What we shipped, in plain language.

A row-level data authorization engine is now available, restricting users to records belonging to their assigned organisational units:

• Scope data by Company, Plant, and Department dimensions.
• Assign organisational access to users via the Data Access admin screen at /admin/data-access.
• Non-breaking rollout — unassigned users remain unrestricted on a dimension until it is locked down, so existing access is preserved until administrators are ready to enforce it.
• Gated by the new authz.manage permission (Authorization Admin role).

Resolved several user-interface issues across the CRM and Master Data pages, improving form validation, field rendering, and grid behaviour.

The Employee Self-Service portal is now live under /ess ("My Workspace"), giving every employee a single place to manage their own HR information:

• Profile — view personal details and submit edits through an HR-approved change-request workflow.
• Leave — apply for leave, check balances, and track requests through two-level (supervisor → manager) approval.
• Payslips — securely view and download payslips.
• Expense Claims — submit and track expense claims with the same two-level approval routing.
• Company Directory — search colleagues and view contact details.
• Dashboard — a role-based landing page summarising pending actions, leave balance, and recent activity.

New roles introduced: ESS Employee, ESS Manager (supervisor + manager approvals), and ESS HR Reviewer.

An optional security hardening layer ships with the ESS portal to protect sensitive employee data:

• Row-level security ensuring employees only see their own records.
• At-rest field encryption for sensitive personal data.

Both are disabled by default and can be enabled per tenant once configured.

Multi-Factor Authentication is now available for all user accounts:

• Supports any TOTP-compatible authenticator app (Google Authenticator, Authy, Microsoft Authenticator).
• Users can enrol via Profile → Security → Enable MFA; a QR code is generated for the authenticator app.
• Backup codes provided at enrolment for account recovery.
• Tenant admins can enforce MFA for all users in their organisation via the System Administration dashboard.
• MFA status visible in the user management list for admins.

The Real Estate module now includes a Geospatial Report view:

• Interactive map with property pin markers; colour-coded by occupancy status (vacant, occupied, under maintenance).
• Click a pin to open the property summary card with quick links to lease and maintenance details.
• Cluster view for high-density areas with drill-down on zoom.
• Location-based filtering in the property list synchronises with the map viewport.

Usability improvements to the Management Accounting React UI:

• KPI summary cards at the top of the Ratio Analysis page for at-a-glance performance indicators.
• Benchmark comparison — set target values per ratio and visualise variance with colour-coded indicators.
• Export ratios to Excel for reporting and board pack preparation.

The Management Accounting module is now available at /management-accounting:

• Ratio Analysis — compute and track key financial ratios (liquidity, profitability, leverage, activity) from live GL balances.
• Configurable ratio definitions per tenant with formula builder.
• Period-over-period trend charts with drill-down to underlying GL accounts.
• RBAC — MA Analyst (view) and MA Manager (manage) roles.

Sales Orders can now drive a dedicated Sales Order Bill of Materials in the Production Planning module:

• Create a BoM directly from a confirmed Sales Order line, auto-populating the finished good and customer reference.
• Component explosion from the SO BoM feeds directly into MRP as independent requirements.
• SO-reserved stock tracked separately from make-to-stock inventory; UI available at /production/mrp/so-reservations.
• Transfer SO-reserved stock to production with a single action, enforcing reservation rules.

The Environment, Health & Safety module is now live at /ehs:

• Incident Reporting — log incidents with type, severity, location, and immediate actions taken.
• Action Tracking — assign corrective and preventive actions with owners and due dates.
• Attachments & Comments — attach photos, investigation reports, and add threaded comments to incidents.
• Lookup Master Data — configurable incident types, severity levels, and status workflows per tenant.
• RBAC — EHS Reporter (create/edit own) and EHS Manager (full access) roles.

The Real Estate Management module now has a modern React UI accessible at /real-estate:

• Property listing with Syncfusion Grid — filterable by type, status, and location.
• Property detail page with floor plans, documents, and lease schedule.
• Tenant and lease management with renewal reminders.
• Maintenance request tracking linked to Plant Maintenance work orders.

Several minor rendering and validation bugs resolved across Master Data management pages: field alignment, empty-state messages, and dropdown option ordering.

The GST master data seeding migration now uses get_or_create to prevent duplicate key errors when re-run on tenants that already have GST codes configured.

The in-app Changelog page now includes:

• Category badge colour-coding (NEW / IMPROVED / FIXED / SECURITY).
• Module filter to narrow entries to a specific application area.
• Sticky version header while scrolling through a long release.

Usability improvements to the Travel Management module:

• Travel request approval notifications now include the itinerary summary in the email body.
• Claim submission validates advance settlement before allowing final submission.
• Report view updated with additional filter options for date range and department.