Changelog

2026

12 Aug 2026FixedWorkforce

Employee numbers are unique within an account and are never handed out twice

A new employee number was worked out by taking the highest one currently in use and adding one. Two people created at the same moment could therefore be given the same number. More seriously, erasing a person under a data deletion request clears their employee number, so erasing whoever held the highest number made the next hire inherit a number that had already belonged to somebody else, silently re-pointing older payroll and contract references to the wrong person. Numbers are now issued by a single allocator that only ever moves forward within an account, and uniqueness is enforced by the database itself, so neither case can occur. Numbers already assigned are untouched.

12 Aug 2026FixedPayrollGroups

Reports • a period covers the same sessions on screen as it does in the export

The group sessions report and the project sessions tab decided which sessions fell inside a month using a different clock from their own exports. Sessions clocked between local midnight and the point the day turns over in universal time were filed under the neighbouring month on screen while the export placed them correctly, so the same account, the same filters and the same period could return two different sets of sessions depending on whether you read them or downloaded them. Both now resolve the period in your workspace time zone, exactly as the exports already did, so the figures on screen and the file you download agree by construction rather than by coincidence. Nothing stored was ever wrong and no correction is needed, but a period you reconciled from the screen alone is worth re-checking against its export.

12 Aug 2026SecuritySecurityRisk

Reduced personal information exposed through public risk-assessment workflows

Publicly reachable risk assessment forms now share less personal information than before. Where such a form needs to identify a person, it shows what is needed to recognize and select them and nothing further, and the privacy protections around these forms have been strengthened accordingly. Nothing changes inside the workspace, where signed-in managers see the same information as before.

11 Aug 2026UpdatedUI

The workspace uses one page width throughout

Workspace pages used one of two outer spacings: a tighter one intended for lists and operational screens, and a roomier one for forms and settings. In practice most pages had moved to the tighter setting and the remainder had not, so moving from a module to its own configuration page visibly shifted the content sideways and dropped the navigation out of view. The tighter spacing is now simply how a workspace page is laid out, so every screen agrees with every other. Spacing inside cards and forms, and the layout of anything printed or exported as a PDF, are unchanged.

11 Aug 2026UpdatedDepartments

Departments • per-user access is configured in Settings

Departments now has a configuration page in Settings, in line with every other module, where individual people are granted access to view or to manage departments. The module has also stopped borrowing its wording from Groups, so its labels describe departments in their own terms, and the earlier operational area wording has been retired everywhere it still appeared.

11 Aug 2026UpdatedProduction PlanDepartments

Production Plan • work can belong to several departments, and rows can be actioned together

A plan item carried exactly one department, which fits neither work that genuinely spans several nor work that concerns everyone. An item can now carry any number of departments, or be marked as applying to all of them, and the filters understand both. Rows can be selected directly in the table and acted on as a set, so a change that used to be repeated row by row is made once across the selection. Locations now display their parent alongside the child, so two similarly named places in different areas can be told apart, and choosing a parent in the picker offers its children with it. A department that has been deleted disappears from the filters, the pickers and the import, while rows already classified to it keep displaying its name so history stays readable. An archived department is different: it stays in the filters, marked as archived, because items classified to it still render and still need to be found. Importing a plan no longer leaves the app's own status wording behind in the comment as stray text.

11 Aug 2026FixedBilling

Billing • capability lists never show an internal key in place of a description

When a capability was added to a plan or an add-on before its description had been written, both the public pricing page and the subscription page inside your workspace printed the capability's internal name as a bullet, so a list could read as a fragment of code. A capability without a description is now left out of the list entirely until it has one, on both surfaces, so such a list is always shorter rather than wrong. The Ops add-on's capability list has separately been brought up to date and now names Production Plan and Departments.

11 Aug 2026FixedPayrollClockwork

Clockwork • editing a session no longer clears a project or group the form never showed

The session edit form hides the project selector when Projects is switched off and the group selector when the account has no groups, but saving wrote both fields regardless. Adding a note to a session in an account with Projects disabled therefore cleared that session's project without saying so, and because payroll scoping filters on project and group, the session then dropped out of a scoped export with nothing stated anywhere. Saving now writes only the fields the form actually offered you. A stored project or group that is no longer in the list, because it has since been archived or deactivated, is preserved through an unrelated edit rather than being cleared by a control that could not display it. Changing a field payroll depends on, meaning the project, the group or the overtime override, now withdraws an existing approval, because a signoff covers both the hours and what they are booked against. Editing the task or the note is an annotation and does not.

11 Aug 2026FixedPayrollClockwork

Sessions • re-importing a file you exported updates those sessions instead of duplicating them

Export, edit, import is a documented way to correct a batch of sessions, but the importer could only create. Importing a file that had just been exported therefore added a second copy of every row in it, which across a month of sessions meant a doubled payroll basis. The export now carries an identifier for each session in its first column and the importer uses it: a row whose identifier matches a session in the account updates that session, and a row without one is created as before. Only the columns actually present in the file are written, so importing a file that omits project or group cannot blank the classification those sessions already carry. A file naming the same session twice, pointing at a session belonging to somebody else, or targeting an open or cancelled session is rejected outright rather than quietly creating a new row instead. The preview now labels every row Create or Update before you commit. Files exported before this change have no identifier column and continue to import as new sessions. This does not undo duplicates written earlier, so if you have ever re-imported an export, the affected period is worth checking.

11 Aug 2026SecuritySecurity

Improved authorization checks for file downloads

Access controls for documents and file downloads have been strengthened across the workspace, so that files are available only to users authorized to see them. This covers every kind of attachment the workspace serves. Nothing is required from you, and normal access to the documents in your own account is unchanged.

10 Aug 2026FixedClockwork

Clockwork • editing a session that started after you opened the page

The Clockwork tables refresh by themselves every few seconds, but the data behind the edit dialog was read only once, when the page first loaded. A session clocked in after that had nothing behind it, so its Edit button did nothing at all, with no error to explain why. A session clocked out or adjusted after the page loaded still carried its old values, so the dialog opened showing the wrong times or an empty time in. The edit data now travels with the rows it describes and is read again every time the dialog is opened, so Edit works on any row on screen and always shows what is currently stored. Nothing recorded was affected, and no correction is needed on existing sessions.

10 Aug 2026UpdatedSecurityUI

Signing in goes straight to your workspace, and a failed attempt keeps your email

If you have access to exactly one workspace and no platform administration, signing in now takes you straight there instead of stopping at a picker holding a single tile. Anyone with more than one destination still sees the picker. Separately, a sign-in that does not succeed no longer throws away the address you just typed. A wrong password, too many attempts, a failed spam check, or a form that had been open long enough for its session to lapse all return you to the login page with your email still in the field, so a retry costs a password rather than a full retype. The address is held in your session only and never appears in the address bar or in a link. Finally, when several tabs are open and the idle timer runs out, one tab signs out and the rest follow it, rather than each signing out on its own and leaving the tab you were typing in unable to submit.

10 Aug 2026AddedDashboardProduction Plan

Dashboard • three operational columns for the work you own

For accounts running Ops, the dashboard now answers three separate questions instead of showing three views of one list. My tasks is the production plan work you are personally named on. My departments is outstanding work in the departments you belong to, whether or not you are responsible for any of it, with a pill for each department. Up next is a timeline: the status changes that have actually happened recently, the current moment, then what is scheduled after it. All three columns read the same shape, Overdue, Today, Tomorrow and Later, so one reading works everywhere. Today always shows, falling back to a quiet empty line, because having nothing scheduled today is itself worth knowing. Overdue, Tomorrow and Later appear only when they hold something, so an empty heading never takes up room. The columns refresh on their own and link straight into the plan and the checklist.

10 Aug 2026AddedDepartmentsWorkforceGroups

Departments • organise work and record who belongs where

Departments is a new Ops module holding the organisational structure behind your production plan. A department can have subdepartments, two levels deep, and every one of them keeps its own member list. Membership is recorded per department and is independent at each level: adding someone to a subdepartment does not add them to the parent, and one person can belong to a parent and a subdepartment at the same time. The member count shown on a department is always the people in that department itself, because that is the set the bulk actions act on. From a department you can request profile, competence, or food and allergy information, regenerate PIN codes, change project, move every member to another department, or clear the member list. Each action previews a real count of who it will touch before you confirm, nobody is deleted, and no other membership is affected. A person's profile now lists every department they belong to. Departments carry organisational structure only. Payroll, contracts and registration forms stay with Groups, and the Groups description in module settings has been reworded to state the difference: a person belongs to exactly one group, but to any number of departments. If you were already classifying production plan work by area, those areas are now departments and every plan row kept its classification.

10 Aug 2026AddedProduction PlanSuppliersLocations

Production Plan • the operational master list for a project

Production Plan is a new Ops module that replaces the production spreadsheet most teams keep alongside the system. It is scoped to a project and opens on the project you are working in. Every row is one piece of work carrying a date, a start and end time, what happens, a type, a department, one or more locations, the people responsible, a supplier, labels, a priority and a status. Rows are edited straight in the table, one cell at a time, and saved as you go. If someone else changed the same row while you had it open, you are shown their value before anything is overwritten. New rows are added at the top of the table, several at once if you want, and the plan loads a hundred rows at a time so a long plan stays fast. You can filter by phase, department, location, type, label, responsible, priority, status and a date range with Today, Current phase and All presets, and search the text of the plan; the label and responsible filters can match any or all of what you pick. The table refreshes on its own so a plan open on several screens stays in step, and rows that are past their deadline are marked. Three views share the same rows. The plan is the working table. The checklist is the field surface: start a task, record how many of your own and external people are on it split into supervisors and crew, then close it, with a quick OK for work that needs no run at all. The supplier list groups the plan by supplier so you can see and print everything one supplier owes you. Every view prints. Scheduled shifts for the project appear in the plan as locked rows showing capacity and how many places are filled, which you can turn off in the module settings. Types and labels are managed on a Variables tab: standard types come with the platform and can be hidden, and anything you add belongs to your workspace only. An existing production plan spreadsheet can be imported from Settings, pasted straight out of the sheet or uploaded as a file. Before anything is written you get a reconciliation screen stating exactly what will be created, what will be skipped and what could not be read, and a source that has already been imported into the project is recognised so you cannot duplicate it by accident.

7 Aug 2026UpdatedUILocalization

Date fields follow your language, not your browser

Date fields took their format from your browser or operating system rather than the language you chose in HR Cluster, and there is no way for a page to ask them to do otherwise. A Norwegian workspace could therefore ask you to type a date as mm/dd/yyyy in a form while printing that same date as dd.mm.yyyy everywhere else on the page, which is exactly the mismatch that produces a wrong date. Every date and date-and-time field in the workspace now shows the format of the language you are using, including fields inside dialogs and fields that appear only after the page has loaded. You can type the date and common variations are accepted, or open the calendar with the button beside the field. A date that cannot exist is flagged as you type instead of being silently rolled forward into the next month, and your last valid entry is not discarded while you correct it. On phones and tablets the native picker is kept, and now carries the right format too.

6 Aug 2026SecuritySecurity

Pages that refresh on their own no longer keep you signed in

The dashboard, Clockwork and the Power live view refresh by themselves so the numbers stay current without you reloading. Until now each of those background refreshes counted as activity, which meant a browser tab left open on one of those pages never reached the idle sign out, even with nobody at the screen. Those refreshes now keep the data current without extending your session, so the idle sign out and its warning apply on every page. If you are actually working, nothing changes: moving around the workspace, submitting a form, or choosing Keep me signed in all extend the session as before. If you run a screen that is meant to stay on permanently, such as a wall mounted display, use a public dashboard link instead, which requires no sign in and has no session to expire.

6 Aug 2026FixedSchedulingContracts

Schedule • lists that depend on the current time now use your workspace clock

Views that ask what is happening right now were comparing against the wrong clock, again by your time zone offset. Starting soon and ongoing could leave out a shift that had genuinely already started, and could label a shift that began an hour or two ago as about to start. The upcoming shifts list a worker sees in self service, and the upcoming shifts export, could include shifts that had already begun. Contract reminder emails could name an already started shift as the recipient's next one. The no shifts filter on the user list could hide a worker whose only shift had just started. All of these now resolve the current time in your workspace time zone, so what you see matches what is actually happening.

6 Aug 2026FixedRiskScheduling

Shift and risk assessment times are shown exactly as you entered them

Some places showed a shift or risk assessment starting an hour or two later than the time that was actually entered. The offset matched your workspace time zone, so it was easy to miss: the time looked plausible, just wrong. This affected the risk assessment detail page and its PDF export, the shift picker inside a risk assessment, and the pending signup approvals list. It also affected the email sent to risk assessment participants, which meant people outside your organization could be told a safety activity started later than it did. All of these now show the time as entered. Nothing stored was wrong, so corrected times appear immediately on existing records with no action from you. Separately, when shifts are imported from a CSV file whose times carry a time zone offset, those times are now converted into your workspace time instead of being stored as written, and the import preview tells you how many rows were converted. Files without an offset, including exports from HR Cluster itself, import exactly as before.

5 Aug 2026AddedIncidentsSuppliers

Incidents • share an incident summary with the supplier involved

When an incident involves one of your suppliers, you can now send them a summary so they can act on it. The incident form already suggested your suppliers under company involved; picking one from the suggestions now links the incident to that supplier, and the incident page then offers a share action, both next to the share history and under quick actions. If your account receives incident notification emails, those emails now also carry a Send to supplier button when a supplier is linked, taking you straight to the review step. The button works even if you are signed out when you click it; after signing in you land directly on the incident with the share dialog already open. Nothing is sent automatically. A manager writes or reviews the text that will leave the organization, chooses which uploaded images to include, sees exactly who will receive the email, and confirms. The email carries the reference, type, date and time, project and location together with the approved text and images, and deliberately contains no link, no reporter name and none of your internal follow-up notes. It goes to the supplier's contact email, or to a dedicated incident email list you can set on the supplier when reports should reach a safety mailbox instead. The person on your own team responsible for the supplier receives the same summary. Either recipient can be turned off in the incident module settings, and every share is recorded on the incident with who sent it and who received it.

5 Aug 2026FixedSettingsMessaging

Email delivery • the date filter matches the dates on screen

The email delivery log lists every message in your workspace timezone but filtered by date in UTC, so the two disagreed around midnight. A message shown as sent just after midnight could be returned when you filtered for the previous day and be missing when you filtered for the day it displays. Filtering now uses the same calendar day the list shows.

5 Aug 2026SecuritySecurity

Form submissions with an empty security token are rejected

Every form in the workspace carries a token that proves the submission came from a page we served, and that token is checked against one held for your session. If the stored copy had been cleaned up while you were still signed in, an empty token could compare as equal to an empty stored token, and a submission carrying no token at all would pass the check. Both sides must now be present before the comparison happens, so a request with no token is refused. The only case this changes is a request that carries no token and has no stored token to compare against; normal submissions, including ones made after a session has lapsed, behave exactly as before.

5 Aug 2026FixedSecurity

Remember me now lasts the full 30 days

Choosing "Remember me" at login was meant to keep you signed in for 30 days, but the session behind it still expired after an hour without activity. The browser kept the sign-in for a month while the server had already let it go, so you were asked to log in again far sooner than expected. The chosen length is now recorded with the login itself and is respected for the full 30 days. Sessions that are already open are unaffected and keep the length they were created with.

5 Aug 2026AddedSecurity

A warning before an idle session signs you out

A normal login lasts an hour of inactivity, and until now it ended without notice, which looked like being signed out at random. For the last two minutes you now get a countdown with two choices: stay signed in, or log out. If the countdown runs out, the login page explains that the session timed out rather than leaving you guessing. Moving the mouse is not enough on its own to keep a session alive, and that is deliberate: the page confirms with the server only while you are genuinely working, so an unlocked machine left alone still times out. Sessions started with "Remember me" are unaffected and get no countdown.

5 Aug 2026AddedSettingsGroups

Settings • give a whole group access to a module

The access list on a module used to be one person at a time. Searching now returns groups and subgroups next to people, and choosing one grants access to every eligible member in a single action. Typing the name of a parent group also brings up its subgroups, and a top level group covers everyone beneath it. Before anything is saved, a confirmation tells you how many people will be granted access, how many already have it, and how many were skipped and why. Access is given to the people who are in the group at that moment, so someone who joins the group later does not inherit it automatically. The selection control itself has been rebuilt on the same picker used elsewhere in the workspace, so it behaves and looks the same as assigning someone to a shift.