github.com/getprobo/probo

Added

• Added vendors.json data file under Creative Commons Attribution-ShareAlike 4.0 license`
• New vendor data management system with comprehensive vendor information
• Pre-populated vendor database with 12 common SaaS vendors and their certifications
• Vendor details page with extended fields for improved vendor management:
  • Legal name and headquarters address
  • Website URL
  • Certification tracking with tag-based interface
  • Links to important vendor documents (SLA, DPA, security pages)
  • Support for multiple compliance certifications per vendor

Fixed

• Fix cannot create vendor when the name is too similar to suggested one
• Fix UI showing double button to close evidence preview modal
• Fix cannot delete vendor with compliance reports (added cascade delete constraint)

Added

• Add vendor compliance reports UI
• Controls can now be linked to policies, enabling better organization of compliance documentation and clearer traceability between policies and security controls
• New UI for viewing and managing policies related to a specific control

Changed

• Simplified policy data model by removing version field and optimistic concurrency
• Refactored policy update flow to load-modify-save pattern

Fixed

• Added user-friendly error messages when importing frameworks that already exist

Changed

• Update ISO 27001 and SOC2 framework definition.

BREAKING CHANGES

• BREAKING: Renamed GraphQL mutations for control-mitigation mappings:
  • createControlMapping → createControlMitigationMapping
  • deleteControlMapping → deleteControlMitigationMapping
  • Input and payload types have been updated accordingly

Added

• Add import control <> mitigation mapping.
• Add mitigation tasks import.
• Add auto-scroll to opened category.
• Added support for mapping controls to policies:
  • New GraphQL mutations createControlPolicyMapping and deleteControlPolicyMapping
  • Controls can now be associated with both mitigations and policies
  • New bidirectional relationships:
    • Control objects now expose a policies field to list associated policies
    • Policy objects now expose a controls field to list associated controls
• Added vendor compliance reports:
  • New GraphQL types VendorComplianceReport and related connection types
  • New GraphQL mutations uploadVendorComplianceReport and deleteVendorComplianceReport
  • New complianceReports field on the Vendor type
  • Support for uploading, viewing, and managing vendor compliance documentation
• Added pre-configured frameworks:
  • Added ISO/IEC 27001:2022 and SOC 2 framework templates
  • Improved framework import interface with dropdown menu for template selection
  • Support for one-click import of standard compliance frameworks

Changed

• Evidence can now be requested.

Fixed

• Fix unfoldable mitigation category when open via the URI fragment.
• Fix ctrl+click on mitigation does not open new tab.
• Fix error handling in framework view when no controls are available.

Added

• Add forget password.
• Allow evidence to be a link.
• Add task import support.
• Allow to create vendor when it not exist in the auto-complete.
• Add service account people kind.

Changed

• Make task time estimate optional.
• Set invitation token to 12 hours.
• Order people by fullname.
• Order vendor by name.
• Allow to edit control state without going to edit page.
• Redirect on people list after people creation.
• New UI for the framework overview page.

Fixed

• Fix flickering on hover on categories.
• Fix control order under a category.
• Fix UI does not refresh after importing a framework.
• Fix cannot create control.
• Fix missing include cookie on confirmation invit.
• Fix sign-in does not include cookie.
• Fix missing version when create task.
• Fix random order on framework overview.
• Fix change task state not visible on UI.
• Fix control card items alignement.
• Fix cannot delete task.
• Fix password managers misidentifying token fields as usernames in reset password and invitation confirmation forms.

Initial release.