{"generatedAt":"2026-08-19T10:43:23.287Z","source":"heygrc-web","contract":"v1","product":"heygrc","canonicalHumanPage":"https://app.heygrc.com/changelog","note":"Scrubbed mirror of the heyGRC product changelog. GitHub PR URLs removed. Not the heygrc.com marketing site release notes (docs/CHANGELOG.md).","markdown":"# heyGRC Product Changelog\n\nAll notable user-facing changes to heyGRC, grouped by month.\n\n<!-- changelog-voice/2026-07-v1 -->\n## How to add an entry (authors and agents)\n\n**Canon version:** `changelog-voice/2026-07-v1`  \nShared voice with ISMS Copilot: see `docs/CHANGELOG.md` How-to and\n`docs/heygrc-changelog-catchup-design.md`. Weekly Mac `changelog-merge` catchup\nmay append here for heyGRC-visible PRs.\n\n### Go-forward shape\n\n```\n## Month YYYY\n\n### Features\n\n- **Short title.** One plain sentence.\n```\n\nPreferred categories: `Features`, `Improvements`, `Fixes`, `Privacy & legal`, `Safety`.\n(`### New` / `### Privacy` appear in older July entries; do not add new ones.)\n\nValidate go-forward entries with:\n`node scripts/validate-changelog.mjs docs/heygrc/CHANGELOG.md`\n\nAfter editing this file, run `node scripts/sync-app-changelogs.mjs` so the heyGRC Vercel app mirror updates.\n\n---\n\n## August 2026\n\n### Features\n\n- **Review language.** Settings and `/v1/config` can set GitHub compliance review comments to English, German, Spanish, French, Italian, Dutch, or Polish. Control IDs, the heyGRC check name, and the console stay English.\n\n### Improvements\n\n- **Console sidebar.** Reviews, company context, settings, plan, and API keys stay in a left nav, and Home is reviews plus GitHub install instead of the old card stack.\n\n- **Quieter PR reviews by default.** Inline comments are high and critical only; medium, low, and info stay in a short summary. Clean PRs no longer get an empty sticky comment (the green check-run is the signal). A shadow severity pass logs unverifiable highs for later tuning without changing placement yet.\n<!-- HELD until opt-in flags are on in production (default off at ship). Weekly audit: do not re-add as public Improvements while default-off. Eng-log covers #2260 #2261 #2262.\n- **Optional per-repo review knobs.** A checked-in `.heygrc.yaml` can set inline severity threshold, summary style, and severity regrade mode (flag `HEYGRC_REPO_REVIEW_CONFIG_V1`, default off). Repo file wins over env; read from the PR base commit only.\n- **Grounding verifier for high findings (opt-in).** A second model pass can label high and critical findings as grounded in the diff or only inferred (`HEYGRC_SEVERITY_VERIFY=shadow|enforce`; default off). Shadow logs only; enforce moves inferred highs to the summary without dropping them.\n-->\n\n### Features\n\n- **Sign in with GitHub.** You can create a heyGRC console account, or sign back in, with your GitHub account, alongside Google, Microsoft, and email.\n\n- **Connected repositories on Reviews.** After you install or change GitHub repo selection, Reviews lists those repositories before the first pull request.\n\n- **COBIT 2019 in the framework picker.** The console catalog includes COBIT 2019 alongside the other shared frameworks.\n\n## July 2026\n\n### Features\n\n- **Plan ladder on the console.** The console shows Starter, Pro, and Business private-review allotments with tiered checkout.\n\n- **On-demand reviews (opt-in overage).** Paid plans can allow extra private reviews beyond the included allotment when on-demand is enabled in the console.\n\n\n### Improvements\n\n- **Framework picker lists the full registry.** The console framework catalog includes every framework heyGRC knows (was stuck at an older 79-entry dump).\n\n### Privacy\n\n- **Uninstalling removes your stored account name.** Removing the heyGRC GitHub App now clears the GitHub account name held on an unclaimed installation record.\n\n### New\n\n- **Install the GitHub App first; claim the console later (dev).** Installing heyGRC on GitHub is enough for default-framework PR reviews under free/trial limits. Creating a heyGRC account later **claims** that installation (history and quota kept). Soft-landing signup still finishes the claim; marketing primary CTA stays **Get started** until this is proven in production.\n\n- **EU inference (opt-in).** Organizations can turn on EU inference in console Settings so compliance reviews are processed by Mistral on the EU regional endpoint (zero retention, no silent fallback to global models). Default path is unchanged. Large PRs on the EU path use a smaller review budget and may be marked partial more often. Platform kill-switch + evaluation gate apply before this is fully live.\n\n- **Public review counter for heygrc.com.** The marketing homepage can now show a live all-time count of compliance reviews run (platform total, including dogfood). Backed by a read-only public aggregate RPC; no per-org data is exposed.\n\n- **One summary per pull request, updated in place.** heyGRC no longer posts a new summary comment on every push. Each PR now gets a single summary that updates as you push, and a separate short review only when genuinely new findings appear; unchanged re-runs stay silent apart from the check run. A `/heygrc` mention that finds nothing new confirms completion with a reaction on your comment. Thanks to the customer who reported the noise on collaborative PRs.\n\n- **Dark mode.** The heyGRC console now follows your device's appearance automatically, and you can pin Light or Dark under Settings > Appearance.\n\n### Fixes\n\n- **Finish setup when you install from GitHub first.** If you install the heyGRC GitHub App before you have a heyGRC account, you now land on a clear “Almost there” step to create an account or sign in, instead of losing the install. Primary buttons on heygrc.com say **Get started** and open console signup first; you connect GitHub from the dashboard next. (,)\n\n- **Connect heyGRC to a GitHub organization.** Setting up heyGRC on a GitHub organization now works end to end: install the app, choose your repositories, and continue straight to picking your compliance frameworks. Previously, connecting on an organization account could stall after repository selection, or show a \"you must be the GitHub owner\" message even when you were an admin. Any repository admin can now complete the connection.\n","byteLength":5937}