Product news ·
Clearer GRC, better-governed AI
RiskPilot's latest two batches strengthen everyday workflows: preparing decisions, tracking deadlines and sharing information while retaining control of business data.
AI prepares; people decide
The copilot applies stricter checks to structured provider responses: proposed actions, navigation paths, identifiers, scores and relationships with authorised records. Risk and compliance-action drafts are validated before being presented. An inconsistent response should not become a database write.
Pilot mode remains subject to permissions, organisation boundaries, consent and human confirmation. It does not autonomously modify registers without approval.
French and English business notifications
Thirteen business events now follow the recipient's language, including action assignments, approaching deadlines, risk reviews, acceptance decisions, compliance assessments and review campaigns. Dates and decisions are localised.
Deduplication distinguishes different actions and stays stable across language changes. Inactive recipients and users moved to another organisation are excluded before email publication.
Clearer email integration boundaries
SMTP, Gmail API and Microsoft Graph send email. OIDC concerns user identity: a discovery diagnostic does not activate SSO. Their configurations and secrets are not interchangeable.
Email OAuth requests have bounded network timeouts, reject redirects and validate returned tokens. Email settings use stricter input validation; callbacks prevent caching and referrer disclosure.
Private calendars and stronger Excel exports
iCalendar feeds include French and English labels, UTC creation and modification dates and identifiers distinct across instances. Events remain filtered by owner and organisation; unknown or revoked links are not cached.
XLSX exports correct XML structure, sanitise worksheet names and validate dimensions and cell types. Headers repeat when printing, and oversized text is explicitly rejected rather than silently truncated.
Validation and notification recovery
Relationships among risks, assets, controls and evidence have stricter limits. Action plans also validate costs, dates and evidence links. If publication fails, unpublished notifications return to a delayed queue after two minutes.
The demo is for discovery: do not upload sensitive data or real secrets.
Sources: calendars, exports and integrations; notifications and AI.