Development

Reopening a closed project makes it an open one again – so the same limit as for a new project now applies to it. 🔒 Before, the limit could be worked around: close a project, create a new one, reopen the old one. ℹ️ Once the limit is reached, the message states both numbers and the way out, just as when creating – and anyone who crosses 80 % this way gets the same notice.

When 80 % of a limit is in use, the start page tells you – and the owners receive an email. ✨ Below the line it says what happens once the limit is reached and what you can do: close whatever no longer needs to be open, or move to a larger plan. Once the limit is reached, it also says how to go on. ℹ️ The email comes once – at the step that crosses the threshold, not at every step after it. If your business drops below again and then rises above it once more, it comes again. An unlimited plan has no such notice.

If your business moves to a cheaper plan, the change takes effect at the end of the paid term – not partway through. Until then you keep what you paid for. ✉️ One day before, the owners receive a reminder with the date and the limits of the new plan. 🛡️ The change only happens if your business is within the new limits on that day; otherwise the current plan stays. A change never interrupts running projects.

After signing in you see your plan with its annual price and term – and, for each limit, how much of it is in use. ✨ Open projects and seats taken are shown as a number and as a bar, together with how long your documents are kept. ℹ️ The number you see is the same one the decision is based on – there is no second count that could work it out differently. On an unlimited plan, “unlimited” appears instead of a number.

Your plan sets how many projects can be open at the same time and how many people belong to your business. ✨ Once a limit is reached, no further project can be created and no one else can be invited – the message states both numbers and the way out: close a project or move to a larger plan. 🛡️ Running projects always carry on. Requests, uploads, reviews and deadlines stay usable, and whoever delivers documents to you notices nothing of your plan. ℹ️ A pending invitation holds its seat until it is accepted or expires; an expired one frees it again.

Every action in a project leaves a line in the history – and that line is no longer lost when something fails at the wrong moment. 🔒 Before, a line could be missing: the action itself was recorded, writing the history entry failed, and a second attempt no longer helped – the action had already happened. ✨ Now the action notes its own history line in the same step in which it is recorded, and a follow-up run adds it. It appears within a few minutes at the latest. ℹ️ Nothing is ever written twice: every line carries a marker, and what is already recorded is not written again. 🛡️ And a line is never created for something that did not happen – a gap that closes itself is better than an entry that claims something.

🛡️ A cancelled step is gone for a guest with a restricted view – even if it had been released to them explicitly before. 🔒 This is decided when displaying, not only when cancelling. Cancelling a step takes two moves: switching the step and clearing the releases that go with it. If the second one got stuck, the cancelled step stayed in the guest view. ✨ Now the view asks for the status itself – for guests a cancelled step is gone, whatever happened during cancelling. ℹ️ Nothing changes for you: in your own view cancelled steps remain visible, so you can retrace what was called off.

A closed project can now be deleted – with everything attached to it. 📄 The confirmation first shows you exactly what disappears: how many documents, requests, steps, permissions and log lines. Those figures come from the very place that then deletes – not from whatever happens to be on screen. Only the second click carries it out. 🔒 The contents go first. For every document the keys are removed and the encrypted content is cleared at the storage service; after that nobody can open it any more, you included. 🛡️ A running project is not deleted. Close it first, or set it to “cancelled” if it is being called off – otherwise participants are working towards deadlines that no longer exist. ✨ Download the project report beforehand. It cannot be obtained here afterwards; copies you have sent stay with their recipients.

Every project now has a report you can download. It records when which documents were requested, with which deadlines, when and by whom they were submitted and how they were assessed – the whole course of events in one report, not today's state. 📄 You send a copy to a participant with a second button, and only with it: as long as you do not press it, nothing goes out. You decide that anew for each report and separately for each recipient. 🌍 The recipient receives their sheet in their own language, containing the general events of the project and the entries that concern them – not what went on between you and other participants. 🔒 The report contains none of the content of your documents. That is not a gap, it is the promise of this tool: we cannot read your files. The report carries what happened and when, and nothing else.

Your project list now has a search box and a filter by status above it. Anyone running twenty projects has been scrolling until now. 📄 The search covers project number, name and description – the number first, because that is what you have in hand from an email or a receipt. Upper and lower case make no difference, and neither do accents: type `zurich` and you find «Audit Zürich». Several words may appear in any order. 🔒 The search runs in your browser – no request goes out for it. Above the list you can see how many of how many projects you are currently looking at, so an active filter never goes unnoticed. If the search finds nothing, the page says exactly that – and not that you have no projects.

Whoever requests documents from you can now state which language you are written to in. Until now every email to a contact went out in the default language – including to a recipient in French- or Italian-speaking Switzerland. 📄 When a contact is added there is now a «Language» field with the tool’s four languages. If none is chosen, nothing changes; the entry is optional and can be added later at any time. 🔒 The language belongs to the person, not to the individual request: if it is corrected, the reminders already scheduled go out in the new one as well – and so does the notice about a withdrawal.

When a company puts something to you for a response, you can now answer it — with one click. Until now the link from the e-mail only let you upload something. Where the company asks for your consent, there are now two buttons: accept or reject. No reason is required; if you have nothing to say, you need not write anything. 📄 Where the company has allowed a counter-proposal, you may attach a document of your own to your rejection — it is encrypted in your browser before it leaves this computer, like everything else. 🔒 Your response and the counter-proposal go out together and cost one attempt, not two. What you answered is shown on the page afterwards — *someone who cannot see that their statement arrived will send it again.* As long as attempts remain, you may change your response.

This page said that we cannot read your files either – without making a distinction that exists. For documents your counterpart delivers, everything stays as described: the key is created in their browser and never reaches us. 🔒 When you provide something yourself, the key travels in the link to the recipient. So that the email can be built, it passes through our server once – and is stored nowhere: not on the record, not in the log, not in an error message. A test harness inspects every output of that path and holds us to it instead of asserting it. *A promise that holds for one direction and not the other is not a promise but an interpretation* – which is why it now reads «we never store it» instead of «we never receive it».

If you keep coming back to a project over its whole course, you can now create an account and see every project you are authorised for – without a fresh link from an e-mail. It stays as it was: no account is needed to deliver documents, and an account is always free. 🔒 Authorisation follows the address, but only once it is confirmed. That is not a formality: without it, signing up with someone else’s address would be enough to see their projects. *At this point, confirming the address is the permission check.* Whatever the company has withdrawn is not in the list, and whatever your level does not show is not loaded here either.

A record with neither name nor role brought down the whole project view – for the viewer with an account, that is: the one it shows the most to. The schema does default both fields to an empty string, but that applies when a record is created: *a default is a promise about new records, not a statement about the ones already there.* A record written or imported earlier simply lacks the fields. The list now skips it, while the count still includes it – that person is involved, merely unnamed.

Whoever is asked to supply a document also sees what it is about – in five levels the business sets per person: the title only, plus the short description, the explicitly released sections, all sections, and finally their full descriptions as well. The default is the lowest level: *whoever sets nothing gives nothing away.* Budget and hours are on no level at all — they are not even loaded. 🔒 Other participants' names appear only with your own account, otherwise the bare count with a note. The reason comes with the note: *a link only proves that somebody had access to a mailbox* — a forwarded email, a colleague at the same screen will do. Attaching names to that would be a disclosure without a check. An account is always free.

A link valid for seven days, with a deadline twenty days out, is a dead address for fourteen days with an open task beside it. That can be intentional – there are reasons – and so it is reported, not forbidden. When requesting documents and when moving a deadline, the business is told what it has just set up. *A setting you only notice through its consequences is one you notice when somebody calls.* If validity ends exactly on the deadline there is nothing to report: whoever can deliver by the date has no dead link in front of them.

A deadline can be moved without the old reminders staying behind. The business sets a new deadline along with validity, upload attempts and lead times – and the reminders already scheduled are discarded in the same operation: *a reminder about a deadline that no longer exists arrives on time, and nobody notices that it names the wrong date.* Discarded means recorded, not deleted. The recipient receives an email with the new date and a new link. And “the existing deadline still applies” no longer applies to an expired one: asking for a correction whose deadline has already passed is refused, instead of sending an email that asks for something by yesterday.

The business now judges a delivered document – accepted, another version needed, or rejected. The last two require a reason, enforced by the service and not by the form: *a rejected document without a reason is not a result for the sender, it is a dead end.* If another version is needed, the new link travels in the same email; accepted means closed. The system also records which version was judged – *an “accepted” that does not say what it refers to becomes, at the next upload, a statement about something nobody looked at.*

When a business withdraws a request, the link dies in that same moment – not at the next scheduled run. Anyone opening it afterwards reads that the request was withdrawn, not “unknown”: *a dead link that does not say why it is dead sends the recipient to the phone.* An email goes out, and anything already delivered stays – what is withdrawn is the way in, not the delivery.

Sending a document again does not overwrite the first one. Every delivery is stored as its own version: 1, 2, 3 – and each one stays for as long as the retention period runs. The business sees in the log that something newer has arrived, and whoever delivered sees which version it was. *Anyone who wants to check what was on file on a given day can never do so once it has been overwritten.*

Anyone asked to deliver a document can now upload it. It is encrypted in the browser before it leaves the computer; content and file name only travel sealed. The page shows how many attempts are left. An attempt is booked in the write itself, before the file is stored, and is never credited back; two clicks in the same moment therefore cannot exceed the limit.

Open projects, requested documents and how many of them are overdue – right on the start page. The numbers come from the same calculations as the reminders and the deadline check, so the overview never says anything different from the system. If «Overdue» shows more than zero, it turns red.

Anyone due to deliver a document is reminded automatically – ten days and two days before the deadline. Each reminder is fixed as a record of its own the moment the request goes out; if the hourly run misses once, it is caught up afterwards instead of skipped. If the deadline is already too close, the first reminder is dropped rather than sent at once.

When something is deleted, the envelopes go first and the encrypted file second. In that order, so nothing is left behind that could still be opened. There is also a test that shows the server cannot read the content – not even with an operator account that grants itself access afterwards.

Documents are encrypted in the browser of whoever delivers them – content and file name alike. From then on only those cleared for it can read them; every authorised person gets their own envelope around the same key. Large files pass through in pieces, so a ten-megabyte document does not fail on memory.

A file called `.pdf` is not yet a PDF. Uploads are now inspected from the inside, and the size is checked twice – in the browser, so nobody transfers for ten minutes only to read a rejection, and again on the server, because a check in the browser is a convenience and not a guarantee.

Anyone who receives a request from you now arrives on a page of their own. It names the document asked for, the project, your name, the deadline and how many uploads are left – without an account and without signing in.

🔒 The access token sits in the address after the hash sign and never leaves the browser. It therefore appears in no server log, and it is not passed on when another page is opened from there.

ℹ A link that no longer works also says why. Copied incompletely, expired or withdrawn are three different answers with three different next steps – and the permission is checked afresh on every visit, not only when the mail goes out.

⚠ Uploading itself comes with the next step.

You now decide yourself who looks at a project from outside. Enter the address, add a name and role, and above all: one of five visibility levels – from “the number of steps only” to “everything except internal time records”.

ℹ The default is the most reserved level. Anyone who sets nothing gives nothing away; every further disclosure is a decision you make.

⚠ Withdrawal takes effect at once and stays visible. The entry does not disappear, it carries the moment – so that nobody later has to guess from when someone stopped seeing anything.

The layout and appearance of this page have been reworked. Every change now sits on a card of its own, instead of being separated from the next only by a thin rule, and the header states which release is currently running.

ℹ Type, date and release stand side by side, with the subject on the line below. Along with an icon per type, a legend explaining all four, and a heading per month – so that an entry is found rather than searched for.

⚠ And the descriptions have become fuller. A history made of keywords says that something has changed, but not what – and that is half an answer.

A new account creates its own organisation. Until now that was only possible behind the scenes.

ℹ Anyone working in several of them switches between them. Projects, steps and documents always belong to exactly one organisation.

⚠ Staff are invited with a role. The role decides what someone may see and change – an invitation without one would be a decision nobody made.

Projects, steps and checklists can now be seen and edited in the workspace too. No longer only where they were created.

ℹ Each project carries the number of open items. That is the question you open such a list with – answered without unfolding every project one by one.

Every change to a project is recorded. Who set which state and when, who added which step, who ticked off which item.

⚠ The history can be added to, not altered. A record you can smooth over afterwards is not a record.

The history you are reading right now. In four languages, extended with every release, and each entry carries its date, time and release number.

⚠ Written by hand, not generated from the internal log. Internally we record which release something failed in and why; published, that would be a guide for anyone looking for an installation that has not been updated yet.

For every step you can record when and for how long it was worked on. With a note, wherever the line would make no sense to anyone later without one.

ℹ A budget is optional – enter one and you see what is left. If it is exceeded, you see by how much. Without a budget there is no remaining figure, because “no budget” is a different thing from “zero hours”.

Open, in progress, closed successfully, closed unsuccessfully, cancelled. The same five states apply to a single step and to the whole project.

⚠ As long as one step is open, the project cannot be closed successfully. And within a closed project no step can be reopened – two rules that hold each other.

One project, named steps, a checklist per step. Create, rename, reorder – the structure follows your process, not the other way round.

ℹ The checklist is the list of documents you need. The requests that later go out to your counterpart grow out of it.

German, French, Italian and English – the same statement everywhere. The interface, the emails to your counterpart, and this page as well.

⚠ A check in the build holds that together. If one sentence is missing in one of the four languages, the release never leaves the building – a translation you have to remember to make lasts until the first hurried addition.

Sign-in can be secured with a code sent by email. After the address and the password comes a second step that only reaches whoever has access to your mailbox.

⚠ Plus recovery codes for when the mailbox is out of reach. They are shown once and then exist only with you. Each one is valid exactly once and is used up afterwards.

Both work without making your encrypted documents unreadable. What is re-locked is the wrapper around the key; the files themselves are untouched.

⚠ Resetting is the more delicate of the two. Someone who has forgotten their password has nothing left to show – so the path runs through the confirmed address and not through a question somebody could guess.

The key pair is created on your device, not on ours. The public half goes to the server, the private half stays here – locked with your password.

⚠ That means we cannot read your documents either. What sits with us is the encrypted content and a key that opens nothing without your password.

Create an account, confirm the address, sign in. The first path that works end to end – with a confirmation email, password rules and a session you can end again.

ℹ The email address is the anchor of your account. The confirmation goes there, later invitations go there, and so does every notification – which is why we check at sign-up that it is an address at all.