TOTP second factor — §164.312(d)
The compliance assessment called the absence of any second factor disqualifying on its own, and under the 2025 Security Rule NPRM MFA stops being addressable at...
Add analytics analytics + ?registered=1 welcome notice
- Mount analyticsAnalytics client component in the root layout: next/script loader for analytics.kamocrm.com scoped via data-domains to login.kamocrm.com on...
Create the second-factor tables
Backs UserMfaEnrollment and MfaRecoveryCode in kamo-shared-library — §164.312(d) Person or Entity Authentication, the gap the compliance assessment called disqu...
Require VIEW_CALL_LOGS for call playback in PHI-handling orgs
Recording and voicemail playback checked tenancy and nothing else: any member of the owning org could pull any call in it, transcript included, on extensions th...
Automatic logoff after inactivity (HIPAA 164.312(a)(2)(iii))
A session left open on an unattended workstation stayed usable indefinitely. This terminates it after 15 minutes of no interaction, with a 60-second warning so ...
Audit WOPI content endpoints and close the last byte-serving gaps
WOPI serves whole documents to Docs and recorded nothing. GET /wopi/files/{id}/contents is the same disclosure as /download, relayed the same way through APISer...
Promote an ingested eligibility matrix from the console
For an ELIGIBILITY_MATRIX source document the ingestion panel now shows a "Promote as eligibility matrix" card: pick the product, limit type (MAX_LTV/CLTV/DTI),...
Gateway relay to promote an ingested eligibility matrix
**************** gain promote-eligibility, mirroring promote-adjustments: god-eligible gate, organizationId server-stamped via write(), downstream 4xx relayed v...
Authoring UI — list, line-item editor, share-link management
Completes the quote/estimate system: staff can now build a quote, price it, mint a share link and email it, all from the pipeline. app/lib/quotesApi.ts ...
Record lead reads and refuse un-auditable exports
HIPAA §164.312(b) for SecurityService. The platform records every lead CHANGE (LeadHistory) and every login (SystemAccessLog) and records no READ at all, so "wh...
Public branded quote/estimate document at /{locale}/q/{token}
The customer-facing surface for the commerce quote system. Server-rendered so the org's branding is in the first paint — an unbranded flash on a commercial docu...
Quote REST surface — staff management and public share links
Staff endpoints at /api/security/commerce/quotes and an unauthenticated resolver at /api/security/public/quotes. QuoteController extends BaseLosController rath...
Quote/estimate domain — entities, pricing engine, share links
Adds a first-class Quote alongside the existing commerce spine. The pre-existing "ServiceQuote" is an Intent plus a JSON blob carrying one offering and one flat...
Egress containment for the avatar resolver, as a CiliumNetworkPolicy
Reinstates what 8f6c672 reverted, in the only form that actually works here. The earlier attempt failed because a plain NetworkPolicy cannot express this clust...
Show a facepile for group conversations
A thread with five people on it was represented by one arbitrary face, which reads as a message from one person. Up to three participants now overlap, so "sever...
Instrument the chain, reap expired entries, record disclosures
Every failure mode in this feature is silent. A latched circuit breaker, a worker queue discarding every task, a provider that started returning HTML — each loo...
Promote an ingested LLPA matrix into adjustments from the console
The ingestion panel could only publish a rate sheet. For an LLPA_MATRIX source document it now shows a "Promote as LLPA adjustments" card: pick the existing rat...
Gateway relay to promote an LLPA matrix into conditional adjustments
**************** gain promote-adjustments, mirroring the promote-rate-sheet relay: god-eligible gate, organizationId server-stamped onto the payload via write()...
Record call recording, voicemail and transcript access
Recording playback left no trace. A recorded call is the densest PHI the platform stores — the unredacted conversation — and "who listened to this call" was una...
Record PHI access on every read of stored AI conversation history
Wires the shared §164.312(b) spine into the paths that read persisted prompts and completions. The assistant is the module the compliance assessment put OUTSIDE...
Record chat message reads on the endpoints that return bodies
Sending a message left a row; reading one left nothing. Every chat, support and social thread on the platform renders from a handful of endpoints here, and none...
Record byte access on the four document paths that recorded nothing
/download already logged through **************** and it was the platform's only byte-access injection site. The sibling endpoints serving the exact same bytes ...
Contain egress from the avatar resolver; note the Redis eviction pool
SecurityService now runs a fetcher whose target URL is chosen by an untrusted party — a BIMI record is DNS content published by whoever owns a sending domain, a...
Show sender and recipient photos
The mailbox rendered a single letter on a single shared gradient for everyone, so every row looked the same and the circle carried no information. It now shows ...
Avatar endpoints; fix unauthenticated reachability and contact tenancy
Adds the mailbox side of sender avatars, and fixes three pre-existing holes this work would otherwise have built on top of. AUTHENTICATION. OTKPreAuthFilter us...
Sender-avatar resolution chain for the mailbox
Resolves a correspondent's email address to a picture, working outward from what Kamo already knows: member photo, then a photo someone attached to a contact, t...
Sender identity model + org-scoped batch email lookups
Backing store and queries for the mailbox sender-avatar chain. SenderIdentityEntity is the durable tier of the avatar cache. org_id is part of the natural key ...
Audit spine for PHI access — §164.312(b)
The Security Rule requires recording access to ePHI, which means reads. The platform records changes well — LeadHistory, SystemAccessLog, UserHistory, LoanAudit...
403 rather than 500 when the compliance boundary refuses
Two call sites of featureService.enableFeature now understand the HIPAA boundary: - /enable maps PhiModuleNotPermittedException to 403 carrying the reason, m...
Enforce the compliance boundary at the feature switch
Wires PhiTenantGuard into FeatureService, the single choke point through which a module is switched on for an organization. This is where the boundary stops bei...
Auto-assign a MERS-compatible loan number at application creation
LoanFile.loanNumber was null on create (both blank-create and lead-promote) and only ever set when a steward typed one — which hard-blocked MERS MIN minting (a ...
Render signer dates in the recipient's resolved timezone
SigningSession gains a required `timeZone` (IANA id) that ESigService resolves from the recipient's member zone, then the org's, then UTC. WelcomeScreen now pas...
Resolve signer display timezone from member, then org
Signing dates were rendered in whatever zone the client defaulted to, so an envelope expiring 2026-08-03T05:00Z could read "Aug 3" to a Pacific signer for whom ...
Create HANDLES_PHI and PHI_EFFECTIVE_DATE on orgs
Mirrors the two new Organization fields, following the OrgBrandingFieldsMigration convention, so the columns are reproducible on any environment rather than onl...
Persist handlesPhi and phiEffectiveDate on Organization
Backs PhiTenantGuard with a real column. HANDLES_PHI is NOT NULL DEFAULT FALSE following the **************** pattern, so every existing tenant is explicitly ou...
PhiTenantGuard and the module compliance boundary
The keystone of the HIPAA compliance boundary: which modules a tenant may reach, given whether that tenant handles protected health information. Everything down...
Create HANDLES_PHI and PHI_EFFECTIVE_DATE on orgs
Mirrors the two new fields on the Organization entity in kamo-shared-library, following the OrgBrandingFieldsMigration convention. HANDLES_PHI is NOT NULL DEFAU...
Emit the signer locale segment in signing links
Extracts the byte-for-byte duplicated buildSignLink into SignLinkBuilder and adds a locale segment sourced from Organization.language, falling back to English f...
Add the handlesPhi tenant flag and PhiTenantGuard
The keystone of the HIPAA compliance boundary: a per-organization flag plus a guard deciding which modules that organization may reach. Everything downstream ke...
Add language switcher to the signer top bar
Endonym-labelled menu over the 22 supported locales. Preserves the query string on switch — ?t= is the signer's only credential.
Mirror layout for RTL locales via stylis-plugin-rtl
The MUI theme direction alone flips component logic but leaves physical CSS properties untouched, so Arabic rendered with LTR spacing. Swaps the Emotion cache k...
Route the signer under /{locale} with next-intl middleware
Adds i18n/routing.ts (localePrefix always), i18n/navigation.ts, and middleware.ts, and moves the route tree under src/app/[locale]/. request.ts now resolves fro...
Blink the mail icon while an unread indicator is showing
The unread badge alone was easy to miss in the top bar. NavItemButton gains a blinkIcon prop that pulses the icon (and its badge) — kept distinct from the exist...
Starter capped at 5 users, Business at 25
Repositions the published seat caps on /pricing (and the calculator, JSON-LD offers, and llms.txt summaries) to match the subscription catalog: Starter 25 -> 5 ...
Clarify MeridianLink market secret is the inbound-sync service credential (per-LO logins on member profile)
MeridianLink loan-officer credential card on member profile + lead-button LO pre-warn
Phase L3 of the MeridianLink LOS loan-officer mapping (per §3.4-3.6 of the design spec): - New member-scoped LOS-credential proxy **************** and type...
LO-scoped create (block if unmapped) + member MeridianLink credential API + market-config LO link status
Phase L2 of the MeridianLink loan-officer mapping design (kamo-internal **************** §3.3-3.6), built on the L1 shared-lib schema/resolver (MarketLosUserCre...
Per-member MeridianLink credential (MarketLosUserCredential) + resolveForMember + LO-scoped outbound push
Bulk Email campaigns UI — grid, editor, provider tab, leads action
Adds the org-level bulk email marketing surface under /marketing/email: - Bulk Email tab (after Social Media) + campaigns AG Grid workspace with live status/s...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.