← datatap.org

Changelog

What shipped, when. Everything listed is live on datatap.org the day it appears.

2026-10-18

  • Nightly janitor, backup and demo reset moved onto the durable job schedule — a machine alive for less than an hour used to skip them (staging had a backup-overdue incident open for two weeks)
  • Ingestion: optional action (add/cancel/modify) and order_id columns on the drop-copy schema, FIX order reports converted to book events, so spoofing and layering fire on client data rather than fixtures; wallet↔account maps and account jurisdiction codes over the API
  • Detection: catalyst verdicts computed per market (information shock vs pre-news repricing) replace the scripted Context Engine; a quote-depletion sweep detector with planted ground truth, 24 cataloged patterns
  • Analyst product: the Overview, Forensics tiles and SAR export rows come from the workspace's own data (fixture kill switches, filings and walkthrough panels now render only in demo workspaces); SAR clocks run from detection, go overdue, stop on a recorded filing and start the 90-day continuing-activity review; pre-trade decisions are logged with the rules hit and the restricted-list version in force, with a 'why was this order blocked?' lookup
  • Platform: per-endpoint webhook subscriptions and six new events (case.opened, case.escalated, sla.breached, killswitch.triggered, guardrail.changed, package.released); GET /api/v1/alerts/:id and /cases/:id; a public OpenAPI document generated from the same table the docs page reads
  • Trust: hash-chained admin and access ledgers with GET /api/v1/audit/verify; legal hold on cases and packages (four-eyes release, blocks offboarding); a one-click exam-kit package; datatap-verify.py recomputes every bundle hash offline; program timeliness metrics on Forensics and in the CCO pack
  • Site: roadmap modules labelled on /pricing and the home page, the throughput claim replaced with the measured figure, and a sourced comparison page at /compare

2026-10-03

  • Structured JSON logs on production (request, tenant, user ids on every line); staging key-rotation drill executed end to end (SECRET_KEY_BASE, then BACKUP_KEY with the previous-key fallback and a restore drill)
  • Walkthrough re-recorded from the scripted path against the current release; market-maker obligation ground truth live on the demo workspace
  • Ingestion: mapping auto-detected from a sample file (one click to apply), the last quarantined upload kept on screen with its reject reasons, ingest.completed / ingest.quarantined webhooks, a weekly end-to-end onboarding canary, and tenant import — an export zip restored into a fresh tenant
  • Analyst product: threshold distance on every tunable alert, per-workspace case templates, saved queue views (sort, page size, named presets), watch items with an expiry and auto-unwatch, a seat-activity summary attached to the package when a regulator or counsel seat lapses
  • Platform & trust: a 2FA policy per workspace (required roles, grace window, enforced at login), scheduled maintenance announced on /status and the feed, deploy rows linked to their changelog entry, a perf-probe trend with an early-warning incident, and a monthly retention report of what the janitor pruned

2026-09-24

  • Client data readiness: column mapper, value vocabularies and time-base per workspace; market schedule and correlated-group registry; accounts, participants, restricted-list and market APIs; presigned direct uploads; a local validator script; duplicate compaction
  • Detection science: calibration report with Wilson intervals and threshold curves, forward shadow mode for thresholds, behavioral co-trading edges, per-account deviation and settlement-integrity detectors, market-maker obligation and real OTR monitoring, composite cases, five more enforcement-anchored scenarios, seasonality profiles
  • Analyst product: pattern checklists on cases, a unified evidence timeline, case merge and split, watched markets and clusters, @mentions, a phone pass, an accessibility pass, and public /docs/methodology linked from every alert
  • Platform: boot-time config validation, per-tenant feature flags, async offboarding, JSON logs with request ids, singleton scheduling across machines, pool tuning with a load test (which found and fixed a concurrent-append race), a rebuild-from-zero script
  • Trust: SOC 2 auditor pack, /subprocessors, incident log with 90-day status history and a deploy log on /status, data classification, secret scanning, key-rotation reminders
  • Go-to-market: profile-specific demo workspaces, an ROI calculator, a counsel partner page, JSON-LD and per-page descriptions

2026-09-23

  • Intraday hot-signal sweep every 15 minutes; watchlist trades trigger notifications on arrival, not at the next scan
  • Pre-trade check API: your gateway asks, DataTap answers allow/block with every check cited (restricted person incl. resolved cluster, price bounds, parity, cluster headroom, kill switch)
  • Alert recurrence semantics (seen-counts, cooldown, flagged re-fires) and escalation chains that write once and don't repeat
  • Account 360 dossiers, disposition macros, one-click regulator seats from a package, Reg 1.31 retention attestation, and a red-team button in demo workspaces
  • ClickHouse adapter complete with analytics parity; cold-tier archival; ingestion load-shed; quota headers; latency on /status; warm expired-demo-link page
  • SSO group→role mapping, Slack-format notifications, scheduled report and export delivery to your bucket, backups encrypted at rest
  • Self-serve demo links on /applicants and /pov, a pricing calculator, the first-scan case study, build-vs-buy itemized, RSS + share cards, a printable one-pager

2026-09-18

  • Three new detectors: marking-the-settle, quote stuffing, front-running patterns — every detector proves itself against planted ground truth (19 patterns total, inventory on the Forensics screen)
  • Drop-bucket ingestion: leave exports at your tenant prefix, the nightly pull ingests them — no client engineering
  • API key scopes (read/ingest) and one-click rotation with a 72h overlap window
  • Price charts on market replay with catalyst markers; keyboard triage (j/k/a/d) on the alert queue
  • Threshold recommendations from your own disposition history — proposals still go through maker-checker
  • Automated monthly restore drills with published results; recurring jobs centralized in the durable queue

2026-09-17

  • Dry-run validation on every ingestion path — full report, zero writes
  • Public status page (/status) with machine-readable health; the 90-day PoV playbook, week-resolved, in-app
  • Layering, stream momentum-ignition, serial pre-catalyst, and money-pass detectors
  • Durable job queue (scans survive deploys), auth rate limiting, perf regression gate in CI
  • Sample PoV report generated live at /sample-pov; pricing, security, and FAQ pages

2026-09-16

  • Streamed 90-day backfills: 250MB uploads, gzip, FIX drop-copy auto-conversion, data-quality warnings
  • Idempotent replay by content hash; per-stream quality panel (gaps, orphan settlements)
  • Off-box backup replication path; 1M-event volume rehearsal published in the open

2026-09-15

  • Demo magic links with hot-lead telemetry; PoV report and Exhibit L generators with print covers
  • Examiner bundles: one document per alert with replay, cluster context, and baselines

2026-09-10

  • Correlated-contract structuring detector (relative outlier test); per-tenant OIDC SSO; entitlements and caps
  • Platform ops dashboard; tenant offboarding purge (the DPA's deletion promise as code)

Cadence, not promises: /status shows the platform's live health.