Our latest release on 4th June 2026 includes a set of practical platform updates that make Kyboa easier to manage, easier to audit and easier to integrate with client workflows.
The main changes cover account users, security, timezone settings, safer registry re-import, exports and the first client API surface.
Account users and role-aware access
Kyboa now supports a clearer account-user model for client accounts.
Account administrators can manage users within their own organisation, including inviting users, resending activation, updating display names, changing role or active status, archiving users, disabling a user’s 2FA for recovery, and revoking an API user’s current token.
The user model now supports a simple role structure for normal platform users, account administrators and API users. This keeps access management practical without introducing a complex permissions system.
My Account security and optional 2FA
Each active user now has access to a My Account page where they can manage their own password and security settings.
Optional authenticator-app two-factor authentication is now supported. Once enabled and confirmed, the user completes a second login step after password validation. This gives teams a straightforward way to strengthen account security without making 2FA mandatory for every account.
Account timezone settings
Accounts can now use an account-level display timezone. This improves how users read screening timestamps, entity history, report subtitles, PDF headers and export date ranges.
Kyboa stores first-party timestamps using a canonical UTC model while rendering user-facing timestamps in the account display timezone. This helps reports and exports better match the way each customer expects to review activity by date.
Safer entity re-import from registry sources
Registry re-import now supports two refresh modes for maintained entities:
- Destructive overwrite, which preserves the original replace-and-version behaviour.
- Fill blanks only, which fills missing fields without overwriting populated values.
The new fill-blanks mode is useful when an entity already has manually maintained information but could benefit from newly available registry data. It can append new registry-derived child rows and fill empty subfields while preserving existing local data.
New export surfaces
Kyboa now has expanded audit-facing export support.
- Entity screening exports allow users to export completed screenings linked to a selected maintained entity.
- Entity summary exports provide a maintained-entity inventory view with useful summary context and latest completed screening information.
- Entity record PDF export allows users to download a point-in-time PDF of the maintained entity record directly from the View Entity page.
These exports are designed to help users evidence maintained CDD records, screening history and entity-level compliance activity without exposing raw provider artifacts or turning exports into a raw data dump.
Client API now available for selected workflows
Kyboa now includes a narrow client API surface for selected integration workflows.
The current API supports authenticated context checks, quick screening creation and polling, entity duplicate checks, minimal entity creation, explicit entity screening triggers and compact entity screening history.
This is not yet a full public developer platform. It is intended for controlled client integrations where a customer system needs to push names or entities into Kyboa and retrieve screening status. Contact us if you would like to discuss API access for your account.
API Management for integration users
API users now have a dedicated API Management page. It supports the current one-token model: generate a token when none exists, regenerate by replacing the current token, or revoke the current token.
Plain tokens are only shown immediately after generation or regeneration and cannot be retrieved later. This keeps the API workflow simple while avoiding accidental exposure of token secrets.
Together, these updates make Kyboa more practical for real customer accounts: teams can add users, strengthen login security, align timestamps to their timezone, export useful audit records, refresh entity data more safely and begin selected API integrations where needed.
