> ## Documentation Index
> Fetch the complete documentation index at: https://help.propops.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> A chronological record of significant improvements, new features, bug fixes, and platform hardening delivered to PropOps Web.

<Update label="13 April 2026" description="Trial account badges, reauthentication improvements, PII key rotation, and dashboard enhancements.">
  ## New features

  <AccordionGroup>
    <Accordion title="Trial account badge on dashboard">
      The dashboard now displays a trial account badge when applicable, controlled by your role permissions. This gives administrators clear visibility into which accounts are operating under a trial licence.
    </Accordion>

    <Accordion title="PII encryption key rotation">
      Administrators can now rotate PII encryption keys without downtime. The platform re-encrypts all protected fields in place, keeping your data secure while meeting key management best practices under UK GDPR. Learn more on the [GDPR compliance page](https://help.propops.app/security/gdpr).
    </Accordion>

    <Accordion title="Automated archive purge with configurable retention">
      Archived job documents are now automatically purged once they exceed your configured GDPR data retention period. This keeps storage clean and ensures you stay compliant without manual housekeeping. See the [GDPR compliance page](https://help.propops.app/security/gdpr) for details.
    </Accordion>

    <Accordion title="Improved GDPR report generation">
      GDPR data subject reports now include only relevant case notes and activity logs scoped to the specific tenant, and are encrypted at rest. The report layout has been updated for clarity, with new sections covering purpose and scope in line with UK GDPR requirements.
    </Accordion>
  </AccordionGroup>

  ***

  ## Updates

  <AccordionGroup>
    <Accordion title="Reauthentication form improvements">
      The reauthentication prompt now includes a password visibility toggle for easier entry, along with additional anti-bot protections to strengthen security during sensitive actions.
    </Accordion>

    <Accordion title="Richer jobs-by-type dashboard widget">
      The jobs-by-type widget on the dashboard now displays additional details including the assigned agent, contractor, and job creator, making it easier to triage work at a glance. See the [dashboard overview](https://help.propops.app/analytics/dashboard).
    </Accordion>

    <Accordion title="Enhanced audit logging">
      Audit logs now capture failed reauthentication attempts, guard activity, and document approval events, giving administrators a more complete picture of platform activity. See the [audit log page](https://help.propops.app/security/audit-log).
    </Accordion>

    <Accordion title="Data cleanup now covers case notes">
      The automated data cleanup process has been extended to include orphaned case notes, improving data hygiene and reducing unnecessary storage usage.
    </Accordion>

    <Accordion title="AI features removed from financial reports">
      The experimental AI-assisted analysis in financial reports has been removed. Financial reports continue to work as before, now without the AI badge and related controls, for a cleaner and more focused reporting experience. See the [financial features page](https://help.propops.app/features/financial).
    </Accordion>
  </AccordionGroup>

  ***

  ## Bug fixes

  <AccordionGroup>
    <Accordion title="Fixed rendering issue in email and IP verification views">
      Resolved an incomplete script tag that could cause display issues on the email verification and IP verification pages.
    </Accordion>

    <Accordion title="Stale IP verification records cleaned up during login">
      Unsent IP verification PIN records are now automatically removed during the login process, preventing stale records from accumulating and potentially causing verification delays.
    </Accordion>
  </AccordionGroup>
</Update>

<Update label="9 April 2026" description="New email templates, brand management improvements, API error handling, and bug fixes.">
  ## New features

  <AccordionGroup>
    <Accordion title="17 new email notification templates">
      PropOps now includes a broader set of branded email notifications covering onboarding reminders, password breach alerts, password reset and change confirmations, payment updates, quote-ready notices, user lifecycle events (created, deleted, blacklisted, role changed, status changed), video processing updates, and webhook security alerts. All templates follow the same clean, branded layout as existing emails. See the full list on the [email system page](https://help.propops.app/features/email).
    </Accordion>

    <Accordion title="Production Docker image publishing">
      Self-hosted deployments can now pull a pre-built production Docker image directly, removing the need to build containers locally. This simplifies new installations and ensures every deployment starts from a verified, consistent image. See the [Docker setup guide](https://help.propops.app/installation/docker-setup) for details.
    </Accordion>

    <Accordion title="Improved API error responses">
      API requests that hit an unauthorised or not-found route now return structured JSON error responses instead of generic HTML pages. This makes it easier for integrations to handle errors programmatically.
    </Accordion>
  </AccordionGroup>

  ***

  ## Updates

  <AccordionGroup>
    <Accordion title="Brand management: smarter logo contrast handling">
      The sidebar and layout now automatically adjust text colour based on your uploaded logo's contrast, so light logos display correctly on dark backgrounds and vice versa. No manual tweaking required. Learn more in the [brand management guide](https://help.propops.app/guides/brand-management).
    </Accordion>

    <Accordion title="Configurable email sender name and address">
      You can now set a custom "from" name and email address for all outbound emails, giving recipients a clearer indication of who the message is from. See the [email configuration guide](https://help.propops.app/guides/email-configuration).
    </Accordion>

    <Accordion title="Improved authentication error handling">
      Authentication failures now produce clearer, more structured log entries, making it easier for administrators to diagnose login issues.
    </Accordion>

    <Accordion title="Code quality and performance improvements">
      Cleaned up unused code, optimised tenant detail filtering, simplified attachment file type handling, and improved overall code consistency across the platform.
    </Accordion>
  </AccordionGroup>

  ***

  ## Bug fixes

  <AccordionGroup>
    <Accordion title="Security report now correctly displays personal information">
      Fixed an issue where encrypted personal information was not being decrypted in security report API responses, causing some fields to appear as unreadable text.
    </Accordion>

    <Accordion title="Duration text pluralisation corrected">
      Fixed a display issue where durations showed "1 days" instead of "1 day".
    </Accordion>
  </AccordionGroup>
</Update>

<Update label="6 April 2026" description="Permissions export/import, Docker improvements, and a downloadable permissions template.">
  ## New features

  <AccordionGroup>
    <Accordion title="Export and import permissions">
      You can now export your full permission configuration — every role and account type — as a JSON file, and import it back on another instance or environment. This makes it straightforward to back up your permission setup, transfer settings between staging and production, or audit your configuration offline. Find it under **Admin → Settings → Permissions** using the new **Export** and **Import** buttons in the toolbar. See the [user management guide](/guides/user-management) and [permissions template reference](/permissions/permissions-template) for details.
    </Accordion>

    <Accordion title="Downloadable default permissions template">
      A default permissions template is now available covering all 551 permission keys across five roles and two account types. Use it to bootstrap a new installation, restore defaults, or review the complete permission structure. Download it from the [permissions template page](/permissions/permissions-template).
    </Accordion>
  </AccordionGroup>

  ***

  ## Updates

  <AccordionGroup>
    <Accordion title="Improved Docker setup for self-hosted deployments">
      The Docker configuration now includes an entrypoint script that automatically creates required directories (uploads, extensions) with correct ownership and permissions on first boot. This reduces manual setup steps for new self-hosted installations. See the [self-hosting guide](/self-hosting) for the updated instructions.
    </Accordion>

    <Accordion title="Dependency updates">
      Updated `lodash` to 4.18.1 and `@xmldom/xmldom` to 0.8.12, addressing minor security and compatibility improvements.
    </Accordion>
  </AccordionGroup>
</Update>

<Update label="5 April 2026 — Release 2026.04" description="Security hardening, job lifecycle enhancements, and infrastructure improvements.">
  ## Security Hardening

  <AccordionGroup>
    <Accordion title="Encryption at rest extended to all core data entities">
      Strengthened data protection controls with comprehensive encryption-at-rest coverage across all core platform entities, ensuring alignment with UK GDPR, the Data Protection Act 2018, and ISO 27001 obligations.
    </Accordion>

    <Accordion title="Data protection controls applied to additional API endpoints">
      Extended consistent data protection handling to a broader set of API endpoints, ensuring personally identifiable information is handled uniformly across the entire platform surface.
    </Accordion>

    <Accordion title="Data protection applied to activity logs and system communications">
      Applied data protection controls to user activity logs, email logs, and system communications, reinforcing the platform's GDPR compliance posture and reducing the risk of inadvertent PII exposure in operational records.
    </Accordion>

    <Accordion title="Statutory data retention policy enforced for job records">
      Updated the data retention schedule for job records to align with UK statutory requirements. The previous short-term expiry window has been replaced with a retention period consistent with financial and property regulation obligations.
    </Accordion>

    <Accordion title="Secure contact retrieval in property search">
      Enhanced the property and job search capability to support the secure retrieval of contact information, ensuring data protection controls remain active during search operations without degrading query performance.
    </Accordion>

    <Accordion title="Release artefact integrity verification introduced">
      Introduced automated checksum generation for all release artefacts, enabling independent verification of deployment package integrity prior to installation. This provides an additional assurance layer for self-hosted deployments.
    </Accordion>

    <Accordion title="Resolved serialisation issue in HTTP error response logging">
      Corrected a serialisation defect in error response logging that affected the integrity of log records produced by authentication and access-control error paths. Log output now consistently reflects the structured format expected by downstream monitoring tooling.
    </Accordion>
  </AccordionGroup>

  ***

  ## Features

  <AccordionGroup>
    <Accordion title="Job archiving with read-only enforcement">
      Introduced a comprehensive job archiving capability, enabling organisations to transition completed jobs to a permanent read-only archive state. Archived jobs retain their full history, audit trail, and attachments and remain fully searchable, but cannot be modified or reopened outside of a formal recall process.
    </Accordion>

    <Accordion title="Automated reconciliation of orphaned records during archiving">
      Enhanced the job archive and purge utility to automatically identify and remove orphaned address and tenant records that become disassociated following bulk archiving operations. This maintains referential integrity across the data model and eliminates the need for manual database housekeeping.
    </Accordion>

    <Accordion title="Dark mode design system extended">
      Extended the platform design system with additional colour tokens for dark mode interfaces, improving visual consistency and accessibility across low-light display variants on all supported devices.
    </Accordion>

    <Accordion title="Stale branch reporting workflow">
      Introduced an automated workflow that identifies and reports inactive repository branches on a scheduled basis, supporting repository hygiene and reducing the long-term maintenance burden for engineering teams.
    </Accordion>
  </AccordionGroup>

  ***

  ## Performance

  <AccordionGroup>
    <Accordion title="Container base image upgraded to PHP 8.5">
      Upgraded the container base image to PHP 8.5, delivering runtime performance improvements and extended security patch coverage. All self-hosted deployments should update to the latest image to benefit from these improvements.
    </Accordion>

    <Accordion title="Staging deployment workflow hardened against configuration drift">
      Corrected the staging deployment workflow to preserve Docker configuration files during release operations, preventing configuration drift between staging and production environments.
    </Accordion>

    <Accordion title="Database schema rationalised">
      Removed deprecated schema structures and consolidated legacy data definitions to reduce schema complexity, improve query planning, and lower the overhead associated with database migrations.
    </Accordion>

    <Accordion title="Broad code quality improvements applied">
      Applied a structured programme of code quality improvements across the platform, addressing technical debt, improving internal consistency, and reducing long-term maintenance overhead.
    </Accordion>
  </AccordionGroup>
</Update>

<Update label="31 March 2026 — Release 2026.03.4" description="PII encryption enhancements, compliance documentation, and API security improvements.">
  ## Security & Compliance

  <AccordionGroup>
    <Accordion title="Comprehensive PII encryption across all API endpoints">
      Implemented end-to-end PII encryption at rest and in transit across all core API endpoints. Sensitive fields including names, contact details, and addresses are now consistently encrypted and decrypted with appropriate access controls in place.
    </Accordion>

    <Accordion title="Enhanced job search with encrypted field lookups">
      Upgraded the job and property search functionality to support lookups across encrypted fields without exposing raw PII in query results, maintaining both performance and data protection compliance.
    </Accordion>

    <Accordion title="COMPLIANCE-REPORT.md published covering UK GDPR, ISO 27001, Cyber Essentials, PECR, and property regulations">
      Added a formal compliance report covering the platform's adherence to UK GDPR, ISO 27001, Cyber Essentials, the Privacy and Electronic Communications Regulations (PECR), UK property regulations, and VAT obligations.
    </Accordion>

    <Accordion title="API endpoint documentation updated for consistency">
      Updated API endpoint path references throughout the README and developer documentation to reflect the current routing structure, eliminating stale references that could mislead integrations.
    </Accordion>
  </AccordionGroup>
</Update>

<Update label="26 March 2026 — Release 2026.03.3" description="Maintenance mode, PWA enhancements, brand management, and API access controls.">
  ## Features

  <AccordionGroup>
    <Accordion title="Maintenance mode system implemented">
      Introduced a full maintenance mode API and frontend integration, allowing administrators to take the platform offline for scheduled maintenance with configurable user-facing messaging and role-based bypass controls.
    </Accordion>

    <Accordion title="Progressive Web App (PWA) service worker enhanced">
      Improved service worker registration with timeout handling and an enhanced caching strategy, increasing PWA reliability and offline capability across supported devices.
    </Accordion>

    <Accordion title="Brand management enhancements">
      Updated the brand management system to support custom login page slides and background images, enforce file type restrictions from environment configuration, and allow application logo uploads as SVG files. Login and forgot-password pages now use locally hosted images for improved performance and consistency.
    </Accordion>

    <Accordion title="Default avatar SVG serving introduced">
      Implemented a dedicated API endpoint to serve default avatars as inline SVGs, simplifying error handling and eliminating broken image states across user profiles and listings.
    </Accordion>

    <Accordion title="Session location map on security dashboard">
      Added an interactive session location map to the security dashboard, powered by Mapbox, providing administrators with a real-time visual overview of active session geography.
    </Accordion>

    <Accordion title="SecOps chiplets for security dashboard">
      Introduced SecOps summary chiplets to the security dashboard, surfacing key operational security metrics including recent file uploads, accessed files counts, and system health indicators with fade-in navigation effects.
    </Accordion>

    <Accordion title="Document selection dropdown and document inspector enhanced">
      Improved the document management interface with a new selection dropdown and an enhanced document inspector view for faster document review workflows.
    </Accordion>
  </AccordionGroup>

  ***

  ## API

  <AccordionGroup>
    <Accordion title="API access control checks implemented across all endpoints">
      Applied consistent API access and permission checks to all platform endpoints, ensuring that authentication and authorisation validation is enforced uniformly regardless of the request path.
    </Accordion>

    <Accordion title="Health check endpoint added to all APIs">
      Added a `/health` endpoint to all API modules, enabling infrastructure monitoring tools to verify service availability independently of business logic.
    </Accordion>

    <Accordion title="API logging and testing framework enhanced">
      Improved structured logging across API endpoints and expanded the internal testing framework to cover authentication flows, access control edge cases, and response format validation.
    </Accordion>
  </AccordionGroup>

  ***

  ## Infrastructure

  <AccordionGroup>
    <Accordion title="Protect-source workflow enhanced">
      Updated the branch protection workflow to block merges from staging and production branches into main, providing automated feedback to contributors when a blocked merge is attempted.
    </Accordion>

    <Accordion title="Dependency updates">
      Updated the `yaml` package from 2.8.2 to 2.8.3 and updated `picomatch` to address minor security and compatibility improvements.
    </Accordion>

    <Accordion title="PHPUnit configuration added for API testing">
      Added a PHPUnit configuration file to standardise the automated testing setup for API endpoints, enabling consistent test execution across development and CI environments.
    </Accordion>
  </AccordionGroup>
</Update>

<Update label="25 March 2026 — Release 2026.03.2" description="Security dashboard improvements, document management, and cleanup of deprecated functionality.">
  ## Features

  <AccordionGroup>
    <Accordion title="Security dashboard layout improvements">
      Enhanced the security dashboard with improved responsiveness, refined styling, and better layout for monitoring panels on all screen sizes.
    </Accordion>

    <Accordion title="Recent uploads and accessed files count in security report">
      Extended the security report to surface the count of recently uploaded files and most recently accessed files, giving administrators greater visibility into file activity.
    </Accordion>

    <Accordion title="Legal document DPO and document management columns added">
      Added new database columns to the legal documents table to support Data Protection Officer (DPO) assignment and enhanced document lifecycle management.
    </Accordion>
  </AccordionGroup>

  ***

  ## Maintenance

  <AccordionGroup>
    <Accordion title="Deprecated settings, database backups, and obsolete scripts removed">
      Removed the settings group backup mechanism, old database backup files, and obsolete scripts and views related to the legacy background image system and the deprecated recall jobs feature, reducing codebase complexity.
    </Accordion>

    <Accordion title="Logout process enhanced with improved cache clearing">
      Refactored the logout flow to perform comprehensive cache clearing and improved session teardown, preventing residual session data from persisting after a user signs out.
    </Accordion>

    <Accordion title="Sidebar handling simplified">
      Simplified the sidebar navigation logic and removed the deprecated icon-only mode, reducing rendering complexity and improving sidebar performance across all screen sizes.
    </Accordion>

    <Accordion title="Code structure refactored for readability">
      Applied broad code structure improvements across multiple modules, improving internal consistency, reducing cyclomatic complexity, and easing future maintenance.
    </Accordion>
  </AccordionGroup>
</Update>

<Update label="27 March 2026 — Release 2026.03.1" description="Dark mode CSS utilities and stale branch automation.">
  ## Features

  <AccordionGroup>
    <Accordion title="Dark mode text colour utilities added">
      Added new CSS utility classes for dark mode text colours, extending the design system with improved visual consistency and accessibility across all dark mode views on supported devices.
    </Accordion>

    <Accordion title="Git repository hygiene workflow">
      Added a scheduled GitHub Actions workflow to automatically identify and report stale branches, reducing repository noise and supporting long-term maintainability for the engineering team.
    </Accordion>
  </AccordionGroup>
</Update>

<Update label="18 September 2025 — Release 2025.09.3" description="User activity tracking, notifications system, contractor trades, and online status.">
  ## Features

  <AccordionGroup>
    <Accordion title="Comprehensive user activity tracking system">
      Implemented a full user activity tracking system with detailed logging for page visits, link clicks, button interactions, and form activity. Includes a backend API, a frontend tracking class, database schema updates, and an enhanced activity log display with pagination.
    </Accordion>

    <Accordion title="UUID-based profile routing">
      Updated user profile routing to use UUID-based URLs for improved privacy and security. Added UUID validation for URL and GET parameters, and ensured staff permission controls are enforced for profile access.
    </Accordion>

    <Accordion title="Notification system with user data integration">
      Overhauled the notifications system to integrate user data, improved rendering logic, and added comprehensive notification management including deletion functionality. Introduced a dedicated user avatar API and enhanced notification dropdown and footer action separation.
    </Accordion>

    <Accordion title="Contractor trades and certification management">
      Added a Trades & Certifications demo page with a searchable selection system. Enhanced the contractor trades API with improved assignment status handling and introduced a trades manager interface for assigning and managing trade certifications.
    </Accordion>

    <Accordion title="Online status system with real-time updates">
      Implemented a real-time online status system with activity tracking, enabling staff and tenant views to reflect user presence in real time.
    </Accordion>

    <Accordion title="Avatar management and upload functionality">
      Introduced full avatar upload and removal functionality with improved error handling and JSON response management. Refactored avatar storage to use a UUID-based directory structure. Avatar URLs are now protected from direct access via session-based authentication.
    </Accordion>
  </AccordionGroup>
</Update>

<Update label="17 September 2025 — Release 2025.09.2" description="Profile system, agent and contractor views, and authentication improvements.">
  ## Features

  <AccordionGroup>
    <Accordion title="Comprehensive profile system">
      Implemented staff and tenant profile sections with role-specific details, dashboards, and recent activity feeds. Consolidated profile form fields, improved layout, and enhanced accessibility. Added functionality for staff to update email addresses and set email notification preferences.
    </Accordion>

    <Accordion title="Agent and contractor profile views">
      Enhanced agent and contractor profile views with Flowbite components, read-only view support, and role-specific data display.
    </Accordion>

    <Accordion title="Email verification system">
      Implemented a full email verification flow with activation token generation, account status checking, and a resend activation email capability. Updated login and activation pages to integrate with the new verification workflow.
    </Accordion>

    <Accordion title="Admin impersonation (view-as) functionality">
      Added admin impersonation capability allowing support staff to view the platform as a specific user for debugging and support purposes, with account type filtering and status management controls.
    </Accordion>
  </AccordionGroup>
</Update>

<Update label="16 September 2025 — Release 2025.09.1" description="Project foundations: deployment, routing, database, and authentication.">
  ## Infrastructure

  <AccordionGroup>
    <Accordion title="GitHub Actions deployment workflow established">
      Implemented GitHub Actions workflows for automated deployments to staging and production environments, including PHP syntax checks, manual approval gates for production, and Plesk integration for deployment status tracking and notifications.
    </Accordion>

    <Accordion title="Clean URL routing implemented">
      Added a Router helper class and updated `.htaccess` to support clean URL routing across the platform, improving URL readability and enabling structured route definitions with authentication checks.
    </Accordion>

    <Accordion title="Database schema and models established">
      Created the initial database schema with comprehensive table definitions for user management, job tracking, financial records, notifications, and compliance data. Added migration scripts and PDO-based connection handling.
    </Accordion>

    <Accordion title="Automated production cleanup workflow">
      Implemented a GitHub Actions workflow to automatically remove all development-only files during production merges, ensuring clean production deployments without manually curated exclusion lists.
    </Accordion>

    <Accordion title="Comprehensive database backup system">
      Added a database backup system with scheduled and on-demand backup capabilities, supporting operational continuity and disaster recovery for self-hosted deployments.
    </Accordion>
  </AccordionGroup>

  ***

  ## Features

  <AccordionGroup>
    <Accordion title="Authentication system">
      Implemented the core authentication system including session management, role-based access control, and secure logout with comprehensive session teardown and cache clearing.
    </Accordion>

    <Accordion title="Shared dashboard with role-based rendering">
      Built a shared dashboard with dynamic content rendering based on user roles, delivering a consistent entry point experience for staff, tenants, landlords, and contractors.
    </Accordion>

    <Accordion title="Theme configuration and dynamic theming">
      Added theme configuration with helper functions to support dynamic theming across the platform, enabling per-branch or per-tenant visual customisation.
    </Accordion>

    <Accordion title="Project initialised with Tailwind CSS, Flowbite, and PHP components">
      Established the frontend foundation using Tailwind CSS and Flowbite, with a PHP component architecture, email service integration via the Brevo API, and a BaseLayout class with shared SVG icon support.
    </Accordion>
  </AccordionGroup>
</Update>