Changelog — latest update August 8, 2026

Your profile, password, sessions and connected identities now live in one account workspace rather than being scattered across settings.

Alongside it, OAuth account linking changed. When you sign in with Google or Microsoft, Oneop now matches you to an existing user by the identity provider’s own stable subject ID, not by email address alone. That means changing your email address at your IdP no longer risks stranding you from your account, and an email match on its own cannot silently attach a social login to someone else’s user record.

→ Security

Commit ce96c317.

The product, the logo system and the domain changed together. Everything the platform sends — the app UI, transactional email, and the synthesized Message-ID on outbound mail — now carries oneop.io.

Three follow-up commits over the same day sharpened the logomark, corrected how the tenant account name renders in the sidebar, and updated the outbound-mail header assertion so email threading stays intact across the change.

Commits 844e34db, 78ec36c1, 50bd56e8, 7daac2ae.

New workspaces no longer open on blank tables. Every major surface — CRM, Leads, Tasks, projects, Support, AI and Reports — now has a guided empty state that says what the screen is for and offers a first action.

Behind it sits a first-run wizard and an adoption checklist, plus optional sample data. The finance and inventory seeders are deliberately ledger-safe: sample transactions post through the same double-entry path as real ones rather than writing rows that would leave the books unbalanced.

Opt-in. The wizard, checklist and the finance and inventory sample data are each turned on separately. CRM, support and task sample data works with no setup.

→ Roadmap

Commits 454c9eac, ab314547, 0f4dd7fe, 00fd85c7, 07aadad3, b0d53e94, 6121bb8a, 5190417f.

This is Oneop’s own staff tooling, not a customer feature, and it matters for one reason: it governs what a support engineer can see when you ask for help.

Operator access moved from broad roles to 63 granular permission tokens, so an operator holds only the permissions their job needs. The console also gained API telemetry and an analytics suite, and plan-catalogue prices and AI routing were corrected in the same pass.

Impersonation rules are unchanged and remain strict: 30-minute default sessions with a two-hour hard ceiling, a 15-minute idle timeout, revocation that takes effect mid-session because the session is re-checked on every request, and hard blocks on billing, password, MFA, team-membership and destructive actions.

→ Security

Commits 145421ac, a938187e, a3303e9a, 08aee2fa, 9db1bc8f, 63451933, 79783393.

The client portal’s project page stopped being a summary and became a real view: overview, risks, team and status updates, each backed by real data rather than derived text. Your team authors all of it from a new Client tab inside the project.

The PM workspace also gained a settings tab covering payments, billing and rate entry, and the workspace pages — Goals, Documents, Templates, Intake, Rates and the project board — were rebuilt on the platform’s design system.

Opt-in. The portal is a separate switch on top of project management itself, so both have to be turned on.

Correction, 2026-08-09: true on the day, superseded since — project management and the client portal both ship enabled now. Left as written, because a changelog records its own date.

→ Project management

Commits 30a1d6cb, d3fdef8a, 6ef739c7, a3fda3cd, 7726c57e.

An internal full-platform audit produced a remediation pass, shipped as ten separate commits so each area could be reviewed and reverted independently. The substantive fixes:

• Finance — journal entries are now rejected if their date falls outside their own accounting period, and payment reconciliation became atomic.
• Inventory — a multi-warehouse adjustment now moves the global quantity by the per-warehouse delta, rather than overwriting it.
• Tax — the tax engine became authoritative for invoicing instead of advisory.
• Support — CSAT responses are ingested and scored from real submissions.
• Workflows — a durable scheduler and queue, so a restart mid-run does not lose work.
• CRM — lead deduplication and a real lifecycle state machine.
• Localisation — right-to-left correctness via logical CSS properties, and locale scoping before login.
• AI — injection hardening, and a credit refund when a model returns malformed JSON.
• Custom fields — the custom_fields column is now mapped on eight entity types that were silently dropping it.

Commits c191b755, f26d4284, 390180a3, 01f46cae, bafb7270, f1101920, 62f9dab6, a4cb6a7e, c8e844dd, 2a59ab7e, 1aa4b411, c7c99986, 8a218ca1, 3a0d567b, dd2e95ad.

Rich-text content submitted into the product is now sanitised by parsing the HTML and rebuilding it from an allowlist, rather than by matching patterns against the raw string. Pattern-based stripping is defeatable by construction; parser-based sanitisation is not defeatable the same way.

This closed a stored cross-site scripting path found during an internal audit. Oneop publishes its security fixes in the changelog rather than only in release notes, because a vendor that never publishes one is not a vendor that never had one.

→ Security

Commit 5a357edb.

Three things shipped together.

CSAT became a workspace. Four tabs — Overview, Responses, Recovery and Survey — with real NPS and CES columns, ticket-joined breakdowns, and detractor recovery cases that open automatically. Score drivers are a genuine metered AI pass over free-text comments, cached per tenant and window.

Support automation gained multi-step flows. Condition gates, branches, delays that truly pause via a persisted row and resume on a one-minute tick with crash recovery, human approval steps gated by role rank, and AI steps behind a confidence gate. There is also a dry-run simulator that shows the exact execution trace without writing anything.

Email got real per-user mailboxes. Connect Gmail or Microsoft 365 in one click over OAuth, or point at any SMTP/IMAP server. Credentials are encrypted, inbound mail is polled every minute, and replies thread back onto the deal. On by default.

→ Help desk

Commits 731f71f1, 38464a5a, f97cc852.

A full project-management module merged into the platform: projects and milestones created from a won deal, sprints with burndown and workload, goals and OKRs, project templates, public intake forms, rich-text project documents, and a read-only metered AI insights layer.

Two things make it more than a task board. First, work items run on the same task engine as the rest of the platform, so a project task and a CRM task are one object rather than two parallel systems. Second, tracked time converts into an invoice and posts as a real double-entry journal entry in the finance ledger — not a spreadsheet estimate.

The client portal that ships with it is a genuinely separate login principal: its own session cookie, its own signing secret, and a production boot that fails hard if the portal, tenant and operator secrets are not all distinct.

Opt-in, and every sub-surface — billing, the portal, AI insights, retainers, intake and role rates — is switched on independently.

Correction, 2026-08-09: that was accurate on the day this shipped, and is no longer. Project management now ships enabled in every workspace, along with its sub-surfaces. This entry is left as written because a changelog records what happened on its date; the current behaviour is on the project management page.

→ Project management · Security

Commits 74a1e171, 8ddaa269, a6fe7848, 5b50c732, 20a4826c, ed60784b, f80b1bbd, d6943035, d42461a8, 5235cc49, 7cac2ce0.

Every notification in Oneop now flows through a single service, and that choke point is what makes the behaviour predictable. It resolves recipients by permission rather than blasting every admin, honours per-user per-category preferences, collapses repeats inside a 60-second window into one counted row, suppresses notifying the person who caused the event, and lets critical events bypass mutes.

Delivery is a real-time WebSocket push to the bell with a 60-second polling fallback reconciled from the database, plus immediate email for critical items and an automatic 90-day purge. Twenty server modules produce into it.

An optional timezone-aware daily digest shipped alongside, switched on per workspace by the people who want it.

Commits 02742ccc, 6e7e94f5.

Tasks stopped being a CRM activity type and became a work engine any record can hang work off. A task attaches to any of twelve entity types — deal, contact, company, lead, ticket, invoice, bill, sales order, purchase order, inventory item, customer or project.

It supports subtasks, checklists, threaded comments with validated @mentions, watchers and dependencies. The dependency graph refuses to create a cycle rather than accepting one and hanging: a circular link returns a 422, blocked work is shown as blocked, and the owner is pinged the moment the blocker clears. Recurrence is real — daily, weekly on specific days, or monthly with an interval, an end date or a fixed count — and completing one occurrence mints the next without ever leaving two open copies. Every task carries an SLA clock with a 24-hour warning and three escalation levels.

On by default, with no plan gate.

Commits 08aaa98c, 38464a5a.

Eight UI locales reached complete translation coverage: Arabic, German, English, Spanish, French, Turkish, Urdu and Simplified Chinese, at between 7,724 and 8,637 keys each. Arabic and Urdu are full right-to-left.

The same pass closed two whole classes of bug rather than individual strings: hardcoded currency formatting, and pluralisation rules that assumed English. Both are now caught by a lint rule, so they cannot creep back in.

Right-to-left support reaches into invoice PDFs — an embedded Arabic typeface, a fully mirrored layout and locale-correct number formatting — not just the application UI.

Commit 21081f0c.

Four agents joined the workforce: a stock reorder suggester, a report narrator, a meeting assistant and an email auto-responder.

All four run through the same machinery as every other agent — the metered router, the same autonomy model of suggest, approve and autonomous, and the same hard per-run ceilings. Nothing here can dispatch a finance or stock action unless that capability has been switched on separately, regardless of the autonomy level set on the agent.

The auto-responder stays switched off until you ask for it, and when it is turned on it queues a draft for human approval rather than sending.

→ AI agents · AI governance

Commit 0858738e.

Outbound email can now leave from a tenant’s own verified sending domain, DKIM-signed at the SMTP layer with a key the platform generates and manages. The private key is encrypted with AES-256-GCM and is never returned by any API.

The important part is the failure mode. If the domain is not verified, or the DKIM key cannot be set up, the send is blocked — the lease is released and it is retried on the next tick. It is never sent unsigned. One domain per tenant, with an index that stops a second tenant claiming a domain already verified elsewhere.

Opt-in. It stays off until your workspace asks for it.

→ Roadmap

Commit 3341da19.

A large release across three areas.

Leads got a workspace: rule-based scoring that ships with fourteen sensible defaults so leads arrive ranked with no setup, live Apollo.io contact enrichment, CSV import, bulk actions and saved views.

Sequences shipped as multi-step outreach cadences mixing automated email, wait periods, call tasks, notes and conditional branches that read real signals — replied, opened, clicked. Emails send from each rep’s own mailbox. It stays switched off until a workspace asks for it. (Correction, 2026-08-09: sequences now ship enabled in every workspace, from the Starter entitlement up. Connecting a rep’s mailbox is still required before anything can send.)

The report engine landed as a cross-module platform: eleven module packs, 33 datasets, 68 prebuilt reports seeded per tenant, a custom builder with calculated columns, interactive dashboards, scheduled delivery, and export to CSV, XLSX and PDF with CSV output escaped against formula injection.

→ CRM · Reporting · Sequences

Commits 5cf5f653, 7fb022ab, 6863ce5f, d99b5652, 81f27cf2, 2fa006bd, caa2f5fb, 254c1ac4, 5346ac1c, e2594718, 105fb0c3, dce49f9c, 1671f1fc, 6848ff38.

SLA became real clocks rather than labels. Creating a ticket stamps a breach deadline from the newest active rule matching its priority; the first public agent reply stamps first-response time; resolving stamps time-to-resolution. Deadlines are computed in business minutes against each tenant’s own working days, daily window, timezone offset and holiday list. A five-minute sweep escalates breached tickets up a ladder — idempotently, so nothing double-escalates.

The chatbot node runtime started executing the flow graph properly, with AI responses running through the metered router rather than an unmetered path. Live chat persistence and WebSocket session authentication landed in the same window, along with canned responses, inbound threading and loop suppression on the support side.

→ Help desk · Chatbot

Commits 97e78991, 01e4f2bd, 914e3e1f, 14f74194, a796932f.