Release notes

What changed in each Find My Data release, newest first. Versions are dated: 26.7.16.5 means the sixth release cut on July 16, 2026 (yy.m.d.sequence). Your deployment ships a VERSION file and reports its version at GET /api/controlplane/telemetry-preview. The current state of every capability — including what is feature-gated or awaiting Microsoft protected-API enablement — is always tracked in STATUS.md. Current release: 26.7.19.2.

​

July 19, 2026 (26.7.19.0 – 26.7.19.2)

​

The Registry redesign — a new web interface

The web interface has been redesigned end-to-end around a single idea: the ledger of ground truth. Three releases in one day:

• 26.7.19.0 — Registry. A new information architecture organized around the Data Domain Owner’s actual work: domain-scoped URLs (/d/<domain>), a capability-composed sidebar (you see exactly what you can do — nothing else), and a seven-module orient home. A new visual identity (“Registry”: archive paper, iron-gall ink, ledger green) with a pencil-vs-ink provenance grammar — everything AI-inferred renders as provisional graphite pencil; everything a human confirmed renders in solid ink, so certainty is always legible. The review queue became a two-pane workbench with an “Ask, Then Refine” decision flow (“Is this your team’s data?” → refine → commit restates the full outcome), an 8-second undo backed by real decision-revision endpoints, and honest propagation preview (“family plates” showing byte-identical / template-family / same-folder reach). A unified /approvals desk with strict, server-enforced segregation of duties, and relational “reach” visualizations where exposure beyond the organisation is marked by a red margin rule.
• 26.7.19.1 — Dark theme. Full dark token pairs and a persisted Auto / Dark / Light control.
• 26.7.19.2 — Tenant orient homes. /home for every tenant persona is now composed from capability modules (approver inbox, taxonomy drafts, release posture, ownership & attestation coverage stated honestly as N of M, findings rollup, source freshness, audit summary) — never a hardcoded role page.

565 tests green; every screen walked live across all five personas; three adversarial review passes fixed 19 defects before ship.

​

July 18, 2026 (26.7.18.16)

​

Scale-out Phase D — pluggable storage, pgvector, packed indexes

Completes the ADR-0028 scale-out programme. The object/artifact store is now pluggable — keep it on local disk (default) or point FMD_OBJECT_STORE at your OWN S3/R2/MinIO bucket or Azure Blob container (content never leaves your deployment; credentials by reference). On Postgres, embeddings automatically use a real pgvector column with an HNSW index for approximate-nearest-neighbour search when the extension is present, falling back to the built-in index otherwise. Duplicate-detection bands and the hot governance facets are now packed into indexed columns for faster retrieval at scale. Load-validated on real Postgres 16 to 2 million assets (7.1k assets/sec ingest, packed-band lookup ~20 ms, vector-neighbour ~2.5 ms). SQLite remains the zero-dependency default; the full test suite runs green on both backends and CI now certifies both.

​

July 17, 2026 (26.7.17.15)

​

Scale-out Phase C — Postgres backend (optional)

Find My Data can now run on PostgreSQL as an alternative to the default, zero-dependency SQLite — set FMD_DB_BACKEND=postgres and FMD_DB_URL. Same schema and behaviour behind one data-access seam; the entire test suite runs green on both engines. SQLite stays first-class for evaluations and small deployments.

​

July 17, 2026 (26.7.16.14)

​

Microsoft Entra sign-in — real production login

Find My Data now signs real users in against your own Microsoft Entra tenant. Set FMD_AUTH_MODE=entra and register a sign-in app (its four FMD_ENTRA_* settings are in the installation guide), and users authenticate through a standard authorization-code flow with PKCE — no passwords touch Find My Data, and nothing about your content leaves your deployment. The login is strict by design: the identity token is verified end to end (signature, issuer, audience, expiry, nonce, and that it came from your tenant), and people are matched to their account by an immutable directory id rather than by email, so a renamed or reassigned mailbox can’t take over an account. An unrecognized user is refused rather than silently let in (opt in to just-in-time, permission-less accounts with FMD_ENTRA_AUTO_PROVISION=true). Until you configure the app, the sign-in endpoint returns an honest 501 — it never falls back to the development persona picker. The whole flow was built against a self-signing test identity provider and passed an adversarial security review with no findings; the only remaining step is the one-time app registration in your tenant. See ADR-0035.

​

Least-privilege SharePoint (Sites.Selected)

You can now scan SharePoint at least privilege. List the specific site paths (host:/sites/Name) in FMD_SP_SITES and Find My Data resolves only those sites — it never enumerates your tenant. This is the recommended production posture (pair it with Microsoft’s Sites.Selected permission, which grants access to nothing until you grant each site explicitly). Remove a site from the list and it stops being scanned — the selection is re-checked every scan, not just at setup. Leaving FMD_SP_SITES empty keeps the previous tenant-wide read behavior, so nothing changes unless you opt in. A site whose grant hasn’t propagated yet is simply skipped rather than failing the scan. See ADR-0036 and the permissions manifest.

​

July 16, 2026 (26.7.16.0 – 26.7.16.13)

​

Box scanning

Find My Data now scans Box. Enable FMD_FEATURE_BOX_CONNECTOR, list the Box folder ids in FMD_BOX_FOLDERS, and provide a read-only Box app (Client Credentials Grant) with access to those folders. Only the folders you list are ever walked. Files flow the same classification, evidence, owner-review, cross-source duplicate-detection, and findings pipeline as the rest of your content, and Box sharing is visible — a file shared by an open link surfaces as anonymous exposure, and collaborations (people and groups) are mapped. Deletions are detected on every change scan. See the permissions manifest.

​

Google Drive scanning — first non-Microsoft source

Find My Data now scans Google Drive (Google Workspace). Enable FMD_FEATURE_GDRIVE_CONNECTOR, list the shared drives in FMD_GDRIVE_DRIVES, and provide a read-only Google service account (via FMD_GDRIVE_SA_KEY_REF; add it as a viewer of those drives, or use domain-wide delegation). Only the drives you list are ever scanned. Files — including Google Docs, Sheets, and Slides, which are exported to text — flow the same classification, evidence, owner-review, cross-source duplicate-detection, and findings pipeline as your Microsoft content, so sensitive data in Drive is found the same way. Two things Drive does better than a file share: deletions and edits come from Drive’s native change feed (fast, accurate, no full re-scan), and sharing is fully visible — a file shared “anyone with the link”, to your whole domain, or to a group is mapped and surfaced as an exposure, not guessed. See the permissions manifest.

​

SQL database scanning (Azure SQL / SQL Server) — first structured source

Find My Data now scans relational databases, not just files. Enable FMD_FEATURE_SQL_CONNECTOR, list the exact server/database entries in FMD_SQL_DATABASES, and provide a read-only login (via the FMD_SQL_CONNECTIONS_REF connection map) plus the mssql driver. Each table is profiled — its column names and types, a row-count band, and a small capped sample of values — and that profile flows the same classification, evidence, owner-review, duplicate-detection, and findings pipeline as your documents, so a national_id or date_of_birth column lights up just like a sensitive file. Over-shared tables (readable by the database’s public/guest role) surface as broad-exposure. The connector is strictly read-only and injection-safe, only ever queries the databases you list (re-checked at scan time), and bounds every sample — at most five short values per column, with the row count reported only as a magnitude, never the exact number — so the most sensitive data stays inside your deployment. Row-level changes within the same size band are picked up on scheduled full rescans. See the permissions manifest.

​

On-prem file-share (SMB) scanning

Find My Data now scans on-prem Windows/SMB file shares — the legacy estate where decades of departmental documents, “temporary” migration copies, and unowned folders accumulate. Mount the share on the deployment host (a normal CIFS mount, or a UNC path on a Windows host) and list the exact roots in FMD_SMB_SHARES: only those roots are ever read, symlinks are never followed, and de-selecting a share stops its scans immediately. There is no agent to install on the file server and no share credential handed to Find My Data — the mount’s service account (which you control and rotate) is the read identity. Deleted files are detected on every change scan, and all downstream capabilities — classification, evidence, duplicate detection across SharePoint/OneDrive/Azure/SMB, owner review, findings — work unchanged. NTFS permissions aren’t visible through a mount, so permission observations are honestly reported as not observable (native ACL mapping is a planned follow-up). See the permissions manifest.

​

Azure Blob Storage and Azure Files scanning

Find My Data now scans Azure Blob Storage containers (including ADLS Gen2 accounts) and Azure Files shares — the places data-lake exports, backups, and stale document copies accumulate outside Microsoft 365. Enable FMD_FEATURE_AZURE_STORAGE_CONNECTOR and list the exact account/container and account/share entries in FMD_AZURE_BLOB_CONTAINERS / FMD_AZURE_FILES_SHARES: only those are ever scanned — the connector has no account-enumeration path at all, and the selection is re-checked at scan time, so removing an entry stops its scans immediately. Everything downstream works unchanged — classification, evidence, owner review, findings, the Analyst — and deleted blobs and files are detected on every change scan even though Azure’s listing APIs don’t report deletions (the scanner diffs the full namespace server-side). Access uses Azure RBAC (Storage Blob Data Reader, plus Storage File Data Privileged Reader for shares) granted to your existing app registration — see the permissions manifest. Storage objects carry no Purview labels; label observations honestly report unsupported, and blob container public-access levels surface as anonymous-exposure signals.

​

OneDrive for Business scanning

Find My Data now scans OneDrive for Business personal drives, not just SharePoint. Enable FMD_FEATURE_ONEDRIVE_CONNECTOR and list the specific users in FMD_ONEDRIVE_USERS — only those users’ drives are ever scanned (least privilege; there is no tenant-wide sweep). Discovered drives flow the exact same inventory / delta / permissions / labels / content pipeline as SharePoint, so every downstream capability works unchanged. The selection is re-checked at scan time: remove a user from the list (or turn the feature off) and their drive stops being scanned immediately, even if it was previously discovered. Live scanning needs Files.Read.All consent (Microsoft’s Sites.Selected cannot cover personal drives). See the permissions manifest.

​

Support workflow: diagnostics in the case flow

Getting help is now a workflow, not a file exchange. When you open a support case in the Account portal, you can attach a diagnostic bundle right in the case: paste the payload from your deployment’s GET /api/support/diagnostics/preview, see exactly what it contains (health bands

• the redacted error snapshot, rendered as a table) before anything uploads, then confirm. Support sees the error-snapshot summary on the case, and — when the case is mirrored to our support tooling — a short metadata note (top error groups, versions, license state) so triage can start immediately. As always, the bundle carries operational health only; the strict schema re-validates it on upload, so no customer content can cross. A support runbook maps each error event to its likely cause for fast (including AI-assisted) resolution.

​

Scale: measured 1M-asset envelope + near-duplicate retrieval fix

The single-node deployment is now measured, not extrapolated, at 1,000,000 assets: ingest in minutes, ~2.4 GB on disk, interactive queries under 100 ms — see the capacity model for the numbers and the supported envelope. Alongside the measurement, near-duplicate candidate retrieval was rebuilt to stay accurate at large corpus sizes: locality-sensitive banding now uses the designed 4 × 16-bit scheme, and a second bounded candidate source (the built-in semantic index) surfaces same-template variants; every candidate is still verified by fingerprint distance, so what counts as a “near duplicate” is unchanged. Existing deployments are migrated in place automatically (migration 0015) — no re-scan required.

​

Active-user licensing

Licensing is now billed per active user — a person who actually signed in to Find My Data within the trailing 90 days — never your organization’s headcount. The count rises the first time someone signs in and rolls off 90 days after their last sign-in, so occasional users aren’t churned in and out month to month. Your deployment computes the number itself from its own session history, and you can inspect exactly what is reported at GET /api/controlplane/telemetry-preview. Existing license tokens remain valid unchanged. Editions: Standard $49** and **Enterprise$99 per active user per month — see Pricing & licensing.

​

AI usage and cost visibility

Building your organization’s data model runs on your own AI provider account (Azure OpenAI or Anthropic — both supported). Every AI call now records tokens consumed and an estimated cost, and GET /api/governance/ai-usage shows per-task runs, tokens, and estimated spend so tenant setup is never a cost mystery. Estimates are computed at list prices (override with FMD_AI_PRICE_TABLE_JSON); your provider bills you directly — Find My Data never meters or charges for these tokens. Restricted to admin/oversight roles.

​

MCP server — agentic access to your deployment

Your deployment can now be driven by AI agents (Claude, IDE agents) through a built-in MCP server: bun run --cwd packages/server mcp. It is a thin adapter over the deployment’s existing API — an agent signs in as one of your principals and inherits exactly that person’s permissions, with every call authorized and audited by the same code paths the UI uses. Reads are broad (taxonomy, landscape, findings, review queue, operational health, analyst questions); writes are proposal-only (draft a remediation, start a scan) — approving or executing anything consequential still happens in the product, by a person. See the API reference.

​

Support-ready diagnostics

The consent-based diagnostic bundle now includes a redacted error snapshot: recent error events grouped by event name and error class with banded counts — developer-written constants only, never messages, file names, paths, or identities. Support (human or AI-assisted) can triage “provider errors are elevated” without any customer content leaving your deployment. As with the rest of the bundle, you can preview the exact payload before consenting to an upload (GET /api/support/diagnostics/preview).

​

Team management in the Account portal

Organization owners on account.findmydata.io can now invite teammates by email, manage owner/member roles, and revoke pending invitations. Invitations auto-accept on first sign-in; the last owner can never be removed, so an organization is never orphaned.

​

Public demo and session hardening

A public, self-resetting demo of the product now runs at demo.findmydata.io — synthetic data only, no live tenant, clearly bannered. Session cookies are now marked Secure on every HTTPS deployment regardless of environment label. Upgrading within July 16 releases: database migrations 0014–0021 apply automatically on boot (additive columns, a near-duplicate index rebuild, and constraint-widening table rebuilds that preserve all rows and verifies referential integrity before committing). No configuration changes required; no license re-issue required.

​

July 15, 2026 (26.7.15.0 – 26.7.15.10)

The first public release day: the platform, its licensing, and the commercial services around it.

​

The platform (26.7.15.0)

First tagged release of the customer-hosted platform: onboarding and AI-assisted taxonomy drafting (human-approved), durable inventory/delta scanning of Microsoft 365, explainable sensitive-data candidates with evidence, the “Is this yours?” owner review flow, the scoped Analyst, approval-gated remediation with source verification, hash-chained audit, operations dashboard, scanner fleet support, and the full documentation set. Published with a container image, SBOM, and checksums on GitHub Releases.

​

Licensing and activation (26.7.15.1 – 26.7.15.2)

Signed license entitlements (Ed25519), online activation with a one-time code, periodic renewal with an offline grace window, and non-destructive expiry: an expired license gates starting new scans — it never locks you out of your data, audit trail, or exports.

​

Commercial services (26.7.15.3 – 26.7.15.10)

The Account portal (account.findmydata.io) went live across these releases: self-service registration and 30-day evaluation, license and deployment views, entitled downloads with signed URLs and checksums, support cases with consent-based diagnostic bundles, production sign-in, and paid checkout. Demo mode (FMD_DEMO_MODE) also landed: a fail-closed configuration that refuses to boot against a live tenant, for safe public demonstrations. Upgrading within July 15 releases: migrations apply automatically on boot; no breaking configuration changes.