Release Notes 09-10-2026

Manage Departments for your sites - You can now create and manage departments for your sites yourself from Account Settings, assign a department when adding or editing a site, and preview how sites will appear to contractors at registration, without needing to contact ComplyFlow.

Document Expired filter has moved - On the Suppliers list, suppliers with expired documents now show the standard Active account badge, with Not compliant (Docs Exp) shown in their Status column and as a new option in the Status filter. They continue to appear in the default Suppliers list.

Faster site selection when inviting suppliers - The site selector on the supplier invitation and contractor registration screens now groups sites by department, with a tick box on each group to select every site in it at once. Select all now works together with the search box, so you can search and then select only the matching sites.

Contractor Attributes field fixes - When editing a supplier's details, the Contractor Attributes list now stays in place under the field while you scroll, and attribute warning messages now clear once you save or cancel your changes.

Clearer account status - A deactivated worker now shows an Account Status of Inactive even when their licence has also expired, instead of Inactive (licence expired).

Single sign-on email notice restyled - The notice explaining that a single sign-on user's email is managed by their organisation now uses the standard ComplyFlow information banner. This applies to staff profiles in the Client App and worker details in the Contractor App.

Accurate Online Training counts on the dashboard - The Online Training snapshot on the contractor dashboard now counts only courses that are actually assigned to workers, so the Completed and Not Done figures match the Workers Training Online matrix.

Global documents clear straight away - When you upload a global document that several of your clients have requested, the request now clears from your dashboard immediately, and submitting the same document twice shows a clear message instead of being accepted silently.

No more unexpected unsaved changes prompt - Opening an inspection to view it and then clicking outside the panel while it was still loading no longer shows an unsaved changes prompt. The prompt now appears only when you have actually made changes.

Scheduled list loads reliably - The Scheduled Inspections list no longer fails to load when a linked inspection template has been deleted.

Friendlier error page - Opening an invalid or removed link now shows the standard Page Not Found page instead of an error.

Site names display correctly - On the Add Risk and Edit Risk screens, site names containing special characters now display correctly instead of showing as raw codes.

Kiosk layout on small screens - The organisation logo and the Need help button on the Live Access kiosk now have a clear gap between them on narrow screens such as phones.

Searchable question pickers - On the AI Agents configuration panels, the Form Question and Other Form Questions pickers now have a search box and are sorted in a predictable numeric order, making it faster to find the right question on large forms.

Training permission set independently - In Advanced mode, the Training permission can now be set independently of the Staff and Worker permissions, so a staff member can be given Training access without Staff or Worker access. It still defaults to the highest of the two.

Consistent email validation - Every form that captures an email address now applies the same validation. Standard addresses, including those with a plus sign or underscore, continue to work, while addresses containing unusual special characters are now rejected consistently.

Bigger tap targets on mobile - Action buttons on the dashboard and on data tables are now taller and easier to tap on phones.

Traditional Chinese corrections - Traditional Chinese (zh-TW) translations in the Contractor App have been corrected, including the Dismiss action and the Plant and Hot Work terms. A related issue where some dashboard requirement alert text appeared in English has also been resolved.

No more duplicate compliance emails - A timezone issue that could cause compliance and document expiry email alerts to resend repeatedly on the day they were due has been fixed. These alerts now send once per day as intended.

Weekly ABN compliance email goes to your team - The weekly ABN register compliance report email now goes to each organisation's super user and primary contact.

Security improvements - This release includes a number of behind the scenes security improvements. There is no change to how any feature works and no action is needed.

Stricter, consistent email validation - Every form that captures an email now applies the same stricter check. Normal addresses, including those with a plus sign or underscore, continue to work. Addresses with unusual special characters are now rejected everywhere, including supplier invitations, which previously accepted any text. If an email is rejected, correct it to a standard format; contractor contact email fields are optional and can be left blank.

Weekly ABN compliance email now goes to your team - The weekly ABN register compliance report now goes to each organisation's super user and primary contact, rather than to ComplyFlow administrators. Your contacts should expect to start receiving this weekly email.

Document Expired supplier filter has moved - The Document Expired option has moved from the Account Status filter to the Status filter and is now called Not compliant (Docs Exp). Suppliers with expired documents now show the standard Active account badge and remain in the default Suppliers list.

Contractor dashboard training counts are now accurate - The Online Training Not Done count on the contractor dashboard now reflects only assigned courses and may appear noticeably lower than before. This is the corrected figure.

Training permission shown separately - The Training permission shown in a staff member's Manage Permissions panel may differ from before for some staff. This is a display correction, not a loss of access, and Training can now be set independently of Staff and Worker in Advanced mode.

Richer Controls - Controls now have a rich-text Description field (bold, italic, lists and links), control titles can be up to 256 characters with a live character counter, and the Controls list can be exported to a CSV file.

Link Actions to Controls - A risk Action can now be optionally linked to a Control, and the Controls list shows status badges for the actions tied to each control so you can see outstanding work at a glance.

More flexible Risk Reviews - When scheduling a Risk Review you can now select specific individual risks, in addition to sites and categories, and the Risk Review screen now opens with all sites, risks and actions expanded for an immediate full view.

Archive Risk Categories - Risk Categories can now be archived and unarchived from Configuration, which hides them from the new-risk pickers while keeping them on existing risks, with a Show Archived toggle to restore them.

No data loss when deleting a Control - Deleting a Control no longer deletes the Actions that were linked to it. The Action is kept with its Associated Control reference cleared.

Risk Matrix - The configuration preview now shows the full grid on load, saving changes no longer fails, and each Risk Area now shows its correct consequence descriptions.

Risk tables - Columns now display at readable widths, the Manage column stays pinned when scrolling sideways and no longer grows each time you sort, the list loads faster, and search now matches the Risk ID and Last Reviewed columns.

Custom fields - A range of fixes: values with special characters now save and display correctly, a deleted field's name can be reused, custom fields now appear in the Edit Risk form, editing a field no longer shows an error, the field-limit message is clearer, and deleting a field now asks for confirmation.

Other bug fixes - The Delete icon in Manage Sites now works, a control's attached files download correctly as a ZIP, the Associated Control column displays and sorts on the Action List, the Update Controls form now saves reliably, scheduled repeating risk reviews no longer stop when a risk has been archived, and the Projects/Sites list and sub-risk popovers now render correctly.

Dropdowns and filter panels - Fixed dropdown lists that could appear detached or misaligned from their field, and restored scrolling in filter slide-over panels, across the Client App.

Security improvements - This release includes behind the scenes security improvements. There is no change to how any feature works and no action is needed.

Deleting a Control no longer deletes its linked Actions - Previously, deleting a Control in the Risk Register also silently deleted any Actions linked to it. Those Actions are now kept, with the Associated Control reference cleared. This prevents future loss only. If Actions were already lost before this release, they are not restored automatically and need to be recovered from backup. Contact ComplyFlow if you think this affected you.

Risk Review now opens fully expanded - The Risk Review detail screen now opens with all sites, risk categories and actions expanded by default, where it was previously collapsed.

Risk Register custom field values are corrected on upgrade - Custom field values and names that were previously saved showing HTML codes (such as & for &) are corrected automatically when this release is applied. Afterwards, special characters save and display as typed on every Risk Register screen and in the CSV export.

New step-by-step location setup - Adding or editing a site access location now opens a three-step panel: location details and map, how people sign in, then the QR code and sign-in link to download, print or copy.

Multiple sign-in points per location - A location can now have several sign-in points, each with its own name, sign-in experience and QR code. Existing QR codes keep working.

Choose how people sign in - Each sign-in point can use a full form, minimal, minimal with escort, mobile first, kiosk display or the new Hosted Visit experience, which asks every visitor who they are visiting and why. You can also block visitor sign-in.

Removing a location's induction now saves - Setting a location back to "No Induction Required" now removes the induction that was assigned before.

Online course inductions - Organisations can now choose, from a new Induction tab in Account Settings, to deliver site inductions as online training courses instead of induction forms. Existing organisations stay on induction forms until they switch.

Inductions at QR code sign-in - When a site uses online course inductions, people signing in by QR code complete the required course on their phone before sign-in finishes. Anyone who already holds a current pass goes straight to sign-in.

Inductions on the sign-in kiosk - People signing in at a kiosk are now asked to complete the site's required induction before their sign-in is recorded.

Induction status in the Sign In Book - For sites using online course inductions, each sign-in shows whether the induction was completed, skipped because a current pass was held, not needed, or incomplete.

Site Inductions tab - Site pages have a new Inductions tab listing the site's self-enrolment courses, where staff can complete them and share an invitation link or QR code.

Sign-in Declarations - Confirmation sets can now be managed as Sign-in Declarations under Live Access Settings, and chosen for each location during Site Access setup.

Declarations on the sign-in kiosk - When a location has a Sign-in Declaration set, people signing in at the kiosk must accept each item, as they do with QR code sign-in.

Site Documents shown at QR code sign-in - Workers signing in by QR code now see the site's documents, including when they skip or complete a permit during sign-in.

Daily Site Report email - Each site can now switch on a morning email to its Site Contact, Site Access Monitors and an optional Staff Category, summarising yesterday's sign-ins and today's active permits.

Spreadsheet, chart and direct link - The email includes a spreadsheet of every sign-in from the previous day and a chart of sign-ins by worker category, and its button opens the Sign In Book for that site and date.

Complete training from the Courses list - Staff can now start a course straight from Online Training Courses when it is assigned to them or open for self-enrolment. Admins can switch self-enrolment off for each course.

Self-enrolled training kept separate from compliance - Training completed through self-enrolment or an invitation link appears in the person's training history and the Online Training Report, but does not change their compliance status.

Training invitations by link or QR code - Admins can copy a course's invitation link or download a printable QR code. People who open it enter their name and mobile number, start the course without a ComplyFlow login, and see a confirmation page when they finish.

Visitors in the Online Training Report - Courses completed by visitors through an invitation link now appear in the Online Training Report, with a new Visitor option in the filter.

Course Status column - Training managers can see whether each course is Published, Draft or has no course package, filter by it and include it in the CSV export.

Wider Courses table - The Courses table now uses the full width of the screen and labels each value on mobile.

Kiosks now ask for the site induction - If a location has an induction assigned, people signing in at its kiosk are now asked to complete the induction before their sign-in is recorded. This starts automatically. If you use a kiosk, check which inductions are assigned to its locations.

Kiosks now show Sign-in Declarations - If a location has a Sign-in Declaration set, people signing in at its kiosk must now accept each item, as they already do with QR code sign-in. This starts automatically.

All courses are open to self-enrolment - Every existing and new course allows self-enrolment until an admin switches it off on the course page. Staff without training management access now see only the courses assigned to them and those open for self-enrolment.

Deleting a Sign-in Declaration set removes it everywhere - Deleting a set from the new Sign-in Declarations page also removes it from every location and permit type that uses it.

New Inspection Dashboard - A new Dashboard page at the top of the Inspections menu shows your total, in progress, completed, overdue and this month's inspections, a 12-month trend and a breakdown by program. Clicking a card or a program opens the Inspections list already filtered to match.

Template usage table - The dashboard lists each inspection template with its total, active and this month's inspections, when it was last used, who conducted it and its completion rate, with search, filters and CSV export.

Dashboard access - The dashboard is available to staff with access to Inspections.

More accurate Template Name filter - The Template Name filter on the Inspections list now shows each template with its program and returns only inspections created from that exact template.

Template Name filter now matches the exact template - On the Inspections list, the Template Name filter now returns only inspections created from the selected template, which is shown with its program. Before, it matched any inspection whose title contained the text, so results and counts may differ. The same applies to the Attendance export. If you had a template selected before this release, select it again.