Release date: 4 August 2026 | Previous version: v26.5.0 (23 July 2026)
Scope: Aggregated changes across patches v26.5.1 through v26.5.4. The v26.5.0 minor cut is documented separately in Release Note v26.5.0.
Features
Microsoft Teams channels (new source)
Teams channels can be scanned and classified as a first-class source, with a team and channel picker for selecting exactly what is in scope
Channel messages and replies are ingested as chunked transcript documents, so a conversation is classified as readable text rather than as isolated messages
Files shared in a channel are ingested alongside the transcripts
Notification reports group findings by author and then by channel
Report documents link back to the original message in Teams through a deep link
Transcript authors are resolved to their directory email, so findings map to real people
Delegated message deletion: a policy can delete a caught Teams message on behalf of an authorised data owner, using a custodian token ladder. The notification report shows a banner while that authorisation is still outstanding
Required Graph permissions are Team.ReadBasic.All and ChannelMessage.Read.All, both gated on admin consent only
Slack (new source)
Slack workspaces connect through OAuth, with a channel picker for scoping and a setup guide in the source creation flow
Slack content appears in the notification report tree, scoped by channel and by creator
Enforcement is dispatched to Slack sources like any other source
Ingestion robustness for large workspaces: a file that fails to download no longer aborts the whole channel, threads that keep hitting rate limits are skipped instead of failing the channel, and API retries are paced to reduce rate-limit pressure
Data Owners: by-accounts view
Teams and Slack sources gained a by-accounts view, which expands a channel into the people who posted in it
The same view was extended to SharePoint, with an identity dropdown and a drilldown from accounts into site folders and files
Repository actions
Documents can be copied or moved to a repository as a policy action, across all source types
The action, the policy behind it and any error are recorded per document in the data index
Revert and move repository enforcement is supported for Google Drive and Gmail
The collector handles the repository upload with a copy and move handoff
Workspace migration between servers
A workspace can be migrated from one server or cluster to another without being rebuilt
A new migration worker runs on the API codebase, with trigger, status and list routes
Per-company Elasticsearch export and import, plus Postgres export and import for identity data
Each migration key is pinned to an https callback URL and its expiry is normalised before storage
DLP expansion
Mail attachments are classified separately from the mail body
OCR now runs inside the DLP flow, on a dedicated express queue for tesseract extraction, so DLP work is not held up behind bulk OCR
Configuration is simplified: all external mail is caught by default and the regex configuration has been removed
Transport rules carry a ten-minute lifetime and are refreshed every two minutes, so enforcement disarms safely if the DLP service becomes unavailable rather than blocking mail
Subscriptions and transport rules are synchronised whenever the DLP configuration is saved
Exchange subscriptions are enabled for both block and alert modes
A loop breaker stops repeated OneDrive and SharePoint processing, and cancelled subscriptions are no longer monitored or updated
The same document is no longer notified twice within one day
Subscription counts are exposed in DLP settings and on the source cards, with a reconcile monitor task reporting progress
The tenant domain was added to the DLP configuration and status
Hashed values end to end
Search matches both plain and hashed values, in the detailed view and in reports
Known Persons tagging searches plain and hashed values
OCR labels are replaced with hashed versions when hashing is enabled
Labels that are not displayed in reports can still be queried
Mailstore (IMAP)
Credential validation endpoint, with an apply-and-check button beside the credential fields
Mailstore archive discovery, real folder paths and archive root detection
Scan mode added to the mailstore source, with start failures reported
Redesigned mailstore settings and scan overview
Reporting
AD-group scoped monthly reports, with sendout and settings UI
A notify last-modified-by subscriber toggle
An add-deleted-data-to-total-data setting on tags, with analytics counting deleted data in monitored and profiled totals
Drive fishing
Fishing sources keep fishing on the recurring sweep, and fixed-rate scheduling was replaced with a source sweep
Drive fishing hits are refetched before ingestion, and files that are gone are deleted on fishing runs
OneDrive fishing KQL was reduced to plain search terms
Changes
Sources page: redesigned scan and ingest panels for Mailstore, Graph, Drive, Workspace and Slack sources
Report document preview performance reworked, including the sheets preview
Text editor: text is inserted at the cursor position, list handling was fixed, the image button was removed and HTML and Markdown conversion issues were corrected
Detailed view: label highlighting reworked, with ctrl or shift click to highlight
The no-personal-data empty state was redesigned as a guided status checklist
AI classification moved from Ollama to vLLM, including image description, using a new VLLM_URL environment variable
The AI profiler returns all matches for a text and precomputes noun chunks, and the document name is passed on profiler calls
Danish criminal-behaviour classification updated
Report emails: markdown conversion removed when sending, placeholders treated as HTML encoded, and broken images and links fixed
Path segments use a big solidus in place of a slash across Graph, Google and IMAP
Custom columns on sites and users are updated only when necessary
New security detections for private keys and PuTTY keys, added to the Passwords and Secrets class with hashing enabled
The login background was replaced with an animated version
Bugfixes
API
Reindexing no longer fails when the index is empty
The email retry mechanism was fixed
Report tree fixed for attachments, Gmail label grouping restored in the folder tree, and Gmail rows now link to their source message
All report tree selections are combined with OR, and channel filters are scoped by creator
Report routes return 400 on missing fields instead of a 500
The nightly categorised-data validation now actually validates
Policy validation is dispatched to Gmail and Drive sources
The default proof-of-concept email template no longer arrives as raw markdown
Client
Data Owners no longer lists single documents in the by-accounts drilldown
Enterprise users are no longer shown personal-account UI
Add-deleted-data-to-total-data and delete-subtree can no longer both be enabled at once
Duplicate credential error toasts are collapsed into one
Graph and Teams
Transcript documents are indexed before their text is processed
Name-only sources no longer break the shared source sweeps
Starting an unconfigured Teams source now fails fast instead of appearing to succeed
Elasticsearch-generated ids are propagated in every Teams repository
Null-safe accessible-by comparison in folder permission propagation
Custodian lookup goes through the keyword subfield, with fail-safe not-found enforcement
A SELECTED-mode save resolves teams live from Graph, with a graph-id custodian fallback
Team detection repaired via resourceProvisioningOptions
Null pointer exceptions on error handling and missing site owners were fixed
DS_LastModifiedBy is populated for drive files
IAM and identity
Deleting very large workspaces was fixed with indexes on foreign-key columns and a timeout on the delete notification
Import and export run separate queries per user
Mailstore and IMAP
A wrong password is no longer reported as missing admin rights
The unverified TLS warning is logged once per host
Stopping a source now cancels the delta schedule
Addresses are resolved only for newly found archives
Analytics
AD-group scoped monthly reports used the group id instead of the group name on the first page
Security hardening
Slack OAuth state is single-use, expiring and pinned to a workspace
Source-edit payloads are whitelisted in the Slack, Gmail and Drive edit routes
Slack enforcement dispatch surfaces connector failures instead of reporting a false success
MCP keys are excluded from workspace import and export, and refresh is disabled during an import
Migration keys are pinned to an https callback URL
Graph account deletion is scoped to the caller's own company
Purge with a SELECTED scope is guarded against an unknown scope
Report routes fail with a 400 rather than surfacing a 500 on missing fields
HTML is sanitised in the detailed-view text highlighter