Changelog
What shipped, and what it cost
Phases rather than dates, because that is how this has been built. Each entry says what went wrong as well as what went out, because a changelog with no failures in it is a press release.
- In progressPhase 5
The front door, and finishing what existed
- A public marketing site. Until now the root of the site was a signed-in operations screen and no stranger could read anything.
- A real settings screen over a settings engine that had been complete for two phases: reminder cadence, default expiry, retention.
- Delete, trash and restore, wired to services that had been tested and unreachable.
- Rename and tag editing on the document itself.
- Departments, which had been a database column and a search filter with nothing able to write a value.
- The board moved from / to /board so the front door could exist.
- A filterable audit trail with CSV and PDF export, and a verdict in plain English rather than a two-word badge.
- org_events: a separate append-only log for organization-level facts, because the document chain’s gapless sequence only means something at document scope.
- The bounce webhook, so the “email bounced” flag is real rather than decorative, and a bounce now also clears the recipient’s asked-to-act timestamp.
- Erasure that preserves the audit chain, and reports honestly what it cannot remove from it.
- A backup restore rehearsal that re-verifies hash chains against the restored copy, because a backup nobody has restored is not a backup.
- A bundle budget and a Lighthouse gate. The first Lighthouse run found that every primary button in the product had failing colour contrast.
What this cost us
Three things nobody had noticed. Seven cache-invalidation calls were naming the board’s old path. The full test suite had been unable to pass in one run since Phase 4, because undrained background jobs accumulated between runs. And running Lighthouse for the first time showed white-on-orange primary buttons at 2.95:1 contrast, below even the threshold for large text, on every screen, since Phase 1.
- ShippedPhase 4
Isolation, limits, retention, proven at a million documents
- Row-level security on every table holding customer data, with the bypass moved to a separate database role that the application cannot assume.
- A test suite that asks the permission layer for another tenant’s document, gets a yes, and asserts the database refuses anyway.
- Composite foreign keys, so a record cannot be attached across a tenant boundary.
- Rate limits and quotas on every action a stranger can trigger, each with its reasoning written next to the number.
- Retention: a per-organization window, then permanent destruction with a tombstone that keeps the history and the hashes.
- A one-million-document benchmark across multiple organizations.
What this cost us
Nine of thirteen performance budgets failed the first time the benchmark ran at a million rows. Two causes: an OR in every security policy that no index could satisfy (4,498 ms against 12 ms), and ten indexes built with the wrong null ordering, which the planner silently discarded (3,753 ms against 12 ms). Neither was visible in the schema, the query, or a code review.
- ShippedPhase 3
Finding things, and talking about them
- Full-text search across titles, tags and the extracted text of every document, weighted and typo-tolerant.
- Filters and saved views, all held in the URL so a search is a link.
- Comments, with a real distinction between internal notes and what a recipient can see.
- Templates for recurring workflows.
- Board metrics: cycle time, throughput, and whether either is improving.
- Version history on every document.
- ShippedPhase 2
Sending and signing
- The send flow, benchmarked in the test suite at under thirty seconds and five clicks.
- Signing with no account: a single-use link, a drawn or typed signature, on a phone.
- Sequential and parallel routing from one integer, with approvers and copied-in recipients.
- Reminders on a cadence, and one-click nudges.
- Flattening and the certificate page, appended to the signed PDF.
- Decline and cancel, each halting the workflow and notifying only the people already involved.
What this cost us
The signing page is the one screen promised to work one-handed on a phone, so it is tested on real WebKit at an iPhone viewport rather than on a desktop browser pretending to be small.
- ShippedPhase 1
The foundation
- Organizations, invitations, and four roles with no permission matrix.
- Passwordless sign-in with a six-digit code.
- PDF upload with real validation and specific, readable refusals.
- The hash-chained, append-only event log, made immutable by database triggers rather than by permissions.
- The board.
- PlannedNext
What we are building after this
- A preparation canvas: drag a signature field onto page seven of a forty-page PDF, per recipient. The appended signature page stays the default fast path.
- Public self-serve signing links, for volunteer waivers and policy acknowledgments.
- A public API with keys and scopes, outbound webhooks, and embedded signing.
Send your first document today
Sign in with your email. We send a six-digit code, there is no password to invent. Name your organization, and you are on the board.
Start free150 documents a year free for nonprofits. No credit card to start.