Notre changelog et nos mises à jour de sécurité

Security improvements

• The API now refuses Retyc CLI versions older than 1.3.0. The CLI gets an explicit error asking you to upgrade.

Website

• The pricing and security pages now mention passkey sign-in.

Under the hood

• Groundwork for an upcoming change to dataroom file types. A file whose type cannot be read is shown as a generic file, never as a folder.
• Docker images build faster.

Sign in without a password

• You can now sign in to Retyc with a passkey: fingerprint, face recognition or a FIDO2 security key such as a YubiKey.
• Passkeys are available on every plan, including Free.
• A passkey only works on the genuine Retyc sign-in page, so it cannot be phished the way a password can.

What does not change

• Your password still works. Using a passkey is optional.
• Your passphrase is still needed to unlock your encryption keys.

Performance improvements

• Experimental: new upload feature for dataroom with unsafe writes (average 70% faster for small files, but less safe if the connection is interrupted). This feature is not enabled in frontend app.

New Features

• Small dataroom files can now be sent in a single request. If something fails along the way, nothing is left half-uploaded.

Security improvements

• The API checks login tokens more strictly, and someone removed from an organization can no longer rejoin it with an older session.

Bug fixes

• LOW Opening a dataroom folder that was deleted in the meantime now takes you back to the root with a notice, instead of showing an empty folder.
• LOW The upload window of a dataroom no longer lists files from the previous upload as already sent.

Performance improvements

• Database work no longer blocks other requests on the same server. File uploads are 5 to 10% faster under load.

Under the hood

• More detailed tracing of the sign-in steps for monitoring and audit logs.

Security improvements

• HIGH Files and folders of a dataroom can no longer be linked to another dataroom.
• MEDIUM Sign-up: each verification code accepts a limited number of attempts, email addresses are normalized to lower case, and each anti-bot challenge works only once.
• LOW Ensure filter NUL bytes when validating strings in the backend.
• LOW Fix potential race condition in some endpoints.
• LOW Dataroom file uploads are checked more strictly, so an upload can no longer overwrite or slip data into another file.
• LOW Files sent through a deposit link can only be attached to that deposit form's own fields.
• LOW Sessions with incomplete information are now refused instead of being partially accepted.
• LOW Stricter Content Security Policy on the website and the app.
• LOW Configuration secrets no longer have default values, so they must be set explicitly in on-premises instances.

Bug fixes

• LOW Empty files can now be uploaded. They used to fail with a server error.
• LOW Expired one-time codes are now cleaned up properly (valid codes were sometimes removed instead).
• LOW Email addresses that Retyc cannot accept now get their own explanation screen.
• LOW Fixed a memory leak on the website.

Performance improvements

• Downloaded files are decrypted and written to disk piece by piece, so large downloads use much less memory in your browser.
• Listing the versions of a dataroom file is faster.

Bug fixes

• LOW Deleting files in a dataroom now frees the storage quota right away, instead of up to two hours later.

Under the hood

• Faster API responses: fewer database and cache queries on the most used pages (~15% faster).
• More options for on-premises instances. Add new feature flags.
• Tracing/logging improvements for SIEM integration and audit logs.

New Features

• Blog: the website now has a blog, with its first articles.

Security improvements

• LOW Some email addresses were logged in plaintext in the backend logs (rare error cases). They are now redacted.

Under the hood

• Test suite and linter clean-up (deprecated calls, warnings, false positives).
• New deployment options for on-premises instances.

Security improvements

• LOW Production no longer processes images on demand. Only pre-built image sizes are served.

Under the hood

• Lower memory usage on the API during heavy upload traffic.

New changes

• Folders can no longer receive a version by mistake.
• Add a quota on the number of versions a dataroom can have, to prevent abuse and reduce storage usage.

Bug fixes

• LOW Prevented (rare) race conditions in datarooms when two people upload a new version of the same file at the same instant.

Under the hood

• Optimized frontend build (less memory usage, smaller images, faster builds).
• Bun, the frontend build tool, moved to 1.4.2.

New Features

• Public API: organizations can now snapshot and rekey a dataroom through the machine API, listing every file and folder in one call and bringing the organization service account key into datarooms that existed before it was enabled.
• Public API: transfers can now be rekeyed the same way, bringing the service account key into transfers created before it was enabled.

New changes

• Website content clean-up: removed duplicate pages, added missing FAQ answers and icons, replaced outdated content, and added information about reversibility.

New Features

• Organization service account key: add a recovery key to every new transfer and dataroom created by your members.
  • The key appears as a recipient of every new transfer and as a read-only member of every new dataroom.
  • You can disable it and enable it again at any time. Transfers and datarooms created while it was active keep it.
  • This feature is available as an option.

New changes

• Transfers received through an incoming link carry a Deposit badge in the sent list.
• The white paper was revised and is now in version 1.1.0.
• Files added to a dataroom are measured against the dataroom owner's limits (instead of the contributor's limits).

Security improvements

• The API now refuses encryption keys that are not hybrid post-quantum.

Bug fixes

• LOW Fixed a sign-in failure on the authentication callback. The upstream fix landed in nuxt-oidc-auth, so the workaround we were carrying is gone.

About

• Keycloak, our authentication server, now runs in version 26.7.2 on Retyc's infrastructure.
• The upgrade fixes CVE-2026-18963.

Password reset is back

• The "forgot password" feature is available again. It had been disabled on 25 August as a precaution, while the upgrade was being tested.
• Nothing changes for you: the reset link is sent to your email address as before.

Security improvements

• Backend and frontend dependencies were updated to their patched versions.

Under the hood

• The frontend is now built with Bun instead of npm, which shortens install and build times in our pipeline.
• Dataroom creation went through a clean-up and gained unit tests.

Moving away from Clever Cloud

• Keycloak, our authentication server, is no longer hosted on Clever Cloud. It now runs on Retyc's own infrastructure (Scaleway).
• Response time and stability are now better than ever (prevent use reverse proxies from Retyc infrastructure in Scaleway to Clever Cloud).

About CVE-2026-18963

On the day of the migration, CERT-FR issued an alert about a security vulnerability affecting Keycloak. Fixing it requires a major upgrade, and we did not want to roll out that upgrade before testing it thoroughly.

• The "forgot password" feature is temporarily disabled. This is a precaution: it removes any exposure to the vulnerability while the upgrade is being prepared.
• The Retyc team is currently working on the Keycloak upgrade (26.7.x). The feature will be restored as soon as it is deployed.

New Features

• The encryption key can now survive tab reloads (persistance with 2 AES-256-GCM layers, client+server side)
• Public API: organizations can now drive Retyc from their own tools.
• Organization labels: classify your transfers and datarooms, and attach rules to each label.
  • Choose who can receive a labelled transfer: nobody outside the organization, a list of allowed domains, or members only.
  • Allow or forbid recipients without a Retyc account, and external members in datarooms.
  • Cap how long a labelled transfer can stay available.
  • Pick a default label so every new transfer and dataroom carries one, and archive a label once it has been used.
  • Labels are visible to everyone who sees the transfer or the dataroom, recipients included.
• Domain restriction: blocked domains are now rejected when a transfer is created and when someone is invited to a dataroom. Members of your organization are never blocked.
• Member management: a new member page gathers everything the organization knows about an account, its identity, encryption keys, membership type and recent authentication events, with all the admin actions in one place.
• Export your organization data to CSV or JSON (members, datarooms, transfers).
• Display SSO configuration in the organization settings.

New changes

• Dataroom ownership can be handed over to another administrator of the organization, storage accounting included.
• Choose how long dataroom activity events are kept.
• Owners can now delete their own transfers whatever their state.
• Pick which columns to display in the dataroom and deposit lists.
• Disabled transfers are now flagged with a warning badge.
• A dedicated error page in the app, plus responsive and layout fixes across the organization pages.

Breaking changes

• Inviting someone to your organization no longer takes effect while their account is still being created. The invitation applies once the account exists.

Security improvements

• MEDIUM A transfer sent without a passphrase now requires the recipient to be signed in as the intended recipient.
• MEDIUM Closed several ways around the restriction on recipients without a Retyc account.

Bug fixes

• MEDIUM Removing a member now always takes effect, even if the operation has to be retried, and the member is signed out of the organization right away.
• LOW Fixed errors on the billing pages for organizations without an active subscription, and for plans granted outside self-service billing (Enterprise plan / on-premises instances)
• LOW Prevent create/update encryption keys when multiple tabs are in key management page.

Performance improvements

• Authentication events are loaded only when the panel is opened, making the member page faster to display.
• Lower memory usage on the background task infrastructure.

Under the hood

• Reorganized the backend to separate the app-facing routes from the public API.

New changes

• Added a link to the Retyc status page in the website footer
• The footer is now shown across the app, with direct access to the legal pages
• Minor text changes in pricing table

Performance improvements

• Faster database queries

New changes

• Centered hero content on mobile for a cleaner layout

Performance improvements

• Faster page loads on the website thanks to improved caching
• Lower server memory usage for better stability under heavy traffic

New changes

• Redesigned home page with a new layout.
• Reworked product pages
• Cleaner website menu.
• Improved page content and social sharing previews (Open Graph images) on several pages.
• Update demo page

Performance improvements

• Faster authentication
• Re-add prefetching

Bug fixes

• LOW Fixed the storage usage counter when creating or deleting an account.

New changes

• The app now runs on its own dedicated domain, separate from the website.
• New "Get a demo" page to request a live product demo, reachable from the header and footer.
• New design for 'compact mode' for the language selector.
• New header menu in website.

New changes

• New "Deposit box" section to receive files from others:
  • Create a deposit link (a personal upload link people can use to send you files).
  • Create a deposit form (a structured request for specific documents). This unifies and replaces the previous "Transfer for me" links and templated transfers.
  • Multiple recipients (in your organization) to a deposit link/form.
  • Allow deposit with or without a Retyc account.
• New "Contributor" role for datarooms, sitting between Viewer and Editor: contributors can add their own files while keeping limited permissions on the rest.
• Dataroom permissions are now managed per folder, so you can give different access depending on where someone works.
• Added a refresh button in datarooms.
• Clearer product display on the dashboard and a cleaner public deposit page.

Breaking changes

• Old links to "Transfer for me" are now replaced by "Deposits Links".
• Old links to "Transfer templates" are now replaced by new links to "Deposits Forms".

Bug fixes

• LOW Fix allowed file types for organization custom logo.

Under the hood

• Upgraded several frontend dependencies for better stability / security.

New changes?????

• Reworked the user search when adding members to a dataroom
• Clearer message when adding someone who has not set up their encryption key yet
• Small interface polish: easier to click "add to dataroom" from the dashboard, and pointer cursors on switches and tabs

Performance improvements

• Removed duplicate requests in the public transfer form

Bug fixes

• LOW Fixed validation errors showing up by mistake when adding a user
• LOW Fixed email validation in the dataroom add-user search

New changes

• In-app notifications: a bell now shows your recent activity, with a preferences page to pick what you get notified about
• Track your transfers: a new dashboard page shows when your sent transfers are downloaded
• Added status filter to the sent transfers list
• Shorter, cleaner links for shared transfers (no breaking changes with existing links)
• Reworked the transfer table display

Performance improvements

• Faster uploads thanks to adaptive concurrency (up to ~50% faster with small files)
• Removed an unnecessary request when downloading files (up to ~10% faster)

Security improvements

• LOW Hardened email rendering by escaping user-provided values

Bug fixes

• LOW Fixed the incoming transfer form ignoring some capabilities

Security fixes

• LOW Hardened OTP verification against flooding
• MEDIUM Fixed possible privilege escalation issue when changing owner roles in organizations

Bug fixes

• LOW Fixed double-locale URLs (e.g. /en/fr) caused by browser language detection

New changes

• The dataroom view is now a full Drive-like browser: navigate folders, select files, drag and drop them around
• Activity log moved to a dedicated slideover, laid out as a chat timeline
• File icons updated
• Organization admins can export the member list as CSV
• Small sidebar tweaks in the dashboard
• FAQ updated

New changes

• Retyc is out of beta! The platform is now publicly available
• Previously hidden sections are now live
• Reworked About page
• Press section updated with Cnet coverage
• Minor copy updates on the home page

Bug fixes

• LOW Fixed a missing translation in the template transfer form
• LOW Fixed /upload not showing in search engine results

New changes

• Added public sector solutions page
• Reordered navigation links in header and footer for better usability
• Improved image rendering in Nuxt content pages

Info

This is the last beta build. Next up: the official release. Thanks for testing!

New changes

• Add ProConnect as a new identity provider for login and registration (French public service SSO)
• Minor display improvements (loading indicators) and reduced unnecessary API calls
• Updated legal pages (terms of service, privacy policy, DPA)
• Auto purge datarooms events (GDPR compliance)
• Display file absolute path in events
• Export dataroom events to CSV

Bug fixes

• LOW Fix hydration mismatch causing display glitches on some pages
• LOW Fix incorrect cancel URL in the payment flow
• LOW Fix refresh events when renaming a file in a dataroom
• LOW Fix auth status when using external link
• LOW Fix storage cache after a dataroom deletion (could be false in some cases)
• MEDIUM Fix dataroom download/export when some files are in error state (was not uploaded correctly)
• LOW Fix "SecurityError" when using "download all" feature with large lists of files

Dependency security upgrades (as of 2026-05-24)

• Frontend: 12 dependency vulnerabilities fixed → 0 remaining

Infrastructure changes

• Add new security guard: prevent spammer from creating accounts

New changes

• Display a warning when attempting to send a transfer to yourself
• Improved contrast for text and cards across the interface
• Better display of files and file icons in transfer views
• Transfer form on public upload pages now uses full height

Bug fixes

• MEDIUM Fix 500 error when using the "share for me" upload link feature

New changes

• Add Gmail integration page with screenshots and installation guide
• Add "Integrations" entry in the main navigation header
• Reorganize footer: move developer resources (API docs, SDK) to footer

New changes

• Improved display of public transfer forms (/upload and /upload/for-me)
• Reworked encryption key management page for better clarity and usability
• Improved dataroom settings and user management panel
• Performance improvements (lighter page assets → faster load times)

New changes

• Improve content
• When using organization search, disable user already added and add a badge
• SEO improvements
• Disable prerender pages

Bug fixes

• LOW Fix broken links

New changes

• Add new pages/content for Outlook and Thunderbird plugin
• Auto redirect to extra locales (french) when accessing to a transfer page
• Add press kit

Dependency security upgrades (as of 2026-05-03)

• Frontend: 1 HIGH and 4 MODERATE dependencies vulnerability fixed → 0 remaining

New changes

• Add new API attributes for future Outlook plugin
• Add Microsoft login IdP

New changes

• Manage security for future Outlook plugin
• Minor display changes

New changes

• Text images/updates
• Add external documentation + TypeScript SDK links
• Remove easter egg in the dashboard (sorry, we had to do it 😄)

Bug fixes

• LOW Prevent hide social links in bottom when logged
• LOW Fix SEO title/description in /security/transparency
• LOW Force min 8 characters when setting a password in transfer form

New changes

• Add whitepaper
• Upload forms (transfer / dataroom) now feature a fullscreen drop zone and support folder uploads
• Automatically filter out dummy files (e.g. .DS_Store) in upload forms
• Text updates
• Allow deleting a dataroom without unlocking the key
• Key rotation now uses a two-step process (more reliable)
• Transfer to dataroom management no longer creates an unnecessary "root" subfolder
• Add organization user management page
• Minor display changes in changelog page

Bug fixes

• LOW Prevent display errors when loading the dataroom list with pending deletions
• LOW Fix display issues with the transfer form on prerendered pages

Security improvements

• MEDIUM Prevent access to private (encrypted) keys when listing organization members
• LOW Direct downloads of JS/HTML files are disabled to reduce the attack surface and mitigate risks related to malicious script execution
• LOW Remove obsolete private encrypted key when rotation succeeds

Dependency security upgrades (as of 2026-04-03)

• Frontend: 4 HIGH and 5 MODERATE dependencies vulnerability fixed → 0 remaining
• API: 2 MODERATE and 1 LOW → 0 remaining

New changes

• Key rotation is now enabled for all users
• Add SVG icons and logos (for later use)
• Dataroom list ordered by last creation date
• Update texts
• Upgrade all dependencies

Bug fixes

• LOW Prevent some conflict (duplicate file names) in datarooms
• LOW Do not display upload form in dataroom with VIEWER access
• HIGH Fix some issues in key rotation (was not released)

Infrastructure changes

• Memory optimization for some process

Bug fixes

• LOW Fix scheduled task period setup (refresh aggregate storage cache)
• LOW Remove personal data in an some async job logs

New changes

• Add email notifications to bad status account
• Add blur effect in dashboard when keys are not created

Bug fixes

• LOW Fix responsive header on 'sm' mode.

New changes

• Remove waiting list for new users
• Add press carousel in index
• Rework footer
• Change some text and add infos in the pricing page
• Add new images about E2EE (thanks @Limplementeur)

Bug fixes

• LOW Add missing English translations in /dashboard/organization
• LOW Fix bad link (use history.back()) when feature is not enabled in current plan
• LOW Remove useless organization rename feature for free users (organization name is overwritten when subscription is active, so no need to rename it)
• LOW Fix blocks alignment in /dashboard

New changes

• Drop limitations about transfer recipients (non registered users). Add an tech hard limit to avoid spammers.
• Add 'upgrade plan' button in dashboard menu

Authentication changes

• Increase delay for user actions (e.g. email validation, reset password...). From 5 minutes to 15 minutes.

Infrastructure changes

• Add nodes in the cluster to handle more traffic

Bug fixes

• LOW Prevent upload bad file types when using drag and drop in upload form (dataroom/transfer)
• LOW Fix some text about beta support

New changes

• In locale selector, set United Kingdom flag (instead of USA) for english locale.
• In private transfer page (without passphrase), set a login button when not logged in.

Infrastructure changes

• Increase HPA minimum replicas for Retyc frontend pod.
• Increase memory limit for Retyc backoffice/frontend pods.

Bug fixes

• LOW Ensure to load all login buttons (was hidden in some circumstances)
• LOW Ensure token refresh for beta-activated users

Dependency security upgrades (as of 2026-03-22)

• Frontend: 1 CRITICAL dependency vulnerability fixed → 0 remaining
• API: 4 LOW dependency vulnerabilities fixed → 0 remaining

Infrastructure changes

• LOW Fix incorrect HTTP status code returned by WAF on blocked requests in API

New changes

• Add careers page
• Add changelog page

Bug fixes

• MEDIUM Prevent infinite redirect loop after validating an email address, when using multiple tabs
• LOW Ensure to redirect in /dashboard page after login, when using multiple tabs
• LOW Fix English translation in some pages

SEO improvements

• Add XML sitemaps
• Tune robots (prevent index some internal pages)
• Add llms.txt

Notes about beta

• Private key rotation feature is disabled. We will enable it in a next release, after monitoring the system for any potential issues.
• User access must be approved by Retyc administrator