Product updates
Changelog
What we shipped, in plain language. EonPro deploys continuously; this page summarizes customer-visible changes by month. Security fixes are listed as soon as they are live.
September 2026
- Security
Session replay fully masked
Front-end session replays used for debugging now mask all on-screen text and media and no longer capture request or response bodies, so no patient information can appear in a recording.
- Security
Document storage endpoints require sign-in and scope
Every document-storage API now requires an authenticated session; patients can only reach their own files, non-clinical roles have no access, and access to patient documents is written to the audit log.
- Security
Hardened bootstrap and audit-log integrity
The one-time administrator bootstrap endpoint is disabled in production, and audit-log tamper-evidence signing now refuses to run without a configured secret instead of falling back to a default.
- Security
Multi-factor authentication at login
Enrolled users are challenged for an authenticator-app or backup code at every sign-in. Administrators and providers are guided through enrollment and MFA becomes mandatory for those roles after a short grace period.
- New
Shipping claims ledger and refund tracking
A plain-English ledger of carrier money-back-guarantee claims, a pickup-scan clock, and a contract rate card so clinics can see exactly what a late or missed shipment is worth and export a dispute packet.
- New
GoHighLevel marketplace app (early access)
OAuth-based connection to GoHighLevel with intake-to-contact sync, laying the foundation for two-way CRM integration.
- Improved
Faster patient lists, provider queue and dashboards
High-volume list reads now run against a read replica with read-your-writes protection and lag-aware health checks, taking load off the primary database and cutting page load times during peak hours.
- Fixed
Every patient email is branded for the clinic
Transactional emails (order confirmations, reminders, portal invites) now consistently carry the clinic’s name and branding rather than the platform’s.
- Improved
Notification badges load instantly
Unread counts are served by an index and lists are loaded only when opened, removing a heavy query from every page view.
- Improved
Capacity alerting and fair scheduling
The platform now alerts on database capacity signals and prevents one busy route from starving others of connections.
- Fixed
Vial label color corrections
Several compounded-medication label variants were recolored so no two strengths or vial sizes share the same color bar.
August 2026
- New
Package-photo reporting workspace
One Reports tab replaces three separate drawers, with zero-filled intervals, clinic-timezone “today”, and calendar-safe week boundaries.
- Fixed
Billing safeguards
$0 invoices and paused subscriptions can no longer trigger product shipment; conversion events fire from the canonical payment webhook only.
- Security
Dependency security updates
Patched high-severity advisories in js-yaml and nanoid across the web app, mobile app and Zendesk sidebar.
- New
Chain-aware patient unmerge
Admins can safely reverse a false-positive patient merge, including merges that were chained through multiple records.
- Improved
New pharmacy SKUs and clearer rejection messages
Additional compounded products can be dispensed through partner pharmacies, and the prescription queue now names the exact fields a pharmacy rejected instead of showing a generic error.
- New
Patient roster CSV export
Admin-only, date-ranged export of the patient roster (including cancelled subscriptions), generated in the background so large clinics never hit a timeout.
- Improved
Prescription queue split by licence and pharmacy
Providers see only the patients they are licensed to treat, and orders route to the correct pharmacy by state automatically.
- Fixed
Clinic favicon on every clinic host
Browser tabs on clinic subdomains and vanity domains now show the clinic’s own icon.
- Fixed
Multi-clinic provider picker
Providers credentialed at more than one clinic are asked which clinic they are working in at sign-in.
- New
Zoho billing enrichment and payment webhooks
Payment events can now enrich Zoho records for clinics that run finance in Zoho.
- Improved
White-label patient emails
From-name and branding on patient emails follow the clinic, and pharmacy tracking surfaces faster when carrier webhooks are delayed.
July 2026
- New
Custom intake domains
Clinics can serve their intake funnel from their own domain with clinic-scoped branding, pricing and payments.
- New
Specialty SOAP note drafting
AI-assisted SOAP drafting gained a specialty-specific prompt for hormone therapy visits; drafts always require provider review before signing.
- New
Rep performance dashboard
Per-representative accountability metrics and a neglected-conversation queue for patient chat.
- Improved
Code-quality gate
Lint debt was cleared and a blocking gate added so regressions cannot merge.
- Security
Runtime and dependency security
Upgraded to Node.js 22 LTS ahead of the Node 20 end-of-life and resolved all critical and high dependency advisories in the mobile and Zendesk apps.
Looking for uptime and incidents? See System Status. Security practices are described on our Security page.