1.0 Document Purpose
This document provides a summary of the highlights of the CoreStream GRC Release 3.2 release. Major Platform releases are finalized every 2-3 months depending on client and strategic priorities. These release notes are part of CoreStream GRC’s approach to keeping clients and partners informed of the improvements we are delivering.
This document summarizes the key user stories and issue fixes, categorized in the following ways, and specifies whether the change is available automatically as part of the upgrade, or requires a configuration change.
| Strategic Features | The introduction of new Platform features considered to be of strategic importance. |
| Core Features | Improvements to existing features or new functionality that is more limited in scope than the strategic features. |
| Configuration Improvements | Changes relating to improvements to our approach to configuration, focused on improving the efficiency, accuracy and consistency of Platform configuration. |
| Issue Fixing | The resolution of Platform issues. |
| Integrations | External applications or systems that CoreStream GRC has integrated with. |
| Technical | Improvements to the technical Platform elements. These improvements are typically non-functional. |
Please note that each category will not feature in every release update and some may be more heavily weighted towards certain categories. As always, the plan is to focus on those items that add the most value to our clients.
2.0 Platform Team Overview
CoreStream GRC 3.2 is now live, delivering a suite of improvements focused on flexibility, usability, and efficiency. The main focus of the release was our single object hierarchy. This initiative allows hierarchies to be managed more flexibly with dynamic limits and delivers performance and functional improvements such as the ability to perform reorgs and retain a full version history of such changes. This has been a huge undertaking and credit as always to the Development team here at CoreStream GRC.
Another standout enhancement is the additional navigation grouping, which helps users manage larger, more complex site structures while keeping navigation clear and intuitive.
We’ve also invested in speed and efficiency, with faster configuration updates on larger sites and enhanced tools for testing and validating configurations, including expanded capabilities in the Site Health Checker. Other highlights include improvements to SharePoint attachments, spell checking in rich text fields, character count validation, enhanced keyboard accessibility, and smarter handling of API exports and deletions. Collectively, these enhancements streamline daily workflows, reduce manual effort, and support our configuration teams in delivering more efficiently for clients.
The next release (3.3) will run to the end of the year and so increase our typical delivery from 2 months to 3. Expect great things!
Rich & Cam
3.0 Release Notes
3.1 Strategic Features
Additional Navigation Grouping
Configuration Required
As more clients bring larger and more complex systems into CoreStream GRC, we’ve introduced a new level of navigation to keep things simple and intuitive. Previously, navigation was structured by Entity, Navigation, and Sub-Navigation. With 3.2, we’ve added Entity Groupings, allowing you to sub-divide Entities into distinct groups that present as their own “site” when navigated to. This is a purely visual enhancement – data and screens can still be shared flexibly across groups – but it adds another level of customization for clients who want clearer structure and easier navigation in large implementations. To make things even more flexible, you can now brand these groupings with your own images or logos, rather than being limited to icons, giving each grouping a clear visual identity.
Sorting on Axis and Value of X/Y Charts
Automatically Added
We’ve added new flexibility to X/Y charts by making sorting available both at the configuration level and within each user’s personalized view. Charts can now be sorted ascending or descending either by the axis value field (e.g., sorting Risk Registers alphabetically) or by the numerical values themselves (e.g., ordering Registers by the highest to lowest number of risks). This makes it easier to tailor charts for quick insights and clearer data storytelling.
Single Object Organizational Hierarchy
Configuration Required
As organizational hierarchies grow larger and more complex, greater flexibility is essential. In 3.2, we’ve re-architected the tree view (and many related components) to support a single object hierarchy. Instead of requiring one distinct object for each level of the hierarchy (e.g., “Organization Level 1,” “Organization Level 2,” etc.), we can now use a single object that looks up to itself to determine the level and build the tree structure you’re familiar with.
This change brings several important benefits. First, it removes the limit on distinct levels – if you add a record pointing to an existing level 5, it automatically becomes level 6, without needing a new object. Second, it makes reorganizations much easier: what was previously a level 3 can now be moved under another branch and become a level 5 simply by repointing it, with no need to copy data between objects. Crucially, this approach preserves full version history and removes the manual overhead of restructuring hierarchies. The result is a more scalable, more robust way to manage complex organizational structures in CoreStream GRC.
Consolidated Hierarchy
Configuration Required
Alongside the move to a single object hierarchy, we’ve reworked the consolidated hierarchy to match. Instead of combining multiple links to different organizational hierarchy objects, the new approach points to just one object while still displaying the familiar tree-like structure. This makes configuration simpler, reduces duplication, and ensures users can easily navigate and select the level they need without losing any of the hierarchy’s clarity or functionality.
New Synchronization Tool
Configuration Required
To support the single object hierarchy, where objects point only to their immediate parent, we’ve introduced a new synchronization tool to handle cases where user data still needs to be inherited from “grandparent” levels. Unlike our overnight background services, this tool can run instantly on an individual item, synchronizing its data immediately. This ensures inherited relationships remain accurate and up to date, while giving configurators a fast, on-demand way to keep everything aligned without waiting for scheduled jobs.
3.2 Core Features
Data Deletion Jobs
Configuration Required
Permanent data deletion needs to be handled carefully and sparingly, especially since the alternative of “soft deleting” (hiding records via permissions) is often safer. However, data retention and protection regulations sometimes require complete removal. To support this, we’ve introduced configurable data deletion jobs that can periodically ‘hard delete’ records based on defined criteria. For example, under GDPR rules, personal data may only be kept for as long as it is necessary for its original purpose. A deletion job could automatically remove records containing personal information after a set retention period, ensuring compliance without manual intervention.
Spell Check in Rich Text Fields
Automatically Added
For a long time, spell checking wasn’t available in our Rich Text (WYSIWYG) fields. While our third-party editor supported it, the options typically relied on external services, which wasn’t a good fit for CoreStream GRC. Recently, however, it has become possible to enable the in-built browser spell checker directly within these fields. This means Rich Text inputs now benefit from the same spell checking you already use in standard text fields, helping users quickly spot and correct typos without extra effort.
Editing Column Names in End User Export Wizard
Automatically Added
Based on user feedback, we’ve enhanced the End User Export Wizard to allow column display names to be edited directly. While default names are still provided automatically, users can now adjust them as needed – for example, when exporting linked content that includes multiple identically named fields like “ID” or “Title.” This puts control in the hands of users, making exports clearer and reducing the need for manual intervention by Support or Project teams.
3.3 Configuration Improvements
Consolidated Approach to Repeater Headers
Configuration Required
As CoreStream GRC evolves, we occasionally find more effective ways to deliver the same functionality. One example is how fields are displayed on the header row of repeaters. Previously, you could only select a single field (e.g., just the Title). We’ve now consolidated and upgraded this approach to allow combinations of fields – for instance, Title + ID or ID: Title (Status). This provides greater flexibility and clarity while ensuring consistency across the platform.
Config Upload Speed Improvement
Automatically Added
When updating a site with the latest configuration, CoreStream GRC performs a variety of background tasks including adding new configuration, editing existing configuration, updating database tables, and setting default values in data rows. On larger sites with extensive configuration and data, this process could be slower than desired. We’ve implemented improvements to significantly speed up these updates, helping to make configuration deployments faster and more efficient.
3.4 Issue Fixing
Invalid Date in Progress Trackers Resolved
Automatically Added
In certain cases, when specific date formats were used in Progress Trackers (for viewing trends over time at a glance), the tracker would incorrectly display an “Invalid date.” We’ve expanded support for these formats to ensure dates are always displayed correctly, making Progress Tracker insights more reliable and consistent.
Enhanced Grid Column Keyboard Navigation (Accessibility)
Automatically Added
Accessibility continues to be a key focus for every CoreStream GRC release. In version 3.2, we’ve enhanced grid column functionality so that it can be fully navigated and controlled using just the keyboard. This ensures users who rely on keyboard navigation, including accessibility tool users, can interact with grids more efficiently and consistently across the platform.
Policy Manager Favoriting
Automatically Added
We’ve improved the experience in Policy Manager so that when you favorite a policy or procedure, it now appears instantly in your favorites list – no browser refresh required. This small but helpful fix makes it quicker and smoother to access the content you use most often.
Comments with Save & Continue Fix
Automatically Added
We resolved an issue where leaving a comment, clicking “Save & Continue,” and then immediately deleting the comment could trigger an error. This fix ensures that comment actions work smoothly and reliably, improving the overall form experience.
Support for Colons in Export Names
Automatically Added
Some clients had experienced issues when using colons in export names via the End User Reporting Wizard. The problem arose when storing the export in the Export Logger, which keeps a history of all exports for admin users. Since Microsoft does not support colons in file names, we now automatically remove them at this stage, allowing you to continue using them in your display names without affecting the export process.
Increased Limit on Date Pickers
Automatically Added
We’ve increased the range of our date pickers from 100 years to 200 years, providing more flexibility for long-term planning or historical data entry. In version 3.3, we plan to support free-text date entry, which will remove this limit entirely.
Character Count Validation on Rich Text Fields
Automatically Added
We’ve added support for character count and limit validation on rich text (WYSIWYG) fields. Because these fields store content as HTML rather than plain text, the validation logic has been updated to count only the visible text, ensuring accurate enforcement of limits without including HTML tags.
Small Screen Dual Form Comments Fix
Automatically Added
On small screens, when using dual forms – where comments automatically move from the side to the bottom of the form – comments were occasionally not visible. This issue has now been resolved, ensuring comments display correctly on all screen sizes.
3.5 Integrations
Add Metadata to SharePoint Attachments
Configuration Required
In 3.2, we’ve taken our SharePoint / OneDrive attachment fields even further by adding support for custom metadata. When uploading a file into CoreStream GRC, you can now populate required metadata fields – such as sensitivity classification or retention period – through a simple form before completing the upload. This works for both single and bulk uploads, ensuring your SharePoint document library rules are followed consistently. This enhancement makes document management smoother, helps enforce compliance, and keeps your SharePoint environment properly structured.
SharePoint Subfolder Enhancements
Configuration Required
In version 3.0, we introduced the ability for attachments added to linked items to be automatically stored within a subfolder of their parent – for example, attachments on an Audit Finding would be placed in a subfolder of the parent Audit. Previously, this relied on nested forms to determine the relationship. With 3.2, we’ve expanded this functionality so that the parent can be identified even outside of a sub form. This means you can now manage attachments directly from the Findings grid, with files automatically redirected to the correct Audit subfolder.
Support for Configurable API Monitoring
Configuration Required
We’ve enhanced API error logging in our platform, enabling more flexible and configurable monitoring for our clients. This improvement allows notifications and alerts to be tailored to each client’s specific needs, rather than relying on hardcoded rules, helping teams respond more effectively to API issues.
Generic Integration Sending Documents
Configuration Required
We’ve enhanced our generic integration capability to allow documents to be sent to an API provider – for example, Black Kite’s AI-driven third-party risk management platform. One possible use case is for TPRM clients: when completing lengthy third-party questionnaires, they could upload standard documentation and have the AI engine automatically populate more of the answers. Watch this space for further developments!
3.6 Technical
Deployment Management Now Handled by Project Teams
Automatically Added
At CoreStream GRC, we’re committed to improving the experience for both clients and our internal teams. As our organization and client base have grown, we have begun to see delays in deploying code to non-live environments. To address this, we’ve re-engineered our deployment architecture to allow our Configuration team to trigger their own deployments directly from the CoreStream GRC platform. Even better, this leverages our flexible, generic integration capability – no bespoke code required – showcasing the same automation tools available to our clients.
This new architecture also sets the foundation for an automated patch strategy. In the future, this will mean all clients benefit from the latest bug fixes and security updates automatically, without the hassle of manual intervention.
API Exports Enhancement
Automatically Added
CoreStream GRC provides API exports for clients who want a feed of data into other applications, often for business intelligence reporting. These exports support dynamic filter parameters so clients can limit the data returned. We’ve improved the functionality to support using the same parameter multiple times within a single query, ensuring more flexible and accurate data extraction.
Site Health Checker Enhancements
Automatically Added
CoreStream GRC’s high configurability has traditionally made automated testing of each of our individual client implementations challenging. While we’ve been able to validate configuration and detect common issues, identifying hidden errors across the platform was difficult. Our automation-focused development team has built a custom Site Health Checker that can assess the health of any CoreStream GRC configuration, scanning every screen, form, filter, and more to uncover potential issues. We’re continuously enhancing this tool, and the latest update adds full support for all of our chart types. This tool will help ensure your environment runs smoothly and reduce the risk of hidden configuration issues.
About Rich Eddolls
Richard is a co-founder and Chief Product Officer at CoreStream GRC, where he’s redefining the way organizations approach governance, risk, and compliance. With 20 years of experience in business-driven GRC system design and a background at Deloitte, Richard is all about challenging the status quo and delivering technology that actually works. As the visionary behind the CoreStream GRC platform, he’s committed to building solutions that don’t just promise change—but deliver it. Outside of the office, Rich is a golfer, soccer player, and proud husband and father, always looking for the next challenge—whether on the field or at home.
Follow Rich on LinkedIn here.
About Cam McNair
Cam is Head of Platform Design at CoreStream GRC, where he’s redefining how platform innovation happens—from solving day-to-day configuration challenges to building out features that scale. With a background in data analysis and technical solution design, Cam’s all about turning complex business needs into simple, powerful tools that actually work. He leads a team of Solution Architects who double as Product Owners, delivering real impact across the platform. As the driving force behind CoreStream GRC’s product evolution, Cam’s focused on creating solutions that don’t just tick boxes, but move things forward.
See Cam’s LinkedIn post about Product Release 3.0
Follow Cam on LinkedIn here.
