Feature log & updates

Features, improvements, and fixes by date — newest first.

October 3, 2026

Access is now granted by approval

Creating an account no longer grants immediate access. Signing up sends an access request to an administrator, and you are notified by email once it has been reviewed.
A new account cannot sign in until two things are true: the email address has been confirmed, and access has been approved. Until then the only available action is confirming your email address.
Existing accounts are unaffected and continue to work as before.
Automated sign-up attempts are now blocked. This change follows a sustained run of machine-created registrations, which also caused confirmation emails to be sent to people who had never asked for one. If you received such a message, no usable account existed and nothing of yours was shared.

October 2, 2026

EzFormBuilder is now version 2.0, rebuilt to handle Controlled Unclassified Information (CUI) under NIST SP 800-171 and CMMC Level 2.
CUI submissions are encrypted, held apart from other data, and every access to them is recorded.
Encryption runs through FIPS-validated cryptography.
All data is stored and processed in the United States.
The CUI tier is granted per account rather than sold as a plan, and requires a DFARS 252.204-7012 contract flow-down on file.
Your existing forms, submissions, documents and signatures carried over unchanged.

June 21, 2026

EzFormBuilder is out of beta. This is version 1.0 — forms, pages, documents and signatures, encryption, teams, and the developer API.
Account limits: content beyond an account’s limit stays visible but is not served until the limit is raised. Nothing is deleted.

June 21, 2026

Added defense against clickjacking: your account, sign-in, billing, and admin pages can no longer be embedded inside another website. Public forms and pages stay embeddable, so anything you intentionally share keeps working.
Continued security hardening across sign-in and billing from ongoing security review.

June 16, 2026

Answers from Name, Address, Person, Table, and Price fields now appear as clean, labeled text everywhere they’re shown — the downloaded submission PDF (your legal record), the submissions table, and CSV / Excel exports. The information was always captured in full; this corrects how a few of these multi-part fields were displayed.

June 14, 2026

Developer platform: a public REST API and outbound webhooks let you create and manage forms, documents, and signing envelopes programmatically, and get notified of events like new submissions and completed envelopes. Create and manage keys under Account → API keys; see the Developers page for the full reference.
Bulk sending: send a document or form to many recipients in one action, with delivery tracked per recipient.
Conditional signing fields: fields and signatures can now appear based on earlier answers, so a signing document adapts to each signer.
Signer verification: optionally require a signer to enter an access code before they can open and sign a document — added assurance for sensitive envelopes.
Continued security and reliability hardening across billing, e-signature, encryption, the new API, and access controls, from several rounds of security review.

June 12, 2026

New admin Encryption & Compliance self-test (Admin → Encryption): one button verifies, on demand, that encryption round-trips and rejects every tampered/wrong-key case, that the audit logs cannot be altered or deleted, and that stored regulated data holds only ciphertext. Run it anytime — it writes nothing.
Signers can now recover an expired signing request: an owner’s “Remind” re-opens a request whose link lapsed (fresh link, new window) instead of dead-ending — so a multi-step signing order can no longer get permanently stuck.
Signed-copy delivery: every signer is emailed a link to view or download their completed document (with the certificate of completion) for 7 days; owners can re-send a fresh link anytime with “Resend signed copy.”
Broad reliability & security hardening across billing, e-signature, encryption, and access controls — including stronger protection against duplicate/double-charged actions, spreadsheet-export safety, and consistent enforcement of team and regulated-data permissions.

June 11, 2026

New Certificate of Completion: download a per-envelope PDF summarizing the signing evidence — signer consent and completion timestamps, the document’s SHA-256 fingerprint, and envelope status.
Signing now records an explicit, timestamped consent to transact electronically on every signature (the consent statement itself was already recorded verbatim).
New e-signature legality page mapping each ESIGN/UETA element to the DocuBuilder feature that produces its evidence, with notes on excluded documents and eIDAS.

June 11, 2026

New session timeout controls: sessions now sign out automatically after 15 minutes of inactivity by default. Admins manage the site-wide default, and every user can pick their own (5–25 minutes, or never) from Account → Security.
New admin Modules panel: platform admins can switch entire modules (Forms, Pages, Menus, Sheets, DocuBuilder) on or off site-wide.
New explainer pages for FormBuilder, DocuBuilder, and Encryption — including what each encryption mode protects and what it does not.
The home, sign-in, sign-up, and password-reset pages were restyled to match the rest of the site.
The footer now shows Log out when you are signed in (it previously always showed Sign in), and signed-in visitors to the sign-in page go straight to their dashboard.
Fixed: logging out now fully clears the session cookie in all browsers.
New About page and this updates log.

June 10, 2026

A site-wide security review hardened access controls across document signing, file uploads, team invitations, and admin tooling.
Document signing links can no longer be used twice, and completed envelopes can no longer be voided or re-sent.
Signup now has stronger rate limiting, and several internal endpoints return cleaner not-found responses.
Stricter cookie policy (SameSite=Strict) for sessions, and team spreadsheets correctly follow team ownership.
Fixed: the notifications inbox can now scroll when the list grows long.

June 7–8, 2026

Per-form encryption modes: encrypted submissions are readable only by authorized key-holders, and reviewer access is granted by key re-wrapping rather than by sharing a password.
Agreement acceptance flow for the regulated encryption mode, recorded per account owner.
Encryption audit log viewable from the dashboard.
Export permissions now follow the account’s entitlements consistently across CSV and bulk PDF.

June 5–6, 2026

Team workspaces: shared items, sealed (encrypted) team content, member roles, and team lifecycle management.
Two-factor authentication (TOTP) with backup codes; platform admins are required to enroll.
Form sharing between accounts, with clean permission boundaries.

May 29 – June 1, 2026

In-app notification center with team presence indicators and follow requests.
Media display fields, menu list editor, and file uploads on public forms (with strict file-type validation).
Dashboard auto-save improvements.

May 25–27, 2026

Signature fields with required/optional slots, email-link signing, and document version integrity checks.
Multilingual forms: per-field translations, automatic translation assistance, and a respondent language picker.
Admin user management console.

Questions about a change? Reach us at support@ezformbuilder.com.