Our changelog and security updates

New changes

• Folders can no longer receive a version by mistake.
• Add a quota on the number of versions a dataroom can have, to prevent abuse and reduce storage usage.

Bug fixes

• LOW Prevented (rare) race conditions in datarooms when two people upload a new version of the same file at the same instant.

Under the hood

• Optimized frontend build (less memory usage, smaller images, faster builds).
• Bun, the frontend build tool, moved to 1.4.2.

New Features

• Public API: organizations can now snapshot and rekey a dataroom through the machine API, listing every file and folder in one call and bringing the organization service account key into datarooms that existed before it was enabled.
• Public API: transfers can now be rekeyed the same way, bringing the service account key into transfers created before it was enabled.

New changes

• Website content clean-up: removed duplicate pages, added missing FAQ answers and icons, replaced outdated content, and added information about reversibility.

New Features

• Organization service account key: add a recovery key to every new transfer and dataroom created by your members.
  • The key appears as a recipient of every new transfer and as a read-only member of every new dataroom.
  • You can disable it and enable it again at any time. Transfers and datarooms created while it was active keep it.
  • This feature is available as an option.

New changes

• Transfers received through an incoming link carry a Deposit badge in the sent list.
• The white paper was revised and is now in version 1.1.0.
• Files added to a dataroom are measured against the dataroom owner's limits (instead of the contributor's limits).

Security improvements

• The API now refuses encryption keys that are not hybrid post-quantum.

Bug fixes

• LOW Fixed a sign-in failure on the authentication callback. The upstream fix landed in nuxt-oidc-auth, so the workaround we were carrying is gone.

About

• Keycloak, our authentication server, now runs in version 26.7.2 on Retyc's infrastructure.
• The upgrade fixes CVE-2026-18963.

Password reset is back

• The "forgot password" feature is available again. It had been disabled on 25 August as a precaution, while the upgrade was being tested.
• Nothing changes for you: the reset link is sent to your email address as before.

Security improvements

• Backend and frontend dependencies were updated to their patched versions.

Under the hood

• The frontend is now built with Bun instead of npm, which shortens install and build times in our pipeline.
• Dataroom creation went through a clean-up and gained unit tests.

Moving away from Clever Cloud

• Keycloak, our authentication server, is no longer hosted on Clever Cloud. It now runs on Retyc's own infrastructure (Scaleway).
• Response time and stability are now better than ever (prevent use reverse proxies from Retyc infrastructure in Scaleway to Clever Cloud).

About CVE-2026-18963

On the day of the migration, CERT-FR issued an alert about a security vulnerability affecting Keycloak. Fixing it requires a major upgrade, and we did not want to roll out that upgrade before testing it thoroughly.

• The "forgot password" feature is temporarily disabled. This is a precaution: it removes any exposure to the vulnerability while the upgrade is being prepared.
• The Retyc team is currently working on the Keycloak upgrade (26.7.x). The feature will be restored as soon as it is deployed.

New Features

• The encryption key can now survive tab reloads (persistance with 2 AES-256-GCM layers, client+server side)
• Public API: organizations can now drive Retyc from their own tools.
• Organization labels: classify your transfers and datarooms, and attach rules to each label.
  • Choose who can receive a labelled transfer: nobody outside the organization, a list of allowed domains, or members only.
  • Allow or forbid recipients without a Retyc account, and external members in datarooms.
  • Cap how long a labelled transfer can stay available.
  • Pick a default label so every new transfer and dataroom carries one, and archive a label once it has been used.
  • Labels are visible to everyone who sees the transfer or the dataroom, recipients included.
• Domain restriction: blocked domains are now rejected when a transfer is created and when someone is invited to a dataroom. Members of your organization are never blocked.
• Member management: a new member page gathers everything the organization knows about an account, its identity, encryption keys, membership type and recent authentication events, with all the admin actions in one place.
• Export your organization data to CSV or JSON (members, datarooms, transfers).
• Display SSO configuration in the organization settings.

New changes

• Dataroom ownership can be handed over to another administrator of the organization, storage accounting included.
• Choose how long dataroom activity events are kept.
• Owners can now delete their own transfers whatever their state.
• Pick which columns to display in the dataroom and deposit lists.
• Disabled transfers are now flagged with a warning badge.
• A dedicated error page in the app, plus responsive and layout fixes across the organization pages.

Breaking changes

• Inviting someone to your organization no longer takes effect while their account is still being created. The invitation applies once the account exists.

Security improvements

• MEDIUM A transfer sent without a passphrase now requires the recipient to be signed in as the intended recipient.
• MEDIUM Closed several ways around the restriction on recipients without a Retyc account.

Bug fixes

• MEDIUM Removing a member now always takes effect, even if the operation has to be retried, and the member is signed out of the organization right away.
• LOW Fixed errors on the billing pages for organizations without an active subscription, and for plans granted outside self-service billing (Enterprise plan / on-premises instances)
• LOW Prevent create/update encryption keys when multiple tabs are in key management page.

Performance improvements

• Authentication events are loaded only when the panel is opened, making the member page faster to display.
• Lower memory usage on the background task infrastructure.

Under the hood

• Reorganized the backend to separate the app-facing routes from the public API.

New changes

• Added a link to the Retyc status page in the website footer
• The footer is now shown across the app, with direct access to the legal pages
• Minor text changes in pricing table

Performance improvements

• Faster database queries

New changes

• Centered hero content on mobile for a cleaner layout

Performance improvements

• Faster page loads on the website thanks to improved caching
• Lower server memory usage for better stability under heavy traffic

New changes

• Redesigned home page with a new layout.
• Reworked product pages
• Cleaner website menu.
• Improved page content and social sharing previews (Open Graph images) on several pages.
• Update demo page

Performance improvements

• Faster authentication
• Re-add prefetching

Bug fixes

• LOW Fixed the storage usage counter when creating or deleting an account.

New changes

• The app now runs on its own dedicated domain, separate from the website.
• New "Get a demo" page to request a live product demo, reachable from the header and footer.
• New design for 'compact mode' for the language selector.
• New header menu in website.

New changes

• New "Deposit box" section to receive files from others:
  • Create a deposit link (a personal upload link people can use to send you files).
  • Create a deposit form (a structured request for specific documents). This unifies and replaces the previous "Transfer for me" links and templated transfers.
  • Multiple recipients (in your organization) to a deposit link/form.
  • Allow deposit with or without a Retyc account.
• New "Contributor" role for datarooms, sitting between Viewer and Editor: contributors can add their own files while keeping limited permissions on the rest.
• Dataroom permissions are now managed per folder, so you can give different access depending on where someone works.
• Added a refresh button in datarooms.
• Clearer product display on the dashboard and a cleaner public deposit page.

Breaking changes

• Old links to "Transfer for me" are now replaced by "Deposits Links".
• Old links to "Transfer templates" are now replaced by new links to "Deposits Forms".

Bug fixes

• LOW Fix allowed file types for organization custom logo.

Under the hood

• Upgraded several frontend dependencies for better stability / security.

New changes?????

• Reworked the user search when adding members to a dataroom
• Clearer message when adding someone who has not set up their encryption key yet
• Small interface polish: easier to click "add to dataroom" from the dashboard, and pointer cursors on switches and tabs

Performance improvements

• Removed duplicate requests in the public transfer form

Bug fixes

• LOW Fixed validation errors showing up by mistake when adding a user
• LOW Fixed email validation in the dataroom add-user search

New changes

• In-app notifications: a bell now shows your recent activity, with a preferences page to pick what you get notified about
• Track your transfers: a new dashboard page shows when your sent transfers are downloaded
• Added status filter to the sent transfers list
• Shorter, cleaner links for shared transfers (no breaking changes with existing links)
• Reworked the transfer table display

Performance improvements

• Faster uploads thanks to adaptive concurrency (up to ~50% faster with small files)
• Removed an unnecessary request when downloading files (up to ~10% faster)

Security improvements

• LOW Hardened email rendering by escaping user-provided values

Bug fixes

• LOW Fixed the incoming transfer form ignoring some capabilities

Security fixes

• LOW Hardened OTP verification against flooding
• MEDIUM Fixed possible privilege escalation issue when changing owner roles in organizations

Bug fixes

• LOW Fixed double-locale URLs (e.g. /en/fr) caused by browser language detection

New changes

• The dataroom view is now a full Drive-like browser: navigate folders, select files, drag and drop them around
• Activity log moved to a dedicated slideover, laid out as a chat timeline
• File icons updated
• Organization admins can export the member list as CSV
• Small sidebar tweaks in the dashboard
• FAQ updated

New changes

• Retyc is out of beta! The platform is now publicly available
• Previously hidden sections are now live
• Reworked About page
• Press section updated with Cnet coverage
• Minor copy updates on the home page

Bug fixes

• LOW Fixed a missing translation in the template transfer form
• LOW Fixed /upload not showing in search engine results

New changes

• Added public sector solutions page
• Reordered navigation links in header and footer for better usability
• Improved image rendering in Nuxt content pages

Info

This is the last beta build. Next up: the official release. Thanks for testing!

New changes

• Add ProConnect as a new identity provider for login and registration (French public service SSO)
• Minor display improvements (loading indicators) and reduced unnecessary API calls
• Updated legal pages (terms of service, privacy policy, DPA)
• Auto purge datarooms events (GDPR compliance)
• Display file absolute path in events
• Export dataroom events to CSV

Bug fixes

• LOW Fix hydration mismatch causing display glitches on some pages
• LOW Fix incorrect cancel URL in the payment flow
• LOW Fix refresh events when renaming a file in a dataroom
• LOW Fix auth status when using external link
• LOW Fix storage cache after a dataroom deletion (could be false in some cases)
• MEDIUM Fix dataroom download/export when some files are in error state (was not uploaded correctly)
• LOW Fix "SecurityError" when using "download all" feature with large lists of files

Dependency security upgrades (as of 2026-05-24)

• Frontend: 12 dependency vulnerabilities fixed → 0 remaining

Infrastructure changes

• Add new security guard: prevent spammer from creating accounts

New changes

• Display a warning when attempting to send a transfer to yourself
• Improved contrast for text and cards across the interface
• Better display of files and file icons in transfer views
• Transfer form on public upload pages now uses full height

Bug fixes

• MEDIUM Fix 500 error when using the "share for me" upload link feature

New changes

• Add Gmail integration page with screenshots and installation guide
• Add "Integrations" entry in the main navigation header
• Reorganize footer: move developer resources (API docs, SDK) to footer

New changes

• Improved display of public transfer forms (/upload and /upload/for-me)
• Reworked encryption key management page for better clarity and usability
• Improved dataroom settings and user management panel
• Performance improvements (lighter page assets → faster load times)

New changes

• Improve content
• When using organization search, disable user already added and add a badge
• SEO improvements
• Disable prerender pages

Bug fixes

• LOW Fix broken links

New changes

• Add new pages/content for Outlook and Thunderbird plugin
• Auto redirect to extra locales (french) when accessing to a transfer page
• Add press kit

Dependency security upgrades (as of 2026-05-03)

• Frontend: 1 HIGH and 4 MODERATE dependencies vulnerability fixed → 0 remaining

New changes

• Add new API attributes for future Outlook plugin
• Add Microsoft login IdP

New changes

• Manage security for future Outlook plugin
• Minor display changes

New changes

• Text images/updates
• Add external documentation + TypeScript SDK links
• Remove easter egg in the dashboard (sorry, we had to do it 😄)

Bug fixes

• LOW Prevent hide social links in bottom when logged
• LOW Fix SEO title/description in /security/transparency
• LOW Force min 8 characters when setting a password in transfer form

New changes

• Add whitepaper
• Upload forms (transfer / dataroom) now feature a fullscreen drop zone and support folder uploads
• Automatically filter out dummy files (e.g. .DS_Store) in upload forms
• Text updates
• Allow deleting a dataroom without unlocking the key
• Key rotation now uses a two-step process (more reliable)
• Transfer to dataroom management no longer creates an unnecessary "root" subfolder
• Add organization user management page
• Minor display changes in changelog page

Bug fixes

• LOW Prevent display errors when loading the dataroom list with pending deletions
• LOW Fix display issues with the transfer form on prerendered pages

Security improvements

• MEDIUM Prevent access to private (encrypted) keys when listing organization members
• LOW Direct downloads of JS/HTML files are disabled to reduce the attack surface and mitigate risks related to malicious script execution
• LOW Remove obsolete private encrypted key when rotation succeeds

Dependency security upgrades (as of 2026-04-03)

• Frontend: 4 HIGH and 5 MODERATE dependencies vulnerability fixed → 0 remaining
• API: 2 MODERATE and 1 LOW → 0 remaining

New changes

• Key rotation is now enabled for all users
• Add SVG icons and logos (for later use)
• Dataroom list ordered by last creation date
• Update texts
• Upgrade all dependencies

Bug fixes

• LOW Prevent some conflict (duplicate file names) in datarooms
• LOW Do not display upload form in dataroom with VIEWER access
• HIGH Fix some issues in key rotation (was not released)

Infrastructure changes

• Memory optimization for some process

Bug fixes

• LOW Fix scheduled task period setup (refresh aggregate storage cache)
• LOW Remove personal data in an some async job logs

New changes

• Add email notifications to bad status account
• Add blur effect in dashboard when keys are not created

Bug fixes

• LOW Fix responsive header on 'sm' mode.

New changes

• Remove waiting list for new users
• Add press carousel in index
• Rework footer
• Change some text and add infos in the pricing page
• Add new images about E2EE (thanks @Limplementeur)

Bug fixes

• LOW Add missing English translations in /dashboard/organization
• LOW Fix bad link (use history.back()) when feature is not enabled in current plan
• LOW Remove useless organization rename feature for free users (organization name is overwritten when subscription is active, so no need to rename it)
• LOW Fix blocks alignment in /dashboard

New changes

• Drop limitations about transfer recipients (non registered users). Add an tech hard limit to avoid spammers.
• Add 'upgrade plan' button in dashboard menu

Authentication changes

• Increase delay for user actions (e.g. email validation, reset password...). From 5 minutes to 15 minutes.

Infrastructure changes

• Add nodes in the cluster to handle more traffic

Bug fixes

• LOW Prevent upload bad file types when using drag and drop in upload form (dataroom/transfer)
• LOW Fix some text about beta support

New changes

• In locale selector, set United Kingdom flag (instead of USA) for english locale.
• In private transfer page (without passphrase), set a login button when not logged in.

Infrastructure changes

• Increase HPA minimum replicas for Retyc frontend pod.
• Increase memory limit for Retyc backoffice/frontend pods.

Bug fixes

• LOW Ensure to load all login buttons (was hidden in some circumstances)
• LOW Ensure token refresh for beta-activated users

Dependency security upgrades (as of 2026-03-22)

• Frontend: 1 CRITICAL dependency vulnerability fixed → 0 remaining
• API: 4 LOW dependency vulnerabilities fixed → 0 remaining

Infrastructure changes

• LOW Fix incorrect HTTP status code returned by WAF on blocked requests in API

New changes

• Add careers page
• Add changelog page

Bug fixes

• MEDIUM Prevent infinite redirect loop after validating an email address, when using multiple tabs
• LOW Ensure to redirect in /dashboard page after login, when using multiple tabs
• LOW Fix English translation in some pages

SEO improvements

• Add XML sitemaps
• Tune robots (prevent index some internal pages)
• Add llms.txt

Notes about beta

• Private key rotation feature is disabled. We will enable it in a next release, after monitoring the system for any potential issues.
• User access must be approved by Retyc administrator