users. The function existed; the way to it did not.
The menu on the left now has an Organisation area: view members, invite someone, change roles, remove someone, withdraw an open invitation. Anyone who is not an owner sees the list but no buttons – and reads why.
The appointment itself now shows who is involved. Above the schedule: the audit team on your side, the attendees and their companions on the customer side. Adding and removing happen in the same place. Until now these people appeared only in the selection list of a single section – and even there only if someone was free for exactly that time.
ℹ Three smaller things. The menu on the left now stays put when you scroll the content – until now it scrolled out of view with it. And in your account settings, the “Who can see that you are booked” setting can now really be adjusted per organisation; that list used to stay empty. The plan details above your schedule are now a single narrow line of figures; the setting itself is in your account settings, next to cancellation. And “not counted” has become “No audit time”.
- Regular
phase-3b.165.191An error that was not one – now in the account settings too
Anyone who opened the account settings without ever having changed their e-mail address saw a red error message there. It was unfounded: the section asked about a running address change, there was none – and read that perfectly normal answer as a fault.
It is the same error we fixed on the participant list this morning. Nobody reported it here; it came to light during a systematic review.
🚨 This time it is not the spot that has been fixed, but the cause. At both affected places our services now answer “there is nothing on this yet” with a proper answer instead of none at all. The confusion is therefore not caught there, but removed.
ℹ An automatic check watches over it. It runs with every change and raises the alarm if a service were to start expressing “nothing” with an empty answer again.
- Regular
phase-3b.164.190What the client should enter – and how you ask them
After saving the responsible person on the client side, a red error appeared – even though it had been saved. The cause was not the saving but the re-reading afterwards: it failed, and its error took the place of the success message.
The two are now separate. A saved contact is reported as saved, and a problem with the re-reading stands beside it – with a retry button instead of a line saying “One moment …” that never ends.
🚨 This also brings back the button you use to ask the client. It hung on the same display and therefore stayed away; the note above it now states explicitly in which order the two steps go.
⚠ And when no one is in the audit team for an appointment yet, we say so. Until now every section read “Nobody from the audit team is free at this time” – even when the audit team was empty. That sent you looking for a scheduling clash that did not exist.
- Regular
phase-3b.164.190Two rough edges in appointment planning
Opening a newly created appointment showed a red error before you had entered anything. It was unfounded: the section for the customer's participant list asked for a status that does not yet exist on a new appointment – and read the empty answer as a fault.
And the time fields when dividing an appointment started at today rather than at the appointment. Anyone planning an audit for next month had to page through the calendar to where they already were.
Both are fixed: a new appointment no longer shows a fault, and the fields start on the appointment's first day – in its time zone, not yours.
- Regular
phase-3b.163.190Calendar days can now be clicked anywhere in the box
When scheduling an appointment, the whole day box now responds, not just the small number inside it. Until now only the day number in the top left was a target – a few pixels in a tile that looks far bigger.
The hint above the calendar says to click days in the calendar. If you read that, you click the day, and now that works: in the month and week views, with the mouse pointer showing it.
ℹ Clicking an appointment still opens the appointment and does not select the day. Keyboard operation is unchanged.
- Regular
phase-3b.161.189When a message never went out at all, you can now see it
The delivery status on your appointment now covers a new case: „never sent“. Until now it told you what happened to a message once we had handed it over – delivered, rejected, blocked. Anything that never got that far appeared nowhere at all.
That is the most awkward gap such a list can have: a missing entry looked like „nothing has happened yet“ when it actually meant „this never left our system“.
🚨 This is the one entry where the fault is ours rather than the recipient's. It is marked as such, and the reason is shown underneath it. If you see it, please do not change the address – get in touch with us instead.
- Regular
phase-3b.157.188Appointments and sessions can be cancelled
You can now cancel an appointment – and individual sessions within it. Until now an appointment could be created, sent and changed, but not withdrawn.
Cancelling notifies everyone invited, voids the confirmations already given, and cancels the appointment's sessions along with it. The appointment stays visible in your overview so the history does not disappear.
🚨 We ask first, and the prompt names all four consequences. A cancellation cannot be undone – there is no way to reopen a cancelled appointment.
ℹ A single session can be cancelled as long as the appointment has not been sent. After that your participants hold an invitation containing exactly that session; the change path with notification exists for this.
ℹ After the cancellation the appointment closes. Change requests, the sending rhythm, access rules, the request for the participant list from your customer and the sending of plan changes disappear from the view – they would have no subject left. What only reports stays: you still see who held an access link and what was delivered.
- Correction
phase-3b.157.187A way back when the confirmation email did not arrive
If you have registered and the confirmation email did not arrive, you can now have a new one sent to yourself. Until now there was no button for it – anyone in that situation could neither get in nor move on, because without a confirmed address "forgot password" does not help either.
The way is available in three places: below the sign-in screen, on the confirmation page when a link has expired, and at its own address
/bestaetigung-erneut.🚨 We also ask for the password twice during registration now. A typo was particularly costly there: the address was taken afterwards, and signing in with the intended password failed. We check the length and the match before the form goes out.
- Regular
phase-3b.157.187People removed from an appointment now find out
When you remove a participant from an appointment, they now receive a message about it. Until now this happened silently: the person was left with an appointment in their calendar that no longer existed for them, and with an access link that turned them away without explanation.
The message names the appointment, says that their attendance is no longer planned, and refers them to you if it was a mistake – we cannot change it from our side.
🚨 It deliberately no longer contains any access. Someone removed from the appointment can no longer reach the plan – the message about it must not hand that back.
ℹ Two cases stay silent: anyone who never received an invitation still learns nothing about the appointment. And for an appointment that was already cancelled, the cancellation stands.
- Improvement
phase-3b.157.186Accompanying persons receive their own message
Anyone attending an appointment as an accompanying person is not asked to accept or decline – now the emails say so too. Until now, the invitation to an accompanying person carried the same request for confirmation as everyone else's, and the link inside then turned them away.
🚨 The invitation and the change notice now have their own version. It names the role, leaves out the request for an answer and leads to the same page with that person's own sessions.
ℹ Nothing changes in the remaining messages – a cancellation asks for nothing anyway, and the reminder about a missing confirmation never reached an accompanying person.
- Regular
phase-3b.157.184When your part of the schedule changes, we tell you
Until now we only reported changes to the appointment as a whole. If the planner moved a single session you take part in, you heard nothing – your schedule had changed, your inbox stayed quiet.
🚨 That is different now. When something changes in one of your sessions that you can see – title, time, place, time segments or the shared information – you get a message with a link to your current schedule.
ℹ One message, not several. If several of your sessions are affected, we combine them. And the planner's internal notes trigger nothing: what you cannot see, we do not report.
- Improvement
phase-3b.157.182Clearer information in the internal management console
In our internal management console, several entries now state more precisely what they mean. Nothing changes for your account, your appointments or your data.
ℹ We list such work here without details – so that the history remains complete.
- Improvement
phase-3b.157.181Replies by mail arrive more reliably
When your participants reply by mail, our service reads those messages regularly. Until now, a single message that could not be removed from the mailbox after being read was able to halt the entire pass – everything behind it was left waiting.
The pass now continues. After several attempts the affected message is set aside so the mailbox does not fill up, and the log records which message it was.
ℹ The content was never at risk: by that point the message has already been stored – only the cleanup afterwards failed.
- Improvement
phase-3b.157.180Cancellations and changes are saved faster
When you cancel or change an appointment, the form no longer waits for all notifications to be sent. You save, the response comes back immediately – the emails to your participants go out in the background, within a minute.
With forty invitees this was noticeable: the form sat still while forty emails were queued one after another.
ℹ Your participants also receive less mail. If you change several details of the same appointment in quick succession – first the title, then the time – that now triggers one notification instead of two.
- Improvement
phase-3b.157.179Replies to our invitations are kept for one year
When you or your participants reply to one of our invitations, that reply reaches us and is matched to the appointment. From now on we keep such replies for 366 days, counted from the day we store them, and then delete them completely – without exception.
A year covers any audit cycle; anything older no longer answers a question that someone is still asking. The appointment itself, and the fact that a reply was given, are unaffected.
ℹ At the same time we moved the receipt of these replies to our own servers. Nothing changes for you – except that one fewer party gets to see your mail.
- Improvement
phase-3b.157.178Maintenance work on our internal tools
Work continued on our internal administration console. Nothing changes for your account, your appointments or your data.
ℹ We list such work here without details – so the history stays complete and you can see on which days work was done.
- Improvement
phase-3b.157.177You can now see inside your account whether everything is running
The foot of the menu now shows whether our areas are working without disruption – the same display that was previously only on our website.
It refreshes continuously while you work, and the state is written out as a word next to the colour, not only as a dot.
If the information is ever unavailable, we show nothing rather than a colour that is no longer true: a display that reports someone else's fault when it is itself disrupted would be worse than none.
- Improvement
phase-3b.157.176A clearer development history
This page now shows the twenty most recent entries – and below them a list of every month with its count.
Each month has its own address and can be opened, linked and read on its own. To look further back, pick the month instead of scrolling through one long page.
The entry page stays independent of the change of month: it always shows the twenty most recent entries, including on the first day of a month.
- Improvement
phase-3b.157.175Easier to read – in light and dark alike
We have reworked the colour scheme. In the dark appearance some text was hard to read; in the light one, individual panels barely stood out from the page background.
Both are fixed: panels now have a surface of their own and a clearly visible edge, and buttons carry their colour instead of just an outline. Every text colour was measured against its background again – they still meet the contrast requirement for body text.
We also continued work on the internal management console: the texts of this website can now be maintained there, without a new release having to be shipped for it.
- Improvement
phase-3b.157.173The menu now sits on the left
The areas, the sign-out and – where they exist – your account settings now sit on the left-hand edge instead of in the header. The menu can be collapsed when you need more room; your choice is kept on this device.
In the signed-in areas, at the very bottom, in small print, is the version that is currently running.
- Improvement
phase-3b.157.172Legal notice and privacy now on the sign-in page too
The sign-in page now carries the same header and footer as the rest of the site: a way back to the home page and the links to the legal notice, terms of use and privacy.
In addition, every interface now tells you which area you are working in – and anyone working for several organisations can switch organisation directly in the header.
- Improvement
phase-3b.157.171Clearer notices and messages
In your appointment area, confirmations, warnings and errors can now be told apart at a glance – in both appearances, light and dark.
ℹ Until now many messages carried fixed light colours. Anyone using dark mode saw dark text on a dark background there. That is fixed.
- Improvement
phase-3b.157.170A clearer account view in our internal administration
In our internal administration interface, the account view now shows how long an account has existed, how long it has belonged to an organisation, and when the last sign-in took place – even if that was a long time ago.
ℹ Nothing changes for you. We are noting it anyway: the faster our team can answer a question about your account, the shorter you wait for the answer.
- Improvement
phase-3b.157.169Better readability in our internal administration
We have reworked the colours of our internal administration screens: confirmations, notices and errors can now be told apart at a glance, and the controls stand out clearly against the background in both presentations, light and dark.
ℹ Nothing changes for you. We note it anyway: whoever sees faster what an operation is doing makes fewer mistakes with it.
- Correction
phase-3b.157.169A wrong time in the change log
An entry from 23 August carried a time that was two hours off the actual delivery. We only noticed once this page began to recalculate its own order.
ℹ It now does so with every delivery. Checked are the order, the presence in all four languages and the length of the entries – where the text is written, not only here.
- Improvement
phase-3b.157.168Accents, umlauts and line breaks in every email
Our emails go out in four languages, and three of them carry accents. An
éthat reaches the recipient as garbled characters is not a cosmetic flaw – it is a message no one trusts any more.We now check this automatically: every template, every language, at all four points an email passes through. That includes the line break, which in older systems tends to end up as a character sequence in the middle of the text.
Nothing changes in what you do. What changes is the certainty that your name arrives the way it is written.
- Correction
phase-3b.157.167Dependable sending and a tidier internal area
We have secured the path along which our emails come into being. A rule in the data model demanded a field that is deliberately left empty in one place – and thereby quietly blocked the release of our email texts.
Nothing changes in what you see. What changes is the certainty that a message really does go out.
We have also carried on working on the internal administration console: error messages now say what they know instead of showing a catch-all sentence, and a new check holds data stocks against their own counters.
- Improvement
phase-3b.157.166Signing in with a passkey – now set up here
Anyone who wants to sign in with a passkey can now create one themselves. A passkey is access without a password – by fingerprint, face or security key.
Nothing changes for your account unless you want it to: your password and second factor keep working exactly as before.
We have also improved the handling in several places – fields now sit where they are needed, and setting up the second factor offers a QR code to scan instead of a code to type out.
- Regular
phase-3b.157.165Further work on our internal administration console
Another working area has been added to our internal administration console. Nothing changes for your account, your appointments or your data.
ℹ What we build internally is listed here without details – so the history stays complete and you can see which days we worked.
- Correction
phase-3b.157.164Brief disruption this evening – resolved
On the evening of 27 August our service was unreachable for around half an hour. Anyone who opened a page or tried to sign in during that time received no response.
The cause was in our software and has been fixed. No data was lost, and no data was accessible from outside; invitations and confirmations already sent are unaffected.
So that this kind of error no longer reaches live operation unnoticed, our release chain now checks for it automatically before every publication.
- Regular
phase-3b.157.162An addition to our internal administration console
Our internal administration console has gained a new working tool. Nothing changes for your account, your appointments or your data.
ℹ We list internal work here without detail – so that the history stays complete and you can see which days were worked on.
- Security
phase-3b.157.161Maintenance work on internal administration
Protective measures on our internal administration console have been strengthened. Nothing changes for your account or your appointments.
ℹ We list such work here so the history stays complete – even when there is nothing to see on the surface.
- Regular
phase-3b.157.160You now decide which language we write to you in
Your account now has a language setting. What you choose there applies to every email we send you – confirmations, notices, security messages.
ℹ Until now the language you registered in applied, and it could not be changed. Anyone who created their account in one language and preferred to read in another had to live with it.
⚠ The list shows every language under its own name – Deutsch, Français, Italiano, English. That way you find a language you understand even when the screen is currently in a different one.
🚨 And if you do not yet have an account with us, our email will from now on arrive in all four languages. This concerns the invitation to an audit team and our first enquiry to you: you were never able to say how you wish to be addressed – so we do not guess, we write all four one below the other.
- Regular
phase-3b.157.159A refinement to our clean-up machinery
Work on the internal management console and on the machinery behind it that clears accounts once the deadline has passed.
Nothing changes for you – except that reversing your deactivation now takes effect cleanly even if it happens at the very last minute.
- Regular
phase-3b.157.158Invitees now have a say in who attends
An invitee can send a substitute, bring someone along or move to a different session. Until now, all of that went through the appointment owner.
What works without an account – via the link in the invitation:
- Send a substitute. The named person takes over the same sessions and receives their own invitation; your own link expires.
- Move to a different session. That is a request, not a rebooking: the appointment owner decides, and both sides receive mail.
What needs an account: bringing someone along. Giving away your seat is your own affair – creating a second one affects the plan.
ℹ The appointment owner stays in control. They are informed of every change by email, see the requests on the appointment, and can switch self-service off entirely in the access rules.
- Correction
phase-3b.157.157Asterisks nobody was meant to see
On a few pages, formatting characters appeared in the text instead of formatting it. Where a word was meant to stand out, two asterisks sat in front of it and two behind – visible, in the middle of the sentence.
Five places were affected: the note for accompanying persons, the confirmation before unsubscribing, the note on the invitation page and a paragraph on our home page. All are cleaned up; the emphasis is now done by the display.
ℹ And a check in the build keeps them out from now on. It knows the two areas in which formatting is interpreted, and objects to it everywhere else.
- Regular
phase-3b.157.157What you see before we ask
The page behind our enquiry now explains the point first. What the service does, what you get from it — and that you can use it without an account. Only then do we ask how often we may write to you.
⚠ The order is the message. Starting with the question demands a decision about something that has not been explained yet.
🚨 And your appointment page now shows, at the end, how often we write to you — together with the way to change it. If the setting comes from the appointment owner because you have not chosen anything yourself, we say so explicitly.
ℹ Cancellations and changes to your own appointment still reach you immediately, whatever the setting.
- Regular
phase-3b.157.156You decide how often we write
You set the frequency per appointment – twice. Once for your audit team, once for the customer's participants: immediately on every change, or collected daily, weekly or monthly.
🚨 Two settings, because there are two expectations. Your team works on the plan and needs every change at once; your business partner does not want mail three times a day. A single figure would force you to trade one against the other.
⚠ Anyone who has chosen a frequency themselves keeps it. Your setting applies to everyone else – it says so next to the fields, so it does not surprise you later.
ℹ Cancellations and rescheduling are not affected and still go out immediately. The frequency only collects what can wait.
ℹ You can change it at any time, including after the invitations have gone out.
- Regular
phase-3b.157.155Two deadlines that never collide
If you deactivate your account yourself, the inactivity deadline does not apply on top of it. What applies is exactly the deadline you were given when you closed it – with the date from your confirmation mail.
ℹ And the other way round: the 366-day rule for free accounts only applies when nobody signs in. A deactivation by you or by us follows its own rules and its own date.
ℹ Nothing changes for you – there are simply never two deadlines at once on the same account, and every mail states the date that applies.
- Regular
phase-3b.157.154The calendar now shows what is still open
Every appointment carries its colour. Confirmed, still waiting, change requested, cancelled – you see it in the grid without opening a single appointment.
ℹ Colour never stands alone. Each state also has a symbol and a name that a screen reader reads out. Anyone who cannot reliably tell red from green gets the same information.
ℹ New: the agenda. A list of the next thirty-one days, showing only the days that have appointments. On a phone this is the view that works – a month grid on a hand’s width gives you two characters per day.
ℹ And the calendar can be operated from the keyboard. The arrow keys move the day, t jumps to today, n starts a new appointment. In a text field the letters do not apply – there an n is an n.
- Regular
phase-3b.157.153Free accounts expire after a year without a sign-in
A free account with no sign-in for 366 days will be deleted. Before that there are three reminders – 30, 14 and 2 days ahead – and each one names the date.
ℹ A single sign-in is enough to avert the deadline entirely, up to and including the last day named. There is nothing to confirm and nothing to configure.
ℹ Why we do this. An account holds addresses, appointments and files belonging to other people. Keeping what nobody needs any more is not generosity, it is a data holding without a purpose.
ℹ Paid plans are not affected. With a contract your account remains – even without signing in. This already applies if you are a member of one paid tenant.
ℹ 366 days and not 365 – because of leap years. Someone who signs in on the same calendar day each year should not be one day late in a leap year.
ℹ For accounts that already exist, the period starts today. We only began counting with this change; nobody loses time we did not measure.
- Regular
phase-3b.157.151We remind you before a closed account is deleted
If you close your account, you now receive two reminders before the data disappears: 14 days and 2 days before the deletion date. Both state the date and the way back.
ℹ Why two and not one. There are 91 days between closing and deletion. An announcement that only arrives when you trigger it reaches someone three months later who has long forgotten it.
ℹ On the deletion date, deletion now actually happens – appointments, sessions, documents and participant data. After that none of it can be restored, not on request either. The only thing that remains is the billing history the law requires us to keep. Your e-mail address becomes available again.
ℹ A team does not end with its owner. If you are the last owner of a tenant that other members work in, you cannot close your account without transferring ownership first. Your colleagues should not be left with a tenant nobody can administer.
- Regular
phase-3b.157.150You can now close your account yourself
Under Account there is a new section Close account. Using it deactivates your account – and you then have 91 days to change your mind.
ℹ What still works during that time: signing in, viewing and downloading your appointments and documents. Creating new appointments and sending invitations no longer works.
ℹ Two clicks, not one. Before closing we summarise exactly what happens, with both dates – the last day of access and the day of deletion. Only the second click triggers it.
ℹ You also receive both dates by e-mail, so they remain readable after you sign out. You can withdraw the deactivation up to the last day of access – one click is enough.
- Correction
phase-3b.157.149Two quick clicks are now one cancellation
Clicking Cancel twice in quick succession still triggers exactly one cancellation – and produces exactly one confirmation.
ℹ Why that was not a given: between the check and the save there was a moment in which a second click could have done the same thing. The store now accepts only one entry per operation.
ℹ Also fixed: in rare cases an older, slow request could hide a freshly saved cancellation again in the display.
ℹ And a fault you would never have seen: the database rule required for this could not have been created over existing cancellations at all – the service would not have started after the update.
- Regular
phase-3b.157.148You can now cancel your subscription yourself
Under Account you will now find how long your subscription runs – and a way to cancel it.
🚨 Cancelling does not end anything immediately. Everything stays as it is until the last day of the term: creating appointments, sending invitations, viewing everything. Only afterwards does the free plan apply.
⚠ And you can withdraw it as long as that day has not been reached. You receive a confirmation with the date every time – please keep it, it is your record.
ℹ We found and fixed a mistake along the way: the line „allowance year until …“ named one day too many. The date shown was already the first day of the new year.
ℹ Added later: the same extra day also appeared in the warning email sent when 80 per cent of your allowance is used up. There too we now name the day your allowance year really ends.
- Regular
phase-3b.157.147Dormant accounts no longer create new items
When an account is set dormant, everything existing stays accessible: viewing, editing, cancelling. Only new items are no longer created.
🚨 Cancelling remains explicitly possible. A dormant state that holds you to your commitments while taking away the means to withdraw them would not be rest – it would be a trap.
ℹ And the screen tells you why. Previously it would have said “that didn't work just now” – a sentence that invites a second attempt instead of explaining.
- Improvement
phase-3b.157.146Accounts can now be put on hold temporarily
Further work on our internal administration console. Nothing changes for you.
- Improvement
phase-3b.157.145Account handling in the operator area
An extension to our internal management console. You will not notice anything – except that a question to us gets answered faster.
- Regular
phase-3b.157.145Light, dark or follow your device – now in your area too
Until now the appearance switch was only on our public site. You will now find it at the top right of your area: Light, Dark or Auto.
⚠ "Auto" is the default, and it stays within reach. Your device may switch to dark by itself in the evening, so if you pick a fixed setting you should be able to go back. Your browser remembers your choice and applies it while the page loads, so nothing flashes.
On long pages an arrow at the bottom right takes you back to the top. It only appears once the way back is genuinely long. If you have asked your system for reduced motion, it jumps rather than glides.
ℹ Our internal management console received the same selector.
- Regular
phase-3b.157.144You can now ask for a higher tier yourself
When your appointment quota runs low, you now also see how to proceed. In the tariff overview you pick the tier you want and send us a request.
ℹ No costs arise from this – the request reaches us, we enter the change and get back to you.
⚠ Before, it only said that the quota was used up. Where to turn was stated nowhere.
- Improvement
phase-3b.157.143A click on “Remove” now asks first – and says what disappears
Removing a passkey now asks for confirmation. Before, the first click was final; anyone who hit the wrong row had lost the device they sign in with.
ℹ The prompt names the passkey and says what applies afterwards – not just “Are you sure?”. A prompt without content gets clicked away like the first button.
⚠ Adding one is unchanged – only paths that take something away ask.
- Improvement
phase-3b.157.142The operations tooling was extended
Work on the internal administration console. Nothing changes for your use of the service.
- Regular
phase-3b.157.141We now also notice when our emails never leave at all
Before we send you a first message, our address has to appear in the email footer – we require that of ourselves so that no message leaves any doubt about who sent it.
🚨 While it is missing in a language, no email goes out in that language – and until now that simply went unnoticed: everything runs, only nothing arrives.
ℹ Our operations view now knows about this case and reports it, including the languages in which the details are missing.
⚠ Nothing changes for you – except that such a state can no longer go unnoticed for days.
- Regular
phase-3b.157.140We can now see whether our backups are still running
Your data is backed up in encrypted form every night. That was already the case – what is new is that we also notice when it does not happen.
🚨 The difference is bigger than it sounds. A backup run that fails reports itself. A backup service that has stopped running reports nothing – and that is the case that really hurts: everything looks normal until someone needs the backup.
ℹ So we now also watch for the absence – not just for an error message. If a scheduled run is missing, we see it the next day.
⚠ Nothing changes for you – except that we notice sooner when something is wrong.
- Regular
phase-3b.157.139The sign-up form gives nothing away through its response time either
When you sign up, we answer every address with the same sentence – whether an account already exists for it or not. That is meant to stop anyone from using the form to find out who has an account here.
🚨 Until now we simply were not equally fast. Where a new account is created there is more to do behind the answer – and anyone timing it could read what the text does not say.
ℹ The form now answers after half a second at the earliest. That lifts the fast case up to the slow one. If an operation ever takes longer than half a second, the answer comes later accordingly – this does not close the difference entirely. You will hardly notice; signing up takes longer than that anyway.
⚠ If something goes wrong, you will still be told. We could have sent the answer immediately instead – but then you would get an “accepted” for an account that was never created.
- Regular
phase-3b.157.138Your data is backed up every night – encrypted
From now on our system makes a complete backup of your data every night. Appointments, contacts, settings – everything you have set up here.
🚨 The backup is encrypted. Anyone who got hold of the file would see nothing but gibberish; without the key it cannot be opened.
ℹ Fourteen versions are kept – that is, the last fourteen nights on which the backup actually ran. If a run is missed, the window moves back accordingly.
⚠ What this is not: a substitute for your own care. An appointment you delete is deleted; the backup is there for the case where something goes wrong on our side.
🚨 And as things stand it sits on the same server as the database. It helps against a fault in our software; it does not help against the loss of the server itself. Copying it to a second location is planned and not yet built.
- Regular
phase-3b.157.136Same answer also means: same speed
When you request a new password or ask for the confirmation email again, we answer every address with the same sentence – whether we hold an account for it or not. That is meant to stop anyone using these forms to find out who has an account here.
🚨 We just were not equally fast. Where an account exists, there was more work behind the answer – and anyone measuring the time could read what the text does not say.
ℹ The page now answers immediately and does the rest afterwards. The duration no longer depends on whether we know you. Nothing changes in what you see.
- Regular
phase-3b.157.135Everything switched off – and still a way back
Anyone who switched off all messages also stopped receiving the link needed to undo it. The switch cut off the path to itself. Until today the confirmation therefore advised keeping the email – a hint, but not a way out.
🚨 Now there is one. Open the settings page without a link, enter your address, and we will send you a new one. This one message goes out even if you have switched everything off.
ℹ It contains nothing but the link to your own settings – no appointment and no indication of who invited you. And the page answers the same for every address, whether we hold it or not.
⚠ At most one such message goes out per address every fifteen minutes. This is the one message you cannot switch off – it is the way back, after all – and so no one may repeat it into your mailbox.
⚠ The link from this message only operates the switch for all messages. The finer levels belong to a particular sender; they appear in every email again as soon as you receive any.
- Regular
phase-3b.157.133One last gap in the delivery status – and it is closed
Yesterday's catch-up had a gap of its own. Two paths pick each other up: the return channel sets aside an event it cannot yet match, and the sending side checks for anything waiting when it files the message.
🚨 If both arrived at exactly the same moment, the report was still lost. The sending side looked in the buffer while the return channel was only just placing something in it – and found nothing. After that, neither looked again.
ℹ Now the return channel also checks last. As long as the message could be filed on our side, one of the two paths hits – and your delivery log shows the state it is meant to show. If the filing itself fails, the state stays open rather than claiming a success that never happened.
- Regular
phase-3b.157.132Delivery status is right even when the answer beats us to it
A message can be rejected before we have finished recording it. We hand it over, the provider accepts it, and only then do we write down that it went out. An immediate bounce – from a mailbox that does not exist, say – could fall into that gap.
🚨 And it never came back. The provider reports each event exactly once; whatever we could not match at that moment was gone. The message then stayed on handed over forever, although it never arrived.
ℹ Such an event is now set aside and applied as soon as the record exists. The delivery log shows you the same status you would have seen if the answer had arrived a second later.
- Regular
phase-3b.157.131Your plan changes – and you are notified
Until now nobody found out. Only changes to the appointment itself were reported – title, location, time frame. Anyone scheduled into three more sessions after the invitation only saw it by opening the appointment page again of their own accord.
🚨 That is a notice now. When your sessions change, you get an email with the link to your appointment page – it always shows the current state.
ℹ And it is ONE email, not five. Building an audit plan means entering many sessions one after another. The planning office collects the changes and sends them in one go; it can see how many people are still waiting for a notice.
ℹ On your appointment page you can now accept or decline all sessions at once. Individually still works as before – and for a change of time there is still the change request on the session concerned.
- Regular
phase-3b.157.130You now decide how often we write
Until now it was yes or no. Anyone annoyed by the volume could unsubscribe – and was gone for good.
ℹ Now there is a scale: immediately · daily · weekly · monthly · not at all. Choose weekly and you get one summary instead of separate emails – and stay reachable.
🚨 Cancellations and appointment changes are never subject to the chosen cadence. They go out immediately, regardless of the setting. Nobody should travel for nothing because of a chosen frequency.
ℹ And the link at the bottom of every appointment email now leads to a settings page rather than an unsubscribe button. It holds up to three switches – this appointment, this organiser, all appointment-planning emails – and they work in both directions.
ℹ The first switch appears only when the link belongs to a single appointment. A digest is about several, so its link shows two switches instead of three.
⚠ Emails about your account are not affected. Sign-in codes and address confirmations are not appointment planning; without them you could no longer get into your own account.
- Regular
phase-3b.157.129You can now see whether your invitations arrived
Until now the information stopped at sending. You read “invitation sent” – what happened afterwards, nobody knew.
ℹ The appointment view now shows what became of each message: delivered, temporarily undeliverable, or not deliverable at all. If it was rejected, the reason given by the other side's mail server is shown with it.
⚠ Accepted is not delivered. A mail server keeps trying for up to a week; a failure can arrive days later. The display is updated as reports come in – it is worth looking again later.
🚨 This is how you find the most common reason why nobody confirms: an address with a typo. Until now that looked exactly like someone who simply had not answered yet.
ℹ We do not see whether anyone opened a message, and we do not want to. That would require a tracking pixel in every mail. Delivery yes, opening no.
- Regular
phase-3b.157.128Change your plan while you keep working
Your plan can now be changed without setting up a new account. Until now, the tier your account was created in was the tier it stayed in. Write to us and tell us which tier you would like – we switch it over, and it takes effect immediately.
ℹ A change takes nothing away that is already there. Appointments you have sent stay sent; people you have assigned stay assigned. A smaller tier applies to what comes next: the next mailing and the next assignment.
⚠ There is one exception: your own mailbox. It belongs to the largest plan. If you move to a smaller tier, we delete the stored credentials – because a mailbox password you no longer need should not stay with us. Your invitations then go out through our service again.
ℹ Your plan overview after signing in still shows where you stand – appointments used, seats taken, and how long your allowance year runs.
- Regular
phase-3b.157.127Users are now counted – as people, not as assignments
What your plan includes in terms of users is now enforced. Until now the number on the pricing page had no effect.
ℹ People are counted, not assignments. Anyone on the audit team of two scheduled appointments occupies one seat, not two.
ℹ And only what is currently being planned counts. Cancelled appointments and those that are over no longer hold a seat. Removing someone from a team frees their seat immediately.
⚠ Once your plan is exhausted, nobody new can be assigned. People already assigned are unaffected – including in appointments that have already gone out.
ℹ Your plan overview after signing in now shows both figures: appointments used and seats occupied.
- Regular
phase-3b.157.126Your allowance is now visible – and it applies
Until now you could send without limit, whatever your plan contained. That changes with this release – in both directions: you can now see the number instead of guessing it.
ℹ After signing in, your plan is shown at the top of the page. What it includes, how much is used, and when the current allowance year ends.
ℹ At four fifths we write to you. Once per allowance year, by email and in the hub – so that you can decide while there is still room, and not on the day you want to send.
⚠ Once the allowance is used up, new appointments can no longer be sent. Creating and scheduling them still works.
🚨 What remains untouched: everything already sent. Confirmations, change requests, cancellations and individual resends continue as normal – even with a full allowance. Your invitees have nothing to do with your plan and notice nothing of this.
ℹ Counting happens on sending, once per appointment and regardless of the number of participants. A draft costs nothing, a reschedule costs nothing, and a reminder does not count again.
- Regular
phase-3b.157.125Standard clauses now sit with their standard
Until now your plans carry a bracket after the number. Something like “7.6 (20k)” or “QMS: 8.1” — because the clause number alone does not say which standard it belongs to. Four notations for the same thing, all by hand.
ℹ You now enter the clauses with the standard they belong to — where the minutes already are. That makes the bracket unnecessary, and the printout looks the same everywhere.
ℹ The same number may appear twice if it belongs to two standards. Clause 8.2 exists in several standards; each brings its own. Only within one standard the same number cannot appear twice — that would be a typo.
ℹ Empty lines disappear on their own. Anyone leaving a line blank meant to say nothing; that is not an error and is not reported as one.
ℹ And the order stays yours. We do not sort — an audit plan reads in the order in which the audit is carried out.
- Regular
phase-3b.157.124How much is scheduled, and how much is still missing
Planning is where you lose track fastest. ISO 9001 needs 32 hours, 18 of them scheduled; ISO/IEC 27001 needs 48, 17 of them scheduled. And your auditors have committed: one to 16 hours, one to 14.
ℹ Both numbers now sit side by side – the target and what is already scheduled, per standard and per person. What is still missing is calculated from the sessions and stored nowhere else, so the two cannot drift apart.
🚨 Two tallies that are never added together. If two auditors sit in the same two-hour session, that is two standard hours and four person hours. Both are correct – their sum would not be.
ℹ Session time not yet assigned to any standard appears as its own figure. Otherwise you would read “12 hours open” next to a full calendar.
ℹ Anyone who says “I will join, but I only have four hours” records it. Whoever says nothing has no upper limit. Going over is shown, not prevented – the decision stays with you.
ℹ The display follows with the planning view; through the interface the overview is already available.
- Regular
phase-3b.157.123Every standard gets its own target hours – and its own audit type
An audit rarely covers just one standard. Your plans list five side by side, and each brings its own target hours: ten for one, eight for another. A single total on the appointment did not help – the parts cannot be recovered from it.
ℹ You now enter the standards individually, each with its target in minutes and with the audit type in the same row. Because that belongs to the standard too: within one appointment, one standard can be recertified while another is under surveillance.
ℹ And on the individual session you state how many minutes go to which standard. If you audit both standards within two hours, you split those two hours – say one hour each. That uses two hours of your budget, not four.
⚠ A standard that already has minutes booked cannot be removed. Otherwise planned hours would disappear without anyone noticing.
- Regular
phase-3b.157.122A topic spanning two days now shows as “Part 1” and “Part 2”
Real audit plans put the same topic on two days – one part on the first morning, the other on the second afternoon, often with partly different people. Until now these were two sessions with no visible connection.
ℹ You can now record a session as the continuation of another. Anyone reading the plan then sees Part 2 of 3 behind the title – the numbers are derived from the sequence itself.
ℹ You do not have to count along. If a part is added or dropped, the numbers still add up.
⚠ The order is checked. An earlier part placed behind a later one is rejected – including when you move it afterwards.
- Regular
phase-3b.157.121Attending only part of a session no longer counts as a double booking
**In the audit plan it appears in brackets: (H. Ortiz until 4 p.m.).** Until now the application only knew "present" or "not present" – and reported a double booking as soon as someone moved out of one session and into the next at 4 p.m.
ℹ You can now enter an individual time per person and session. Empty still means: from start to finish.
ℹ The double-booking rule takes it into account. Whoever sits in one session until 4 p.m. may join the next from 4 p.m. – and anyone who actually overlaps is still rejected.
ℹ Your attendees see their own time on the page they open from their invitation link.
⚠ Nothing changes in existing appointments unless you enter a time.
- Regular
phase-3b.157.120Escorts are no longer treated like interviewees
Whoever guides the auditor through the building is not interviewed. You can now enter a person explicitly as an escort – and that changes three things at once.
ℹ They may be listed in several concurrent sessions. Until now the application reported a double booking there, although that is precisely an escort's job.
ℹ They do not count towards the outstanding confirmations. Otherwise an appointment never counted as fully confirmed, because someone was expected to accept who had never been asked.
ℹ Their access link shows no accept and decline buttons, but a sentence explaining why.
⚠ Existing attendees remain interviewees. Nothing changes in your current appointments unless you switch someone over.
- Regular
phase-3b.157.119Rooms you have already entered are now suggested
Anyone who has the same room for six of eight sessions now types it once. As soon as one room appears in a plan, every other room field offers it to you as you type.
ℹ It stays a suggestion, not a choice list. The seventh room is exactly the case this field exists for – you can enter something that appears nowhere else at any time.
⚠ Only what is saved is suggested. An entry you have only just begun does not appear in the list – otherwise a typo would multiply across the whole plan.
- Regular
phase-3b.157.118No more unnamed session when two people edit at once
From the second session onward, each one needs a name. Until now, two people editing the same appointment at the same moment could get past that rule — the plan then showed one session without a name among named ones.
ℹ This was rare and never lost any data, but it looked like a fault in your plan, and you had to correct it by hand.
⚠ What you might notice now: if two people edit the same appointment at the same time, one of them briefly sees a message asking them to try again in a moment. That is the rule doing its work.
- Regular
phase-3b.157.117You can now see who has their access link – and who has opened it
Each invitee on the appointment now shows the state of their access: none issued yet, open, used, expired or revoked. Along with when the link last went out and when it was last opened.
🚨 This is the first question before an audit: did they get the link? did they look at it? Until now there was no answer – and without an answer you call them, or send it a third time.
ℹ Sending and revoking sit in the same row. A revocation still works after the appointment has been sent out; that is exactly when it is needed.
⚠ Shortly after sending, the send button is locked so the same mail does not go out repeatedly. Next to it stands the time from which it works again. The lock releases by itself, with no need to reload the page.
ℹ All times in the appointment's time zone – as everywhere on this page.
- Regular
phase-3b.157.116Your access link no longer appears in any log
The link in your invitation now carries its key in a way that never reaches our server. It stays in the browser – and therefore out of every access log, including our own.
🚨 Why this matters: anyone who finds this link sees an audit plan with participants and times. It is valid until the appointment, so it lives a long time.
ℹ Older links keep working. If you open one, the page rewrites the address itself.
⚠ What has not changed: the link is still in your address bar and in your browser history. If you share your screen, you share it too.
- Regular
phase-3b.157.115An approval applies to the list the auditor read
If the customer changes the participant list at the very moment of submitting it, the auditor can no longer approve it. The list goes back to open, and the customer is asked to submit it again.
🚨 This is not red tape, it is the point of the sign-off: an approval applies to the state the auditor read – not to what it became a second later.
ℹ You will almost never see this. It takes two operations in the same instant. When it happens, nobody did anything wrong – somebody just clicked too fast.
- Regular
phase-3b.156.114You tell us the room – you know your building
Customers entering their participants can now add a room to each session. With three parallel sessions that is the detail that makes the difference:
E18-O1-12instead of the same address three times.🚨 The room is the one detail the auditor cannot know – you know your building. It then appears in the plan – and on the page your participants open from their invitation.
⚠ Optional. If you have only one meeting room, leave the field empty.
ℹ While your list is with the auditor, the room is shown but not editable: it is part of the plan the auditor signs off.
- Regular
phase-3b.149.113Show that you are booked – if you want to
Anyone working for several clients can now let other planners on this platform see that a period is booked. Otherwise the second client only finds out when you decline.
🚨 Only THAT a time is booked is shared – not the customer, not the appointment, not the place and not the title of the session.
⚠ The setting is off unless you switch it on. You will find it in your account, and you can expressly exclude or expressly include individual organisations.
ℹ Revocable at any time, and the revocation takes effect immediately. If you change your e-mail address, the setting moves with it.
- Regular
phase-3b.149.112No double booking when you move a time
When you move an appointment, the application now tells you if that would double-book someone. Until now this check only applied when assigning a person – moving a time could silently create a double booking.
🚨 The message names the person and the other session. With forty sessions, „not possible“ is not information; you see who is in the way, and where.
⚠ A blocked time also stops the move – that is not a double booking but a person who is unavailable at that time.
ℹ And the confirmations for the moved session are collected again. Someone who accepted 11:00 did not accept 09:30. The confirmations for the other sessions stay as they are.
- Regular
phase-3b.149.111Your customer may ask for a swap
The person in charge at your customer can now request that two sessions or two sections trade places. They pick the two entries, optionally write why – and you get a message.
🚨 The request changes nothing in the plan. Nor does an approval swap anything by itself: you decide, and you carry out the swap in the editor. That way the plan stays what you see – and you keep control over what exactly is swapped: the times only, the sections too, with or without the people.
⚠ A refusal requires a reason. Otherwise your customer would only learn that their wish is not being granted, and would ask.
ℹ Every decision sends an email to your customer. If one fails to go out, it says so on the request – with a button that sends it again.
- Regular
phase-3b.149.110The participant list now gets a release
Your customer now submits the participant list, and you release it or send it back. While a submitted list is with you, they cannot submit a second one.
🚨 Sending it back requires a note. Your customer reads it on their own page and knows what to change – a return without a reason would be a dead end with a stamp on it.
⚠ If they change anything after submitting, the submission falls back to open. Otherwise you would release a list that has since become a different one.
ℹ You see the state on the appointment: when you asked, when your customer first opened the link, how many people are entered, and where the release stands.
- Regular
phase-3b.149.109Your customer enters their attendees
The responsible person at your customer now enters their attendees themselves. Through the same link they use to view the plan: add a person – e-mail, name, role – and assign them to the sessions.
🚨 Nobody can be in two sessions at the same time. The page tells them with the same sentence you read in the editor, as soon as it happens.
⚠ They still change nothing in the plan. Sessions, times and parts are yours; they see them and assign their people.
ℹ You see their entries in your editor like any other attendee – they are the same records, not a second track alongside.
- Regular
phase-3b.149.108Plan before the names are known
You can now finish planning without knowing your customer's attendees. Record the responsible person at the customer on the appointment – address, name and language – and request their list of attendees with one button.
🚨 They need no account with you. They receive their own link and see your plan there, with every session and its times.
⚠ They cannot change anything in it. The plan is yours; if something does not fit, they get in touch with you.
ℹ If the responsible person changes, you can send again at once – the 24-hour lock applies only to the same address, and the old link stops working.
ℹ Entering the attendees follows next. The link already leads to the right page; entry will appear there.
- Regular
phase-3b.149.107Audit time counts work, not calendar
The planning counter now adds up sessions. Two audit teams checking different standards in the same slot from 2 to 4 pm deliver four audit hours – while the calendar is occupied for two. Both numbers appear side by side, because they answer two questions.
🚨 A session may be interrupted. From 8:15 to 8:30 and again from 9:00 to 11:00 – the gap in between does not count, and an auditor may be scheduled elsewhere during it.
⚠ Audit time is shown in hours, not in days. “40 hours” is unambiguous; “1 day 16 hours” would not be, because a calendar day has twenty-four hours and a working day does not. How long your working day is, we deliberately do not calculate for you.
ℹ The occupied time next to it stays calendar time and still tells you how long your day is taken up.
- Regular
phase-3b.148.106You request the confirmations at the end
Once your planning stands, one button requests the confirmations. It sits below the sectioning – where your work ends.
🚨 It asks before it acts. Sending cannot be undone: the invitees have their access links, and the appointment can no longer be changed freely afterwards.
⚠ Nothing goes out while anyone is left without a session. An invitation without times does not tell the invitee when they are needed – and once you schedule them afterwards, their confirmation would be void anyway.
ℹ Afterwards you see who was reached and who was not – with address and reason. Anyone the run skipped, you can still invite individually.
- Regular
phase-3b.148.105Your visitors appear in the section too
You now staff the client’s people just as you staff your audit team. They appear under each track in a line of their own – by name, not just by address.
⚠ The same rule applies: nobody sits in two sessions at once. Anyone already scheduled at that time – including in a different audit – cannot be booked here a second time.
🚨 Listed separately, and that is deliberate. An auditor performs the audit; a visitor attends it. A track holding only visitors is not a staffed track – which is why a free visitor does not open another track either.
ℹ The unaccompanied walkthrough stays possible: a track without visitors is not a mistake.
- Regular
phase-3b.148.104Who works in which section
You now staff your audit team directly in the section. Below each section you see which tracks run inside it and who sits in which – and who you can still add.
🚨 A section can split into any number of parallel tracks – as long as you still have auditors who are available at that time. When nobody is free, the button for another track is closed and says why. Creating an empty track and having to delete it again is spared you.
⚠ Anyone unavailable does not vanish from the list; they appear with a reason – “has a blocked period” or “is already scheduled at this time”. A name that simply is missing looks like a fault; a name with a reason is information you can act on.
ℹ An assignment in a completely different audit counts too. Anyone scheduled elsewhere that same morning is not free here – even if they appear nowhere in this appointment.
- Regular
phase-3b.148.103Parallel sections for parallel teams
Sections may now run at the same time. In a large audit covering several standards, one audit team covers one standard from 2 to 4 pm while the other team covers another in the same hours – two sections, the same hour.
🚨 The counter now shows two figures, because there are two questions. Two teams working two hours deliver four audit hours – that is the time you are scheduling. Your calendar, meanwhile, is occupied for two hours – the afternoon only happens once.
⚠ What limits the parallelism is people, not clock times. A second section at the same time is possible as long as auditors are free. Anyone already scheduled elsewhere – including in a different audit – cannot be booked twice.
ℹ On the timeline, simultaneous sections get their own lanes. Drag one of them and the parallel one stays put: it was not in the way, it was beside it.
- Regular
phase-3b.148.102Drag the sections into place
An appointment’s sections can now be dragged into place. Above the list there is a timeline: each section is a bar, and you grab it by its edges.
🚨 Neighbours give way when it gets tight. Drag a section longer and the ones behind it move along – but only as far as they are genuinely in the way. A gap you left is used up first rather than being pushed along.
⚠ The movement stops at the edge. No section slides out of its appointment, and none shrinks to nothing. Where it cannot go further, the bar stays put and a note tells you why.
ℹ Shrinking pulls nobody along. Make a section shorter and a gap stays behind it – your breaks and changeover times remain where you put them.
It works without a mouse too: the tab key reaches every handle, the arrow keys move it in five-minute steps, and holding shift moves it by the hour.
- Regular
phase-3b.148.101Divide an appointment into sections
An appointment can now be divided – opening, tour, lunch break, closing meeting. You draw the sections, and a counter tells you continuously how much time is allocated.
🚨 The lunch break belongs to the appointment, not to the audit time. Tick “does not count as audit time” and the section stays occupied in the calendar – nobody can book a second appointment then – but it does not count as an audit hour worked.
⚠ You then see both numbers: how much audit time is allocated and how much time is occupied in total. As long as the two do not differ, only one is shown.
The duration grows with the amount: “1 hour 30 minutes”, “1 day 16 hours”, “1 week 3 hours” – never “2400 minutes” and never “0 weeks 1 day 16 hours 0 minutes”.
- Security
phase-3b.148.100Sign in without a mailbox – with an authenticator app
You can now run the second factor through an authenticator app instead of by email. Your app calculates a new code every 30 seconds, even offline.
🚨 Your access no longer depends on your mailbox. That counts precisely when it matters: if your former address is unreachable, a recovery code used to be the only way in – and there are ten of those.
For the same reason there is now a third way to change your address. You approve it with a code from your app, without touching your recovery codes. ⚠ This way only appears once you have set the app up – with the emailed code it would be the same door as the link to your old address.
You will find the setup under “Your account”. ⚠ You see the secret exactly once, and the second factor is only switched on after you confirm a code from the app – so the setup cannot take your access away halfway through.
- Security
phase-3b.148.099Sign in without a password – with a passkey
You can now set up a passkey and sign in with it – with your face, your fingerprint or your device PIN, in one step and without a second factor.
🚨 A passkey cannot be phished. Its secret half never reaches us, and it only works on the genuine site: a copied sign-in page does not get it, however convincing it looks. That is precisely where the most common attack on passwords fails.
You will find it under “Your account”, right next to the second factor. For each key it says whether it is backed up – whether it survives the loss of the device or disappears with it. That is the question that matters before you rely on it alone.
⚠ Your password stays. The passkey stands beside it, not in its place; you choose again at every sign-in.
- Security
phase-3b.148.097Your last ten sign-ins are now in your account
Under “Your account” you now see your last ten sign-ins – with the time, the method (password, password and code, passkey) and the origin.
🚨 This answers a question that cannot otherwise be answered: was there someone who was not me? Whoever holds a stolen password changes nothing – they only look. A sign-in you do not remember is the only sign of it.
ℹ If you see one that was not you, change your password immediately and switch on the second factor.
⚠ The address is stored shortened – the last part is missing on purpose. Sign-ins are kept for 90 days and deleted afterwards.
- Security
phase-3b.148.096“All sessions end” now covers the one being created right now
When you reset your password or change your address, every sign-in ends; when you switch off the second factor, all other sign-ins end. Until now that applied to those existing at that very moment – a sign-in already under way could still get through.
ℹ What counts now is the point in time, not the moment of the cleanup. Anyone who has entered the password and then types in their code no longer gets a session if you reset in between.
⚠ When switching off the second factor you stay signed in yourself – as before. It is the others that end.
- Security
phase-3b.148.095Every appointment email now has an unsubscribe link
From now on, every appointment email ends with an unsubscribe link. You choose how far it goes: just this one scheduling process, everything from this sender, or no appointment emails at all – from anyone.
ℹ No sign-in, no account. The link is enough; most recipients have no account with us, and a right to object that requires registration is not one.
⚠ The link does not expire. Unlike an appointment access link it stays valid – anyone who finds an old email later and wants nothing more can still act on it.
- Regular
phase-3b.148.094Team invitations can now be accepted
Anyone invited to a team receives an email with a link. Until now that link led to a page that did not exist – the click went nowhere.
ℹ This is fixed. The link now opens a page where you can accept or decline the invitation. If you are not signed in yet, the sign-in appears right there; your invitation is not lost in the process.
⚠ Only the invited address can accept. If you are signed in with a different account, the page says so – instead of quietly declaring the invitation invalid.
- Correction
phase-3b.148.092Improved wording now reaches every language
Our legal texts and page content ship with a built-in base version in four languages. Once one language had been edited in the admin area, the other three stayed frozen at that moment — later improvements to the shipped version no longer reached them.
ℹ This is fixed. A language nobody has edited now always shows the current shipped version. Edited languages are untouched.
- Security
phase-3b.148.091Rejected mail no longer leaves addresses in the log
When another mail server rejects a message, it usually names the recipient address – something like “recipient unknown” with the address in the same sentence. Until now that reply went into our operational logs unchanged.
🚨 That is fixed. From a foreign server's reply we now record only what kind of rejection it was, not its wording. The same applies to messages from technical systems that may carry a value along.
ℹ Nothing changes for diagnosis: messages we write ourselves are still logged in full. Only what an outside system puts in is held back.
- Regular
phase-3b.142.000In the day view you select hours – and watch the total
In the day view you now select hours instead of whole days. A click picks an hour; hold Shift to extend the range up to it. The assistant takes those times over and does not ask for them again.
🚨 The selected duration runs along with you – visible while you select, not only in the summary. If you meant to plan four days and caught three, the number shows it.
ℹ A day with a clock change has one row fewer. On 29 March there is no 02:00 – the clock jumps from 01:59 to 03:00. The grid only offers hours that genuinely exist on that day.
- Improvement
phase-3b.142.000Free days between two appointments stay free
An audit on Monday and Friday no longer blocks the days in between. Until now an appointment counted as continuously busy from its start to its end: Tuesday through Thursday showed as occupied in the calendar although nothing was happening. Now what you marked is what counts.
🚨 And a day marked as all-day is genuinely blocked – from midnight to midnight in your time zone. Marking a day as unavailable now does exactly that; until now such a day was invisible to the availability calculation.
ℹ On a day with a clock change that is 23 or 25 hours. This is not a rounding error but the true length of that day – and the summary shown before saving states the same figure.
- Regular
phase-5.055.089The calendar is here – and appointments start with a selection
Your appointments now appear in a calendar with five views: year, quarter, month, week and day. Clicking a day goes one level finer; clicking an appointment opens it.
🚨 You create a new appointment by selecting days in the calendar – no longer through a form. The assistant then asks for the times: all day or from–to, whether the same times apply to the remaining days, and shows you a summary before anything is saved.
⚠ The name comes last. Entering it first would mean naming an appointment you do not yet know you want. And the summary comes before saving, because that is where a selection mistake shows up while it has cost nothing.
ℹ Several ranges in one go: select Monday to Wednesday, hold Shift and add Friday and Saturday – both ranges stay.
- Security
phase-5.055.085You can now turn on the second factor yourself
Your account can now require a second factor: a one-time code by e-mail, in addition to the password. The switch is in your account settings.
🚨 When you turn it on you get ten recovery codes — exactly once. Write them down. We cannot show them again later, and that is the point: an emergency exit that can be fetched again at any time is a second front door for an attacker.
ℹ Every change asks for your password, even when you are already signed in. A second factor that could be switched off with a hijacked session would fail to protect in exactly the case it exists for.
ℹ If you turn it off, every session that exists at that moment ends. You will sign in again on your other devices.
- Regular
phase-5.055.081Your own email footer when sending via your mailbox
When you send via your own SMTP mailbox, our footer no longer sits under your emails — instead you can store one of your own.
ℹ Why: these emails go out under your sender address. Our postal address below them would simply be wrong. You still need to be able to meet your own obligations, and that is what this field is for.
ℹ Plain text, no Markdown. What you type goes out as typed — no reshaping, no formatting from us. At most 15 lines of 80 characters each.
ℹ Optional. One line is enough, none is fine too, and you can switch it off without losing the text.
ℹ It is appended with three blank lines of spacing under every email we send through your access — including the test email during setup. That is where you see it first.
- Correction
phase-5.055.080Your name is back under your emails
In every email we send on your behalf, your organisation's name stood where your own should have — in the sign-off under invitations, reminders, changes and cancellations, and under the invitation to your team.
🚨 This was a mistake on our side, not a setting you got wrong. The query looked for the name in a field that does not exist in that form; it never found anything, and with nothing found it substituted the organisation's name. From the outside this looked plausible, which is why nobody noticed.
ℹ From now on your first and last name from your account appear there. If only one of the two is on file, that one is used; if neither is, it stays with the organisation's name.
ℹ You need do nothing. Emails already sent are unchanged.
- Improvement
phase-5.055.079From the second slot on, every slot needs a name
As soon as an appointment has more than one slot, every slot needs a name — including the first. Until now that applied only to the newly created one; the first could stay nameless and then sat among named ones.
ℹ With exactly one slot the name stays optional. There the appointment carries it, and a mandatory field would just be a copy.
ℹ The path is: name the existing one first, then add the second. The message says so too — you never got to see the first slot, it is created together with the appointment.
ℹ Spanning several days changes nothing. An appointment may run across days, and so may its slots; the rule follows the count, not the day. Cancelled slots do not count.
- Security
phase-5.055.078Team invitations go out as email
Anyone inviting someone into their organisation now has that invitation sent by email — with the inviter's name, the personal message and the written-out time until which it is valid.
🚨 With that, not a single access token remains in the server log. There were once four such links; this was the last. Anyone who found it there could join your organisation — and, for an address not yet known to us, receive an account on it as well.
⚠ An invitation to someone who does not know us yet needs their consent. Anyone who already has an account receives it right away. For an unknown address the same rule applies as to any other mail we send on your behalf: ask first, write after. Being a member of your team is not consent — your colleagues did not choose our service themselves.
ℹ The invitation is valid either way, even while the mail waits: it is in your administration view, and you can trigger it again.
ℹ The link sits behind the
#of the address. The browser attaches it to no request — it appears in no access log, not even ours, and in no referrer passed to third parties. When you accept, the page does send the link to us, because it has to be checked; but it never sits in an address line that anyone records. - Regular
phase-5.055.074The reminder that comes once
If a confirmation is still missing seven days before the appointment, a reminder goes out — to the people something is actually still missing from, in their language, with the link to confirm or decline.
🚨 Exactly one, and never more. Anyone reminded is not reminded again — not the next day, and not after an appointment change. A reminder should not turn into a series.
ℹ If the planning stands, the system stays quiet. If your appointment needs only one acceptance and it is in, nobody gets a reminder — not even those who never replied. Nobody is waiting on them.
⚠ Only upcoming appointments are reminded about, and only ones that are not cancelled. Drafts are left out.
ℹ The link in the reminder is the current one — as with all our appointment emails, the link from the most recent message is the one that works.
- Regular
phase-5.055.073Changes and cancellations go out
When an appointment is moved or cancelled, everyone already invited now hears about it — by email, in their language, with the new details and a link to the appointment.
⚠ A change resets the confirmations. People agreed to one particular appointment, not to whatever it later becomes. Until now that only stood in the email; from now on the system does it too.
ℹ Only what was in the invitation is reported — title, place and time. Your internal notes, the confirmation rule and the access settings trigger no mail. Nor does saving the same form again unchanged.
🚨 The link from the original invitation stops working. That is the price of having any link in the notice at all: we do not keep access links in the clear, so each notice issues a new one. The current link is always the one in the most recent email.
ℹ Anyone who wants no more mail keeps their existing access — it is not swapped when no mail goes out. And anyone never invited receives no cancellation either.
- Security
phase-5.055.072The invitation actually goes out
From now on the system sends the appointment invitation by email — in the invitee's language, with title, time, time zone, place and the link they use to confirm.
🚨 Until now that link sat in the server log. It was a deliberate stopgap while only we ourselves created appointments — and the most sensitive of the four links that ever sat there: it lasts until the appointment is over, not 48 hours, and whoever found it saw someone else's audit plan with participants and times. That is over.
⚠ You as the planner do not see the link either — neither on screen nor in the system's response. It belongs to the invitee. Otherwise you could confirm in their name, and the appointment would carry an acceptance nobody gave.
ℹ What you see instead is whether the invitation went out. Anyone who wants no mail receives none — the access still holds, so they can open the appointment another way.
- Regular
phase-5.055.068A no stays a no
From now on, every appointment email is checked against the recipient's consent. That used to be an intention; now it is a lock — and it sits at the one place every email has to pass.
Anyone who says no receives no further mail. Asking again is possible, but limited: after 90 days at the earliest, at most twice, and only when a person deliberately triggers it — no process asks again by itself. The period runs from the refusal; it cannot be extended by asking in between.
There will be three levels, and the lock already knows them: this one appointment · every appointment from this business partner · everything. They become adjustable once the settings page arrives.
⚠ Your account emails are exempt — sign-in code, password reset, account confirmation, address change. Otherwise someone could lock themselves out of their own account with a single switch: the second factor arrives by mail, after all.
ℹ And the record keeps what the request said at the moment of consent — not what it says today. If the text is revised later, the earlier version stays in the log.
- Regular
phase-5.055.067Naming slots – from the second one on
When you split an appointment into several slots – morning, afternoon, plant tour –, each slot now carries its own name.
It is required from the second slot you create onwards. The reason is in your business partner's email: the slots are listed one below the other there, and an unnamed entry between named ones looks like a mistake. A name such as “Plant tour” says in three words what someone is agreeing to.
As long as an appointment has only one slot, you need no name – the appointment's own name sits above it anyway. You may give one, but you do not have to.
ℹ And the first slot stays unnamed if you left it that way. It is created together with the appointment, without your being asked; we do not fill anything in for it later. So when you add a second one, it is best to name both.
⚠ The name is not copied from the appointment. That would have been convenient, but the second slot would carry the same text – and nobody would notice, because it fitted the first one. You type it yourself. At most 150 characters, for appointment and slot names alike: a name is shown on a single line everywhere.
Plus free text of 800 characters per appointment and per slot for details: access, parking, documents, contact person. The previous limit was 20,000 characters – eight pages, and nobody reads those between two appointments on a phone. If you need more, attach a file.
ℹ Longer names and texts already entered remain in place and are still displayed. The new limit applies the next time you change the appointment.
⚠ You will see this once the slot form arrives. Today the server accepts the rule – the interface in which you create and name slots individually comes with the calendar. Until then nothing changes for you.
- Regular
phase-5.055.066A mark for confirmator – and we ask before we write
Two things, and you will see the first straight away: confirmator has a mark. It sits to the left of the name and in your browser tab – a check on a calendar page.
Your business partners will notice the second one. We do not send anyone an unsolicited scheduling mail. Before the first invitation goes out, the address receives a short question: Would you like to arrange appointments online? Two buttons, nothing preselected, no account needed.
If someone says no, we stop writing to them – and you are told, so you can pick up the phone as before. If they say yes, you invite them as usual.
⚠ These questions are not being sent yet. The trigger is the first appointment dispatch, and that comes next.
- Regular
phase-5.055.065Forgot your password? You can now reset it yourself
Until today a forgotten password was a dead end: you would have had to write to us. From now on there is a “Forgot your password?” link next to the sign-in button.
You enter your email address, we send you a link, and you use it to set a new password. The link is valid for two hours – shorter than any other link we send, because this is the only one that replaces the password itself.
All open sessions are then ended, including on devices you are not holding right now. And you sign in afterwards as usual: with the new password and your second factor. We do not skip it – otherwise it would be worth a single intercepted email.
Two things that may surprise you, both deliberate: we do not tell you whether an address has an account – the answer is always the same, otherwise anyone could use this form to find out who our customers are. And a link requested earlier expires as soon as you request a new one: there should only ever be one key in circulation.
If you have set up a passkey you need none of this – simply sign in with it.
- Regular
phase-5.055.064You can now change your email address yourself
Your email address is your sign-in name and your way back into your account. That is why it can be changed from today – but only in a confirmed way, in three steps.
You request the change from your account, with your password. We then write to your current address: it says which address the change is meant to go to, and that is where you release it. Only afterwards do we ask the new address whether it belongs to you. It only takes effect once that is confirmed too.
If nothing arrives at your current address any more – changed company, mailbox gone – release the change with one of your recovery codes instead. That is what they are for.
And once the change is through, we write to your old address one more time. Even if it was you: that message is the reason you would notice if it had not been you.
- Regular
phase-5.055.062The confirmation email now actually arrives
Since yesterday you can create an account yourself – and we promised you a confirmation link. From today you actually receive it: by email, at the address you entered. Until now it got stuck inside the system.
The same applies to the sign-in code, if you have switched on two-step sign-in. It arrives by email, is valid for ten minutes and can be used once. We never ask you for it by phone, email or chat.
If the confirmation email does not arrive, there is no need to try a second address: you can have it sent again. And if the sign-in code cannot go out, we tell you so, rather than leaving you waiting for an email that is not on its way.
- Regular
phase-5.055.060Create your account yourself – and maintain it yourself
From now on you create your account yourself: you choose your plan, enter your details and receive a confirmation link at your address. The Free plan is included and costs nothing.
The form helps you fill it in rather than complaining afterwards: the postal code is checked against the country you selected — four digits in Switzerland, five in Germany — and the country dialling code is shown with the phone number.
And whatever you entered, you can correct at any time. Under Account you will find the same fields, filled in and ready to save. This matters especially if you came to us through an invitation: until now there were no details there at all, and you can now add them at your leisure.
Your email address is shown there for reference but cannot be changed yet. That will come later, and deliberately so: a change of address is confirmed to the previous address, so that nobody else can make it on your behalf.
- Correction
phase-5.055.053Your access link lasts one day longer
A small change with a clear cause: an appointment access link used to be valid until the end of the appointment plus 30 days. From now on it is 31 days.
The reason is not a new consideration but a tidied-up one: the same period appeared in several places in our system — and in one of them with a different number. You never saw that; for us it was a source of error. Now the same number applies everywhere: 31 days after the appointment ends — for the access link, for access to the record, and for your documents' recycle bin.
Links already issued keep the deadline recorded on them. Anyone receiving a new one today gets the extra day.
- Regular
phase-5.055.052The participant area is here: all your appointments in one place
Until now, as a participant you reached your appointment through the link in the invitation — one link per appointment, one email per invitation. Anyone sitting in audits at three companies had three emails to keep track of.
From now on you can sign in instead and see every appointment you are invited to in one list: title, time, time zone, and who invited you.
Important: the link stays. Anyone who does not want an account does not need one — accepting, declining and requesting a change still work without signing in. The account gives you no additional rights, only a place.
The planning status, the requests and the appointment report will follow in this area.
- Correction
phase-5.055.051When two windows are open, the page now says what happened
A small but irritating case: you have confirmator open in two windows — say your planning view and the operator area — and you switch companies in one of them. The other one then read “A technical error occurred”, and the “Try again” button did not help.
Nothing was actually broken. Your sign-in covers all areas together, and which company you are currently working in is recorded in one place — so the second window was suddenly working in a different company than the one it displayed. Instead of saying so, it reported an error that did not exist.
Now it says what actually happened, with a button that takes you back to the selection. If you belong to only one company, that button restores the previous state right away.
We found this while preparing the participant area — there it would have gone from an edge case to an everyday one.
- Improvement
phase-5.055.049We now verify that our safeguards actually hold
This time there is no new feature here, but something you will never see – and that is exactly why it belongs here.
What prompted it: Four days ago a review found a fault in the appointment overview. Paging quickly between two months could show you the appointments of the wrong month – and when switching between two companies, they would have been another company's appointments under your own name. It was fixed the same day. What we could not do was prove it, because these parts of the application had no automated tests.
What has changed: now they do. And we check them in the only way we consider honest: we deliberately break the safeguard and see whether the test notices. If it does not, the test is worthless – green or not.
What that turned up: the first test passed even though we had removed the safeguard entirely. So did a second attempt. Only the third one held it. Along the way we found another place nobody had checked, and two rules on the participant page that until now existed only on paper – among them the most important one: a brief outage on our side must never tell your participants „this link is invalid“. Anyone who reads that throws the invitation away.
A test that has only ever passed, without once being challenged, answers the question „is this checked?“ with yes – and that is worse than no test at all.
- Regular
phase-5.055.048You now decide what the access link shows
Until now the rules at the access link were fixed: an invitee saw their own session and nothing else. From now on you set this on the appointment itself.
What the link shows: their own session only, their own session with its participants, the whole day, or the whole plan. The smallest level stays the default. Whoever sets nothing gives nothing away.
Who may request changes: nobody, all invitees or specific people – and until when. With no date given, the appointment’s end applies; late requests are expressly allowed, because things get moved during an appointment too.
Two things stay as they are. Only signed-in people see names: a link proves access to a mailbox, not a person; without an account it stays at the number. And these settings can still be changed after the invitations went out. Title and times are locked by then, because your participants are holding them – what the link shows is in no invitation, and a view opened too far must be closable again.
- Regular
phase-5.055.047The appointment list in the Business Hub – and what is still open
Until now, signing in showed you your account and nothing else. From now on you see your appointments, month by month, and for each one its planning status: being planned, fully planned, under revision, confirmed or cancelled.
What stands next to it matters more than the status itself. Anyone waiting for confirmations reads “3 of 7” and still does not know what they are waiting for. So every open item is listed individually – with name, session, time and the date on which the question went out.
One line matters to us in particular: someone who was invited but has not been assigned to any session appears as a case of its own. That person cannot accept at all – showing them as someone who is keeping others waiting would put the blame on the one nobody asked.
All times are shown in the appointment’s time zone, and the zone is named.
- Regular
phase-5.055.046The Business Hub now has a sign-in
Until now,
business.confirmator.netonly carried a note saying this area was being built. From now on you can sign in there – with email and password and, if you have enabled it, with your second factor.If you used one of your recovery codes doing so, we tell you, and we name how many are left. Anyone who only notices that none remain when they need one is one emergency exit short.
What you see after signing in is still slim: your account, nothing else. Appointment planning is being built next. We would rather show an honestly empty page than one that looks finished.
- Regular
phase-5.055.045Requesting a change
Your answer to a time stands as soon as you have given it. If something changes afterwards, you no longer need to reach for the phone: below your answer there is now Request a change, with a field for what you would like.
The request goes to the planner. They decide – and until they have, your request is the one that counts. A second one cannot be sent in the meantime, and that is deliberate: sending the same wish three times does not make it more urgent, only harder to find.
Whether requests are possible, and until when, is set by the planner for each appointment. If none are provided, it says so – instead of a button that does nothing.
Late requests are expressly allowed. Even during the appointment things can still be moved or added; only afterwards is it over.
- Regular
phase-5.055.044Who else is there – as a number
Anyone opening an invitation through their link has so far only seen their own times. From now on the planner can decide how much the link shows beyond that: only your own time, your own time together with the other participants, all times of one day, or the complete schedule.
Whoever sets nothing gives nothing away – the default remains the smallest level.
Names are not shown there. A link proves that someone had access to a mailbox, no more: a forwarded mail, a security scanner or a colleague at the same screen is not the invited person. Without signing in you therefore see only the number per side – for example “3 from the audit team, 2 further invitees”. The names come with a free account and a personal sign-in.
Times you are not scheduled for appear without your answer status and without buttons. You are not being asked there – and it should not look as if you were.
- Correction
phase-5.055.043Four updates that never arrived
Between 09:35 and 14:00 we finished four changes – and none of them showed up on the server afterwards. The build of the visitor area failed every time at the same point.
The cause was not a fault in the program but in its packaging: the text files the pages take their wording from sat outside the area the build process gets to see at all. On the development machine they sit one level above and are found; in the finished image they were simply not there.
While fixing it, a second place turned up with the same problem, quietly: the service behind the pages could not find its shipped texts either – without a crash and without any outward sign. Both are fixed.
So that it does not happen again, a dedicated step now checks before every merge whether what an application reads is actually shipped with it.
- Regular
phase-5.055.042An answer, not a switch
Once you have accepted, declined or requested a change for one of your times, that answer stands. It can no longer be toggled back and forth.
That sounds like less and is worth more: an acceptance that can be withdrawn silently at any moment carries no planning. Anyone booking travel needs to be able to rely on it – and anyone who changes their mind should say so rather than do it quietly.
Nothing changes for your times that are still open: you answer those as before, each on its own.
And if your schedule is changed – a different time, a different day – that is a new question: you answer it again. What stands is your answer to what you were actually asked.
- Regular
phase-5.055.039Your appointment – one click, no account
Anyone invited to an appointment can now see it: the personal link from the email opens your overview – the appointment, your times, and three buttons for each of them: accept, request a change, decline.
No account. No password. No hunting through your inbox for the latest version.
You see exactly what concerns you: your own times and the information you were given – not other people’s planning. Times are shown in the appointment’s time zone, not yours: if you are due on site at eight, you read eight.
More is in preparation: anyone who wants to see the whole plan, download the report or request changes will be able to open a free account for that. It will never be required – answering an invitation works without one.
- Regular
phase-5.055.037One access per person – with a deadline and an off switch
Anyone invited to an appointment gets in without an account and without a password: through a personal link that works for them alone and for that one appointment.
The link stays valid until the appointment is over, and for 30 days after – long enough to read the log and the report at leisure. A deadline that expired before the audit would protect nobody; it would only lock out the one person the link was meant for.
In exchange, you can switch it off at any time. If someone is taken out of the appointment, that happens by itself. And a new link makes the old one invalid – there is only ever one.
So that a reminder never turns into pestering: at most one link per person every 24 hours – counted from the last send, and revoking one does not reset the clock. The overview shows you who has access, whether it has been used, and from when you may send again – the link itself nobody sees but the recipient.
- Regular
phase-5.055.036Confirmation rules – and a status everyone can see
You now decide per appointment when it counts as confirmed: when everyone agrees, when any one person agrees, when named people agree, when at least that many agree – or not at all, because agreeing is voluntary.
With several sessions the whole agreement counts: someone invited to four sessions who agrees to two has partly agreed – and it says so, instead of passing as done.
New is a status everyone involved can see: being planned, fully planned, under revision or confirmed. Each side knows whether the appointment goes ahead as planned or whether something is still missing from someone. Alongside it, the open points in plain words – who, which session, when they were asked.
And you keep the last word: if agreement comes over the phone, you enter it by hand. That it was you, and when, stays on the record.
- Regular
phase-5.055.033Participants and audit team – and nobody booked twice
Every appointment now has two circles of people: the participants on the client side – you invite an address, nobody needs an account for that – and the audit team on your side, with lead auditor and auditor. The function applies to this one engagement: whoever leads an audit today may be a team member on the next one, and the record will say so later.
Both can be assigned to individual sessions – and one rule applies: nobody can be in two sessions at the same time. Schedule someone into two parallel sessions and you hear about it right away, not on the audit day. This holds across appointments too: being scheduled into two audits on the same morning is just as much a double booking. Two sessions one after another are of course fine – that is the normal case.
Anyone taken off an appointment is not deleted but removed from the appointment: the record stays, so their earlier answers keep their author.
- Regular
phase-5.055.026An appointment can consist of several sessions – including parallel ones
An appointment is a frame here: an audit from 08:00 to 12:00 can contain one session from 08:00 to 11:00, a second from 08:00 to 10:00 with different people, and a third from 11:00 to 12:00. The first two run at the same time – that is exactly what sessions are for. If you are planning an ordinary appointment you will notice none of this: it has exactly one session, and we do not show it. The appointment's time span is computed from its sessions rather than maintained alongside them – so the two cannot drift apart.
- Regular
phase-5.055.020We store appointments with their time zone, not with an offset
An appointment is stored here as universal time plus the name of the time zone –
Europe/Zurich, not+01:00. The difference shows up on exactly two Sundays a year: a stored offset is wrong after the clocks change, and the appointment would sit an hour off. All-day appointments run from midnight to midnight in their own zone. And if you change your organisation's time zone, no existing appointment moves: each carries its own. - Regular
phase-5.055.018Legal notice and terms: every version stays on record
When we change the terms of use, the old version does not disappear – it stays stored, and your consent records which version you accepted. In a dispute what counts is not today's wording but the wording of that day. At the foot of every legal page you will find the number and the date. For a plain typo fix we do not ask you again – anyone asked three times for nothing stops reading the fourth time.
- Regular
phase-5.055.017The texts on this site can now be changed in production
Every sentence on this site lives in its own file and can be changed without a new release – in all four languages. A change only goes live once all four are at the same level: if a French text is missing, the German version does not go out either. That is inconvenient and deliberate – it stops a site that already says the new thing in one language and still the old one in another.
- Regular
phase-5.055.016Running the platform means signing in for it
Administering confirmator is a separate area that you switch into explicitly – just as you switch between two organisations. Entering it requires the second factor, without exception; if the account is blocked or the right is withdrawn, the area closes on the next click rather than at the next sign-in. And anyone without the right does not see it at all.
- Regular
phase-5.055.012Your own address for every account
Every organisation gets its own address of the form
identifier.business.confirmator.net, leading straight to its area. The identifier is drawn at random and says nothing about you – a speaking name would tell anyone reading the certificate logs who our customers are. After a deletion the address stays blocked for 90 days, so that an old link never ends up with somebody else. - Security
phase-5.055.009Strict separation between clients
Every query must state which organisation it applies to – otherwise it is rejected rather than quietly returning too much. That rules out the most common cause of data showing up under the wrong client: a forgotten filter, which nobody notices during development because it only bites with the second customer.
- Regular
phase-5.055.009Bringing colleagues into the team
Team members are invited by email: enter the address, choose the role – the person invited needs no account beforehand. With a personal line if you like, so the invitation reads as a message from a human being. A refusal is not final: you can invite again, at most once a day, so that it never turns into pestering.
- Regular
phase-5.055.004One login, several clients
Anyone working for several audit firms signs in once and switches between them without logging in again. Permission is checked afresh at every switch – and while you work: leaving a team removes access immediately, not at the next sign-in.
- Security
phase-5.055.002Sign-in with a passkey
Anyone who wants to can now sign in with face, fingerprint or device PIN – no password, in a single step. The key stays on the device and cannot be phished.
- Security
phase-5.055.001Sign-in with a second factor
The second factor is ready: anyone who wants to will be able to protect their account with a one-time code sent by e-mail. Ten recovery codes come with it, for the case where the mailbox cannot be reached. Both become usable when the service opens.
- Regular
phase-5.055.001Clearer price information
The cards now show CHF only; below them it says that invoicing in the EU is in EUR and that prices are net. Each plan also states how many business users it allows.
- Regular
phase-1.017.000The public site is live
Home page in four languages, legal texts, pricing overview and this page. The service behind it is running but not yet open.
- Regular
phase-1.017.000Operations set up
Server, certificates and abuse protection are in place. The application reports its own version – the number at the bottom of every page comes from the running system, not from a hand-kept list.