What changed, and what is still rough.

Added

• Windows Hello sign-in. Preview Passkeys (WebAuthn) are now a sign-in method in every deployment. On the Windows app the authenticator is Windows Hello: your face, fingerprint or PIN. Windows Hello verifies you on the device, and the app stores only a public key. First-run setup on Windows offers Set up with Windows Hello, with Use a password instead as an optional fallback.
• Manage your sign-in methods. In Settings, Sign-in & security, add, rename and remove passkeys. Once you have a passkey you can remove your password, and the Windows login page then shows only Sign in with Windows Hello. You cannot remove your last sign-in method. On hosted instances and self-hosted servers the button is Sign in with a passkey, and phones and security keys work too.
• Verified Google and Microsoft accounts. Accounts are bound to the provider's permanent account ID on first sign-in and never matched by email afterwards, and the first sign-in needs an email the provider has verified. A firm's instance can be restricted to its own Microsoft organization or Google Workspace domain. Google and Microsoft sign-in with roles stays Shipped.
• Hosted instances sign in with Google or Microsoft. Password sign-in is off by default there; an operator can turn it on. The first owner opens the private setup link, enters the email of their Google or Microsoft account, then signs in with it. Your firm keeps its own MFA and conditional access, and there are no passwords to manage.

Changed

• The Windows app runs at http://localhost:<port> instead of http://127.0.0.1:<port>, because browsers do not allow passkeys on IP addresses. The port can change each launch, so use the address shown in the app window. Existing installs sign in again once after upgrading. The local MCP address for an agent on the same PC is http://localhost:<port>/api/mcp.

Known limits

• Passkeys and Windows Hello sign-in are in Preview.
• If Windows Hello is lost, recovery needs access to the local install: an operator command on that PC sets a new password.

Added

All of this is in Preview. Nothing here is generally available yet.

• Fair Source release preparation. The license is FSL-1.1-ALv2: free for any use except a competing product or service, with each release becoming Apache 2.0 after two years. License notices, a trademark policy, contribution and security policies are written, and a guarded export builds the public source from the private repository with a fresh history and privacy scans. The public repository is not published yet.
• Windows download. A portable x64 package with its own Node runtime and embedded PostgreSQL. The first launch creates a private local database and opens a one-time setup link. When the app version changes, it backs up the database, restores the backup into a scratch copy, checks that posted entries balance, and migrates only that copy before switching over. An optional per-user installer needs no elevation.
• Hosted instances. A kit for one isolated instance per client: its own app, PostgreSQL 18 database, documents, secrets and domain, with TLS through Caddy, nightly backups proven by a scratch restore, upgrade and offboarding runbooks, and a security checklist.
• Password sign-in and first-run setup. Email and password sign-in alongside Google and Microsoft. The first owner is created through a one-time setup link, failed sign-ins are rate limited, and owners add users and reset passwords from Settings.
• Onboarding. A first-run flow in the app for the first entity, its chart of accounts and its open periods.
• Bring your own API keys. Anthropic, OpenAI, SimpleFIN and Stripe keys entered in Settings, stored encrypted and never shown again. A key set in the host's environment takes precedence over a saved one.
• Agents on the same computer. Connect Claude, ChatGPT, Codex or any compatible MCP client to a local installation from Settings, with Read or Read and Draft scope. Against a hosted instance the same connection works over HTTPS, including from your phone.

Known limits

• The Windows download and the source release are not public. Request early access to be told when they open.
• The Windows package is unsigned unless a release says otherwise, is single-user, and has no scheduled or off-machine backup. Upgrade backups cover the database, not documents or the credentials key.
• This version of password sign-in has no self-service password change or recovery and no forced rotation. Owners reset passwords from Settings.
• Losing the encryption key makes saved integration credentials unrecoverable. Back it up separately from the database.
• Managed hosting is an invite-only beta. Region, retention and the offsite backup destination are agreed per client.
• Your agent on your phone needs an instance reachable over HTTPS. A phone cannot reach an app that runs only on your Windows computer.

Added

• A new identity. Every page is a leaf from a well-kept ledger book: ruled stock, account-coded sections, and totals that visibly balance.
• A capability inventory. The features page lists what is Shipped, Preview or Planned, with the limit next to each claim and nothing untagged.
• Pricing, download, get started, hosting and FAQ pages. The software is free; managed hosting, firm onboarding and support are services, by request.
• Request forms. Early-access and hosting requests are stored in our own database, with your consent recorded, and answered by a person. They go to no mailing list.
• Rewritten legal pages for the current site, pending owner review.

Changed

• Page views are counted by us, in our own database, with no analytics cookies and no third-party script. Your address is never stored.
• Old routes for products that no longer exist now return 410 Gone, and the rest redirect to their new homes.