Product Updates
Release notes, feature announcements, and improvements from the product team.
Release notes, feature announcements, and improvements from the product team.
Release notes, feature announcements, and improvements from the product team.
Release date: October 2026
This version introduces Acknowledgment Campaigns: send your policies and documents to employees or third parties, and get evidence that they read and accepted them.
Pick the documents, choose the recipients and send the campaign. Each person receives an email with a personal link, verifies their identity with a code and acknowledges the documents, no Enveedo account required.
Release date: October 2026
This version introduces the Multi-workspace Console, the console for organizations with multiple workspaces: hierarchy, people, access, SSO and a consolidated dashboard, all in one place.
If your organization manages several Enveedo workspaces, you now have a dedicated console to manage them together.
Release date: September 2026
This version introduces Documentation Management, the new module for managing your policies and documents with version control and formal approvals, and replaces the Data Room.
Manage all your policies, procedures and documents in a dedicated module, organized by category, each with its own document ID.
Want to know more? Read the full guide in our Knowledge Base: Documentation Management: documents, versions and approvals.
Your files were migrated automatically. The Data Room is now read-only and marked as deprecated. Document selectors in Risk Assessments and vendor contracts already point to the new module.
Create and manage roles with tailored permissions without depending on the Enveedo team.
Disable an account instead of deleting it, keeping its history and assignments.
When exporting the record of processing activities to CSV, choose which fields to include instead of exporting everything.
We reorganized the navigation menu so modules are grouped more clearly and each section is easier to find. Documentation Management now appears in the main menu, in the place the Data Room used to occupy.
Released August 2026
This release puts Vendor Risk Management in your hands and lets you set up enterprise onboarding yourself with self-service SSO.
Build your own vendor assessment templates, with custom categories and questions. Assess your vendors with your own questionnaire, not just the standard templates.
Available as an add-on. Contact your sales executive to see it in action and try it out.
Configure your SAML Single Sign-On on your own, without depending on the Enveedo team, through a 4-step wizard:
If you're on the previous SSO setup, the migration is guided from the same screen.
Documents attached to assessments can now be previewed right in the platform, no download required.
Duplicate an assessment with all of its answers and data under a new name. Ideal for recurring assessments.
The Summary widget now shows the maturity breakdown per catalog, so you can see at a glance how each framework is progressing.
Website is no longer required when creating a vendor.
Questions about what's new? Reach out to us at [email protected] 💬
This release connects what your organization does (its processes) with what it needs to run them (its assets) and what can go wrong (its risks), and makes those connections visible in the new Dependency Map. Here's everything that's new.
Document your business processes directly in Asset Management: a dedicated page, a relation with the Risk Register, and its own permissions. Assets, processes, and risks connected in a single flow.
A new interactive visualization of your business's full dependency chain: Crown Jewel → Processes → Dependencies (assets, people, and vendors), down to the risks and controls of each element.
A complete redesign: faster and simpler. You can now also create custom crown jewels and relate them to processes, integrated with the Dashboard and the Risk Register.
Asset classification is now based on single categories (replacing types and subtypes), for clearer and faster management.
Settings has been reorganized for a tidier, more intuitive configuration.
Risk Register v2 transforms the module from a single, rigid checklist into the core of your Security Program. You can now assess risks with the methodology that matches your organization's maturity, document the full journey from inherent to residual risk, formally accept risks with a clear paper trail, and connect every risk back to where it actually comes from. Here's everything that's new and improved in this release.
Every organization measures risk differently, so the Register now supports up to three methodologies side by side, all normalized internally to a single 1–5 scale:
Admins configure methodologies and declare the organization's risk appetite per level in a single Settings table.
You can now document a risk's full lifecycle: its inherent level before controls, and its residual level after treatment. Choose from four treatment strategies — Mitigation, Avoidance, Acceptance, and Transfer — and see the inherent → residual movement plotted directly on each risk's heat map.
Acceptance is now a documented, auditable event. Send an acceptance request to an internal or external approver; acceptors respond securely through a one-time link valid for 30 days. The acceptor accepts with a validity date or requests changes with a comment, and the risk's status updates automatically. When an acceptance reaches its validity date, the risk returns to In Treatment and the Risk Owner is notified — so nothing silently lapses.
Risks no longer live in isolation. Link each risk to where it originates across the platform: Vendors, Assets, Findings/Vulnerabilities, Privacy Records (ROPA), Incidents, and Gap Assessments. Vendors and Privacy Records can be created inline without leaving the risk.
Create or link tasks directly from a risk. Anything you add is automatically grouped under Risk Reduction Initiatives, giving you a clear, consolidated view of the work being done to bring a risk down.
Each risk now carries a full audit trail. Every entry is stamped with who did it and when.
The Register now opens with a dashboard that turns your risk data into an at-a-glance view of exposure and progress:
On the general dashboard, too. Key Risk Register insights now surface on your platform-wide dashboard — Risk Reduction, Control Effectiveness, Top Threats on Crown Jewels, and the Risk Heatmap — so leadership can see your risk posture alongside every other module without opening the Register.
This release includes a one-time migration. A few things will look different the first time you open the module:
No action is required — your data has been migrated for you.
Questions about CRQ or want it enabled for your organization? Reach out to your CSM at [email protected].
Version 9.10 delivers the full rollout of Role-Based Access Control (RBAC) across the entire Enveedo platform. Every module now enforces precise access permissions based on the user's role — controlling what they can see, access, and do. This release also includes a new security improvement for SSO onboarding, a Risk Register enhancement, and several important access control bug fixes.
Enveedo now enforces role-based access policies across every module, both in the interface and at the API level. Each user's role determines exactly which modules they can access and which actions they can perform — nothing more, nothing less.
Access policies are now active across: Dashboard, Risk Register, Risk Assessment, Risk Scorecard, Crown Jewels, Vendor Management, Asset Management, Data Room, Findings, Reports, Workflow Management, Incident Response, Settings (including Business Profile, General Settings, and Integrations), Privacy Register (ROPA), Vulnerability Scanner, Security Stack, Systems & Applications, People, Maturity Target, Onboarding, Control Catalog, CISO Console, Partner Console, and User Management.
Users who attempt to access a module they are not authorized for will now see a clear "Not Authorized" screen instead of an error or blank page.
New users signing in for the first time via SSO (Google, Azure AD, Okta, etc.) are now automatically assigned the Analyst role instead of the previous default. This ensures new users start with appropriate, limited permissions until an administrator grants them a higher role.
Users can now associate controls from the Control Catalog directly to a risk from within the Risk Register detail view. This improves traceability between risks and their mitigating controls, and allows managing multiple controls per risk without duplication.
Administrators can now assign RBAC roles to users directly from User Management. The user update flow has been updated to support the full set of roles introduced in this release.
Search and multi-select components have been improved platform-wide: dropdown menus now properly handle long text, stay anchored when the page is scrolled, and tag/chip elements are capped at a consistent length to avoid layout overflow.
RBAC is a foundational security capability. With this release, every action in Enveedo is gated by the user's role — protecting sensitive compliance data, ensuring users only see what they're authorized to see, and giving administrators precise control over who can do what across the platform.
TL;DR: This release introduces the all-new Control Catalog module — the biggest addition in this cycle. You can now build, manage, and track your organization's security controls from a centralized hub, linked to your frameworks, risks, and evidence. Plus, two new regulatory frameworks land for Argentina and Mexico, smarter vendor notifications, and a wave of reliability fixes.
The Control Catalog is Enveedo's new central module for managing your organization's security controls. It brings structure, traceability, and insight to your compliance program in one place.
You can now:
Why this matters: Before this release, tracking controls, tests, and evidence required manual effort spread across multiple tools. The Control Catalog unifies this into a single, structured experience directly within Enveedo.
When a vendor completes and submits their security assessment (VRM), the user who sent the invitation now automatically receives an email confirmation. The notification includes the vendor name, submission date, overall risk level, and the template used — so you always know the moment a vendor responds, without having to check manually.
This update enhances user experience with refreshed login screens, expanded compliance frameworks, and improved platform performance. Streamline your cybersecurity operations with better dashboard feedback and comprehensive bug fixes.
🚀 New
🔷 Improved
🛠️ Fixed