Roadmap
Shipped, building, deferred, won't-do.
Updated alongside the changelog and known limitations. Items are not commitments to any specific tenant.
| Area | Item | Status | Note |
|---|---|---|---|
| Risk register | Top-down enterprise risk register with appetite, KRIs, residual scoring | Shipped | |
| Compass | Assistive triage + scenario draft + board-pack narrative; HITL on every suggestion | Shipped | |
| Audit chain | SHA-256 hash chain shared with RegAlign®, auditor-verifiable without an account | Shipped | |
| CSV bridge | RegAlign ↔ RiskAlign v1 bridge (findings, controls, obligations round-trip) | Shipped | |
| Golden Path | Operator presenter run-sheet through every register | Shipped | |
| Public surface | Compass methodology, Known Limitations, Security Roadmap, AI Use Disclosure, Changelog, Roadmap | Shipped | |
| Security | DEV_OPEN cutover — mandatory MFA, tenant scoping enforced, dev routes gated | Building now | Hard blocker before first paid pilot. |
| Operator tools | Board-pack PDF polish, signed-link sharing, regulator token access | Building now | |
| Bridge UI | In-app one-click RegAlign ↔ RiskAlign bridge (currently operator-only) | Next | Lands once both products have signed pilots. |
| Public status | Live /status page wired to status_probes | Next | |
| Group view | Multi-entity rollups for group structures | Next | |
| Compass telemetry | Aggregate ratification rates published from /api/public/compass-methodology | Next | Triggered by enough decided suggestions to be meaningful (post pilot #1). |
| SSO / SAML | Customer-configurable SAML 2.0 | Later | Lands at first enterprise procurement requirement. |
| Public REST API | Documented customer-facing API | Later | |
| SOC 2 Type I | Observation window opened | Later | Trigger: Series A close or second enterprise customer. |
| On-premise | Customer-managed deployment | Won't do | |
| Card payments | Stripe/card rails | Won't do | Regulated buyers use invoice + bank transfer. |
| Generic GRC drift | Repositioning as generic GRC platform | Won't do | Loses the top-down enterprise-risk positioning and the Align product family. |