Expiro home
Changelog

What's new in Expiro

Updates, improvements and fixes.

Subscribe via RSS
16 October 2026 v0.111.0

Secure by rule

  • Admins can sign a team member out of every browser from Team, for a lost laptop or a shared computer, without removing them.
  • Admins get an email a week before an API token expires, so an integration does not stop without warning.
  • A custom webhook can now be signed: create a signing secret in Settings, Channels, and your receiver can check that every alert came from Expiro.
  • Opening a link in an email no longer changes anything by itself: confirming a new email address, a guide sign-up or an unsubscribe now takes one click on the page, so a mail scanner opening the link cannot do it for you.
  • Sessions now end after 7 days without use, or 30 days after you signed in. Nobody was signed out by this update.
  • Deleting the account, removing a team member, changing a role, signing someone out, opening the billing portal and switching Require 2FA ask you to sign in again if your last sign-in was more than 20 minutes ago. Turning two-factor off now takes a code from your app, and changing your password asks for the current one.
  • New backup codes are longer, a code from your authenticator app is accepted for a shorter time, and an emailed sign-in link now lasts 10 minutes. Backup codes you already have keep working.
  • Somebody typing wrong passwords at your address can no longer lock you out: with two-factor you still get in with your password and code, and anyone can use Email me a login link.
  • Webhook and chat channel addresses must use https on the standard port and be at most 2048 characters. Every address already saved meets this.
  • Logos above 4096 pixels a side are refused, and photo details such as location are removed from a logo before it is stored.
  • Old sign-in links, expired invitations and old notifications are now deleted on a schedule; a notification is kept for 90 days after you read it.
  • Saved webhook addresses and the Pushover key are shown shortened in Settings, Channels, and the calendar link appears after Show link.
  • If your authenticator code changes while you type it, you are asked for the new one and it does not count as a wrong attempt. With backup codes from before this update you are asked to make new ones at sign-in; the old ones keep working.
  • Exports are limited to 20 downloads in 10 minutes per person, and the calendar feed to 30 requests a minute per account.
  • Signing in with a backup code works again: the code field no longer cuts a pasted code short.
  • Plan limits now hold even when two requests arrive at the same moment.
  • Changing your password long after signing in now asks you to sign in again, instead of showing an error page.
  • Signing up after following a very long link no longer fails.
  • Security improvements.
16 October 2026 v0.110.2

Patch fixes

  • Moving around the app is quicker: New contract, Billing, Settings, Refer a business and other pages in a different part of the app now open straight away, instead of the browser first asking for the page, being turned down and loading it again.
  • Security updates.
15 October 2026 v0.110.1

Patch fixes

  • Refer a business now starts with how it works, in four steps, and tells you exactly what a referral would earn your account - the amount off your next invoice, 30 days of Starter on the free plan, or how much longer your trial gets - with the limits and a link to the full rules.
15 October 2026 v0.110.0

Customers bring customers

  • Refer a business: share your own link from the new page in the sidebar. A business that signs up through it gets a 60-day free trial instead of 30, and is told why.
  • When a business you recommended pays for the first time, you get a free month of your own plan, taken off your next invoice with a line that says what it is for. On the free plan you get 30 days of Starter at once, and on a trial 30 more trial days. Up to 12 a year.
  • The Refer a business page shows every referral, what it earned and where it went - or why it did not count - and updates live.
  • The email saying your trial has ended now waits for your trial's real end date, including a trial that was made longer.
  • Security and stability improvements.
13 October 2026 v0.109.1

Patch fixes

  • Connecting a channel shows, step by step, where to find the address in Slack, Microsoft Teams, Discord, Google Chat and Mattermost, and the JSON a custom webhook receives.
  • Telegram connects from a computer without the Telegram app: scan the code with your phone or choose Open in Web. The bot always answers, and Settings shows the connection without a refresh.
  • Microsoft Teams connects through a Teams workflow. Office 365 connector URLs, retired by Microsoft, no longer work.
  • ntfy starts from a random topic name, so nobody can guess it and read your alerts.
  • The calendar feed link has a Copy button and how to add it in Google Calendar, Apple Calendar and Outlook.
  • Browser notifications say how to unblock them, and what to do on an iPhone.
13 October 2026 v0.109.0

Locked down

  • You get an email when your sign-in email, two-factor settings or backup codes change, when an API token is created, and when you sign in from a browser we have not seen before. An email change can be undone from the old address, and a sign-in or two-factor change you did not make comes with a link to sign you out everywhere.
  • Settings > Security shows every place you are signed in, and you can sign out of any of them or of all the others at once.
  • Planned maintenance is announced inside the app a day ahead, in your own time zone, with a stronger warning fifteen minutes before.
  • Replacing your authenticator app needs a code from the current one, and turning on two-factor, new backup codes and new API tokens ask for your password again if you signed in a while ago.
  • Backup codes are longer. Codes you already have keep working; Settings suggests making new ones.
  • When an admin is made a member, the API tokens they created stop working.
  • Attachments are checked at the moment you click them, and download as files instead of opening in the browser.
  • Reports and reminders sent to an agency's clients come from "Your agency via Expiro", with a daily limit per account and per recipient.
  • Security and stability improvements across sign-in, stored integration secrets, file uploads, PDF reading and imports.
12 October 2026 v0.108.0

Nothing leaks

  • After ten wrong two-factor codes in an hour, signing in with a code pauses for the rest of the hour and you get an email saying so.
  • Alert emails name the client next to the contract, so alerts for contracts with the same name can be told apart in your inbox.
  • While Expiro is briefly unavailable, for example during an update, you see a page saying it will be back in a moment, instead of an error.
  • Deleting your account deletes your attached files from storage too, not only their records.
  • Changing your email address signs you out on your other devices.
  • A webhook that answers with a redirect is reported in Settings instead of being followed: paste the final address.
  • Contract and client names can no longer contain line breaks or other control characters.
  • You will be asked to sign in again once after this update.
  • Members of an account that requires two-factor authentication can now reach the page where they turn it on.
  • Security and stability improvements across sign-in, sessions, exports, integrations and support tools.
9 October 2026 v0.107.3

Patch fixes

  • Settings and Account use one layout: one row per setting, the control on the right, one button style.
  • Settings, Account, the contract form, Import and Templates use the full page width, like Dashboard and Contracts.
  • Your logo on client reports is uploaded with a drop zone, like every other file.
  • Activity uses the full width and says what happened in plain words, with the contract or file it touched.
  • Activity marks only actions that failed or were refused; the detail opens in a side panel.
  • Activity filters sit in one row, with a When list (today, last 7, 30 or 90 days).
9 October 2026 v0.107.2

Patch fixes

  • Show your password with the eye icon inside the password field.
  • Signing up and joining a team ask for your password twice, so a typo cannot lock you out.
  • The password checklist is the one place that says what is missing, and turns red only after you try to save.
  • Passwords set before the new rules that do not meet them are replaced at your next sign-in.
9 October 2026 v0.107.1

Patch fixes

  • Every account now has a password. Signing up asks for one, and accounts that signed in with an emailed link are asked to set one after signing in, with two-factor authentication recommended.
  • Passwords must be at least 15 characters, must not contain your email or company name, and must not appear in a known data breach. A checklist shows each rule as you type.
  • The log-in page leads with your password; the emailed login link stays underneath for anyone without one.
  • You get an email whenever your password is set or changed.