Vad vi har släppt, och när.

VPN profiles now also work with WireGuard, an SSH bastion, a SOCKS5 proxy or an HTTP proxy, and a failed bastion test shows the host key it presented.

The instance wizard's Network step (AWS) now lists only networks of the chosen region and cloud account, requires a subnet, and the choice reaches the server.

For AWS the instance wizard can now create a new network with a public subnet for the server, on your own account or on a Sencai account.

A new VPN profile can start from an existing OpenVPN configuration file. The file is read in your browser and never uploaded.

VPN profiles let the browser terminal reach servers with no public address: add one in Settings, attach it to an instance, and the terminal connects through it.

Hosted CI has a monthly minute allowance: 30 for a free organisation, more with paid seats, a Minutes tab and e-mail notices at 80 percent and when it runs out.

You can create a server with a container already running: pick an image from your registry, Docker Hub, GHCR or Quay and follow it on the instance page.

Hosted CI: each job runs on its own temporary runner that is removed afterwards, with Queue, Hosted runners and Settings tabs, for approved organisations.

You can scan images in your own external registries: Test scans a repository, scans can be scheduled, and Vulnerabilities has an External registries view.

An instance whose price is not known no longer shows 0 EUR; lists and details show the estimate, the last known price with its age, or Price unknown.

Images you push to your Sencai registry are now scanned for vulnerabilities and signed, and the Registry page shows the findings and verification commands.

Git pages now say when your organisation's Git workspace is still being set up or could not be, with a Try again button, instead of showing empty lists.

The Registry page can now search Docker Hub and Quay.io for images and open a GHCR image by its full name.

AI code review requests no longer stay pending for ever: every request now ends as completed or failed, with the reason.

The organisation's Billing tab is now the one place for plan, costs, invoices and payment, and the old settings pages redirect to it.

The instance page has tabs for Overview, Resources, Agent, Software, Backups, Logs, Monitoring and Activity, and Resources lists what is attached to it.

Organisations can switch on Blueprint review, so new blueprints are submitted for review and published only after it.

Networks and DNS each have a records-in-Sencai view and a live-at-the-provider view on one page, and imported networks link to the same network at the provider.

Auto-remediation rules can now be edited and deleted from the rules page.

Deleting an organisation first shows which Sencai-run resources will be destroyed with it, and you must tick a confirmation before the delete works.

The support pages are merged into one Support centre with tabs, and DPA and MSA now sit in a Legal tab on the organisation page.

Change requests are now a table with filters, history and a detail drawer; approving or rejecting needs a reason, and you cannot approve your own request.

Scaleway and UpCloud servers can now be stopped and started from Sencai (UpCloud keeps billing a stopped server), and the UpCloud wizard offers six more zones.

When you delete a server you can also delete the SSH key Sencai generated for it, and the dialog says when: after the provider confirms the server is gone.

Before deleting an instance or database you can take a final snapshot where the provider supports it, and your organisation can make it mandatory.

Resource detail pages now show a Costs card with the latest billing periods for that resource and a clear mark on figures that are estimates.

Hetzner DNS zones now list every record value, so a zone shows all of its records instead of only the first value of each set.

Managed services has a new Load balancers tab listing imported load balancers with their address, listener count and target health.

You can now start, stop, resize and delete imported instances and manage imported networks, databases and buckets directly from Sencai.

The detail page of imported AWS and Azure disks now finds its source in the inventory and shows live facts instead of a missing-source message.

Azure and OVHcloud storage containers that still hold data are no longer deleted; the delete is refused instead.

You can now exclude resources from your inventory with rules by name or tag, preview what a rule would hide, and turn off the built-in rule for CI runners.

You can resync an imported DNS zone from your provider to add records missing in Sencai. Nothing is deleted and nothing is changed at the provider.

Lists of networks, subnets, security groups, managed services and DNS records no longer stop at the first page, and say so when a list is incomplete.

DNS zones hosted at AWS now show one record per value, including alias and routing-policy records that were previously left out.

Imported resources now show when they are missing or gone at the provider, with a presence filter and a note on what the last scan could not read.

Discovered S3 buckets and RDS databases can be imported as managed services and appear on a new Managed services page. Nothing changes at your provider.

Imported networks can now show their subnets, security groups, routing tables and NAT gateways, brought in from inventory without touching your provider.

Deleting an AWS managed database now keeps its automated backups, so the database stays recoverable for up to 35 days.

The Workspace directory now lists only the users and groups of the organisation you have selected, not of every organisation you belong to.

The instances list and the dashboard no longer drop instances when your organisations hold more than 100 of them in total.

You can now rename a cloud network from its detail page.

Exporting cloud instances now works in any organisation you have switched to, not only in your default one.

A repository deleted shortly after it was created is now correctly removed from your repository list.

Marking all notifications as read now sticks. Previously they came back as unread within half a minute.

After switching organisations, the credential, inventory, compliance and cost lists could come up empty. They now always load the organisation you switched to.

The LLM usage page listed no rows and showed zero tokens and zero cost. It now lists your usage with correct totals.

The Findings tab in Access Management no longer comes up empty when one of your cloud identities has no policies attached.

Listing and creating repositories no longer fails with too-many-requests errors during normal use.

A deleted organisation with single sign-on still enforced could lock its members out of password login for good. Deleted organisations no longer affect sign-in.

Failed actions now show the specific reason, for example that only one free organisation is allowed per owner, instead of a bare status code.

Hetzner servers are now created in the location you choose instead of the default location of your cloud credential.

A cloud credential that still has live servers or other resources linked to it can no longer be deleted.

Live firewall management now covers DigitalOcean, Scaleway and Azure, with allow and deny rules shown separately and rule ordering on Scaleway.

Removing a rule from an already provisioned security group is now refused instead of showing the rule as gone while the provider still enforces it.

Google Cloud firewall policies can now be viewed and managed from Sencai, including the networks they protect; classic VPC firewall rules are shown read-only.

Servers discovered on Vultr, Linode and Oracle Cloud can now be promoted to full cloud instances in Sencai.

When you create an AWS firewall in live management, you can now choose the VPC it belongs to.

New OVHcloud credentials now require the Public Cloud project ID, so the platform never has to guess which project to use.

Create managed MySQL databases on Oracle Cloud from the managed service wizard.

You can now create object storage on Linode and Vultr from the managed service wizard.

You can now create managed PostgreSQL and MySQL databases on Vultr and Linode from the managed service wizard.

Create and remove Oracle Cloud Object Storage buckets from the platform.

Creating a cloud network on a provider where it is not supported yet is now refused right away instead of leaving a record that fails a minute later.

Organisations on the Free plan can now create API keys, the same way paid organisations do.

Every paying organisation now gets 90 days of audit log history, where the smallest paid plan previously got 7.

The instance creation wizard now shows prices taken from provider price lists, with how fresh each price is, instead of fixed estimates.

The DPA signing wizard now always signs the current version of the document and lists an earlier signed version as history.

The Kubernetes agent can now register with the platform over HTTPS; fresh installs no longer fail with a certificate error.

The Plus plan advertised AI features it would then refuse to run. Plus now carries a real monthly AI allowance.

Czech had leaked into the English interface across forty screens, along with Czech date and number formatting. All of it reads as English again.

When you ask for a higher spending limit, you now get an email with the decision — and, if it was declined, the reason.

Checkout could report a successful payment for a paid plan when nothing had been charged. It now refuses instead of activating it for free.

The unpaid-invoice deadline is now 14 days to suspension and 7 more before resources are removed, replacing the previous 30-day window.

Cost screens now say when a figure is an estimate derived from your inventory rather than an amount taken from a provider invoice.

The warning that you are approaching your spending limit had never actually been sent. It now runs on a schedule and reaches you in time.

Most running trials were skipped by the job that evaluates them, so a trial could quietly outlive its end date. Every trial is now evaluated.

The runbook trigger button was disabled for every runbook, and a run awaiting confirmation could never be approved. Both now work.

After paying, customers landed on a page telling them it had moved. Checkout now returns you to a page that exists.

Organisation settings can now edit and validate a VAT number, keeping it consistent with what appears on your invoices.

Creating an instance now offers three SSH options: no key, generate one and show it once, or paste your own public key.

Deploying a blueprint sent no cloud credential, so every public blueprint deployment failed. It now resolves and sends yours.

The DNS section listed no zones, so zone detail could not be reached at all. Zones are now listed and open.

The instance wizard silently discarded the startup script you entered, without any error. It is now sent with the server.

A transient failure syncing an organisation member to Git parked the change permanently. Member changes are now retried and reconciled.

Enrolling an agent now lets you choose which capabilities it gets, instead of always granting the default set.

Three of the registry's five tabs called addresses that do not exist, and the failure looked like an empty result. They now load.

The monitoring screen showed no alert rules and offered no way to add one. Rules are now listed and can be created.

The agent activity log claimed no actions had been taken when it had simply not looked far enough back.

Actions that only wrote a database row no longer report success. Where nothing is actually carried out, the platform now says so.

Thirteen screens replaced the server's specific error with a generic message. They now show what actually went wrong.

Backup policies could not have instances attached from the interface at all, and the attached list rendered empty rows.

The support health overview apologised instead of loading, because it called an address that does not exist. It now returns real data.

A resource excluded from a group vanished, with no way to see or undo it after a reload. Exclusions are now listed and reversible.

A suspended organisation could still invite new members. Invitations are now refused while an organisation is suspended.

An operator opening your audit log left no record of having done so. Those views are now written into the audit trail themselves.

Each organisation now gets a monthly billing statement it can open and export, with VAT applied and every figure traceable to its source.

Storage and traffic prices for Hetzner were wrong by up to eleven times. The price catalogue is now read from the provider itself.

A cost summary could add euros to dollars and label the total with one currency. Amounts are now converted before they are summed.

AI is now included in your plan as a monthly allowance, with anything above it metered and billed separately.

A full month of usage could be quoted above what the provider actually charges. The monthly cap now applies across the whole period.

Usage events reached the billing system with no link to the subscription they belonged to, so metered usage aggregated to zero on every invoice.

Spend on your own cloud accounts is no longer added to your Sencai bill. Only the resources we run for you are charged.

A cloud credential that is missing, expired or short on permissions is now shown as such, with two clear ways to fix it.

An organisation must now explicitly consent before anything runs on a Sencai-owned cloud account, and no such account is granted without it.

Scheduled shutdown is no longer offered for providers that keep charging for a stopped server, and the screen explains why.

Before any resource is removed, a record of what existed is captured first, and it can be read back afterwards.

Secret injection reported success for deliveries that never happened. It now records the failure and the reason it could not deliver.

The browser terminal now verifies the host key before connecting, and refuses the session if the key cannot be checked.

Resources in your own cloud accounts are never deleted over non-payment. That refusal is now structural, with no setting that changes it.

A provisioning request whose credential cannot be resolved is now refused outright, instead of quietly falling back to a platform account.

Cloud cost now counts towards your spend ceiling as it accrues, so the limit reflects real usage instead of nothing

AI usage is now billed to the organisation you actually chose, not an arbitrary one when you belong to several

You can now request a higher platform spend ceiling from the app and follow the decision, instead of writing to support

An organisation can now pay for a member's personal plan from the app; until now sponsorship could only be ended, never started

The platform spend ceiling applies only to usage we bill you for; anything running on your own cloud account is never capped by it

The sponsorship notice now describes what ending it actually does, including the seven-day window before the plan changes

You can set your own spend cap again, even after your organisation has already run up cloud cost this period

If someone already pays for your plan, the app says so instead of offering an upgrade that would bill you a second time

The billing page shows the member limit your plan actually has, instead of inventing one the server does not enforce

New organisations start with a 20 EUR monthly ceiling on spend that runs on our own cloud accounts, and you can ask to raise it

Each owner can keep one organisation on the free tier; further organisations they own need a paid plan

The assistant tells you up front when AI is not part of your plan, instead of accepting a message and failing afterwards

Paid plans no longer differ in features: every paid plan gets the whole platform, and only the price scales with how much you use

Records of processing activities are available on every paid plan, not held back for the top one

Tightened authorisation on trial conversion, so a higher tier and its limits cannot be granted without a completed payment

Audit log responses now state the retention window that was applied, so a shortened list is never mistaken for a complete one

Triggering a certificate renewal now actually renews it, instead of leaving the certificate to expire while the status looked busy

Closing a browser terminal tab releases the session slot straight away, so a few closed tabs no longer lock you out until a restart

A refused browser terminal session now says why — not authorised, session limit, missing credentials — instead of closing quietly

Changing your personal plan is no longer blocked because one of your organisations has too many members

An organisation with no member limit set is genuinely unlimited, instead of being silently capped at three people

One person's trial ending can no longer push an entire organisation into grace period and suspension for having colleagues in it

How many people fit in your organisation is decided by that organisation's own plan, never by an individual member's personal subscription

Promoted networks and disks now open the right detail page

AWS security groups can now be created and edited from Sencai, without ever leaving a rule you rely on switched off mid-change

Every resource now shows the same key facts, whichever cloud it came from

Group cloud resources and see how they connect

A firewall that protects running infrastructure no longer reports zero attachments

A firewall rule submitted without a source is now refused instead of opening the port to the whole internet

Editing the description of a firewall rule no longer deletes the rule

Organisation invitations can be accepted again, including by people who do not have an account yet

Removed internal operations detail that was showing on a settings screen

Password reset and email change links now open correctly from our emails

The auditor role can now be picked when you invite someone or change their role

The browser terminal now uses the address, port and login you set on the instance

Microsoft Entra users and groups now appear in your workspace directory

Confirming an emailed action now brings you back into Sencai instead of leaving you on a bare sign-in page

Changing the TTL of a DNS zone now really applies instead of quietly doing nothing

Cloud inventory now finds 24 more kinds of AWS resource, container clusters and load balancers among them

Registering the same Kubernetes cluster twice updates the existing one instead of creating a duplicate

The browser terminal can sign in to your servers again

Changes made directly at your cloud provider now record who made them, not only that they happened

Agency billing summaries now show each managed organisation's real plan and monthly revenue

Usage is now forwarded to billing for real, and running the sync again never double-counts it

Usage events from managed organisations no longer end up attached to no organisation at all

Create and manage Hetzner private networks, subnets and routes straight from Sencai

DNS zones can now be created, renamed and deleted, not only listed

Adding someone to your organisation gives them access to its Git repositories again

Connect a Kubernetes cluster from the console and issue its registration token there

Define your own health probes and run them across your fleet

Approved updates can now be applied to fleet hosts, not just detected

Profile changes reach sign-in again for everyone who has logged in at least once

TLS certificates are now really issued and renewed for you, not merely recorded

Bulk tagging now works on your real resources, and a dry run counts what would actually change

Browser push notifications are now genuinely delivered to your devices

A pending invitation no longer counts as organisation membership until it is accepted

Removing a user now ends their active sessions straight away

Data erasure requests now stay applied instead of being undone at the next sign-in

Your personal data export now contains your real activity history

Update, software inventory and hardening scan results from your hosts now reach the console

Screens that used to look simply empty now say why there is nothing to show

Guided tours inside the app explain what a screen does and where to go next

Oracle Cloud, Vultr, Linode and OVHcloud are now fully usable as your own cloud account