Release notes

Android

• Tagaris for Android is on Google Play. The same app as iOS: pair it with your own server, sign in as you do in the browser, scan labels, change status and whereabouts, count stock and run audits. A server on your own network over plain http works without any setting, and the app lock uses fingerprint or face unlock.

Both apps

• Audits with no signal. Scans are kept on the phone with the time they were made and sent when the server is back, and a late scan never undoes a newer audit made in the browser.
• Report an issue from a scan. An asset's screen lists its issues and can raise one.
• Buttons follow the person's permissions on servers with access groups.
• The new features need Tagaris 2.6.0 on the server. Against an older server the app keeps scans on the phone and says the server needs updating.

Pricing and access

• Every feature is free. Single sign-on, the audit log, reports, the API, the Jira integration, issues and purchasing are on every plan. A licence key buys seats and the multiple organisations add-on. Existing keys keep working.
• View-only people are free and unlimited. A seat is used by anyone who can change something: an Admin, an Editor, or a view-only person given a permission through an access group. The users page shows seats in use and view-only people separately.
• The install owner (the setup account) is never a seat: the free plan is the owner plus unlimited view-only people, and a five seat plan is the owner plus five. When a licence lapses only the other seat holders are paused.
• The Viewer role is now called View only and means exactly that. In the single sign-on mapping and the API it is still written VIEWER.
• Access groups: a name and a set of permissions (twelve, such as record audits, receive deliveries or place orders) that adds to a person's role and never takes away. Managed under Settings, Organisation, Access groups, and on invites.
• Sites: a person can be limited to particular locations. What is placed at another site is hidden from lists, pages, search, the dashboard, reports, exports, the mobile app and their personal API key.
• Cross-org groups can carry permissions as well as a role, applied in every organisation they cover, and now need the multiple organisations add-on to create or add members.
• Branding: an organisation can set a service name and upload a logo, shown at the top of the app, in the browser tab, on the sign-in page and on the staff issue form, alongside the accent colour.
• Device sync (Intune and Jamf) and the Entra people import no longer need a beta key. They are free and open to everyone, marked "still in testing".
• Reports are a permission of their own ("Run reports and export data"), which also covers CSV and JSON exports.

Issues

• Report and track a fault, a change request, new equipment or lost kit, usually against an asset: a status, a category you define, a priority, an assignee and a thread of notes, with an Issues page, an Issues card on every asset and entries in the asset's history.
• Reporting can set the asset to Repair; resolving offers to put it back and to log the repair, with its cost, in the maintenance records. New issues appear once in the daily digest and post to Slack, Teams or a webhook.
• Staff issue form: a page where anyone with the link can report an issue without a login. It shows nothing from the register, gives the same thank-you whether or not a tag matched, limits how much one address can send, has no upload and never emails the address typed into it unless an administrator chooses to.
• Scan a label without a login: with the form on, someone who scans an asset's QR label while signed out is offered "Report an issue with this item". IT staff who sign in from that page land on the asset they scanned.
• The staff form can have a hostname of its own (help.customer-x.com), one per organisation, served with the organisation's branding.
• An issue linked to an asset can be raised to Jira; the ticket shows on the issue and the asset. Issues are in the API and the organisation data export.

Purchasing

• Vendors: who you buy from, with account number, contact and support details. The Supplier field everywhere links to them, a new name creates the vendor on save, and the list is built from your existing supplier text on upgrade. That text stays on every record, so exports, reports and API responses keep their shape.
• Purchase orders: record what you order, then receive it. An asset line creates one asset per item from a grid of serial numbers, with the vendor, unit price and purchase date from the order; stock lines top up items; software lines create a licence or add seats. Part deliveries are tracked and the order moves to Received by itself. Placing and cancelling orders is a permission of its own.
• Contracts: support, maintenance, lease, extended warranty and subscription agreements with a notice period. Everything is keyed on the act-by date, the end date less the notice period: the status, the list order, the daily digest and the calendar feed. A covered asset shows a Cover card with who to call and what to quote.
• Reports: Spend by vendor and Spend by category for a period you choose, Open purchase orders, Contracts due and Vendor summary. The dashboard shows open issues, orders awaiting delivery and contracts to act on.

Migration

• Migrate from Snipe-IT through its API: enter the address and an API token and the register is read directly, with tags kept, who has what and where, the location tree, people, categories, status labels, custom fields, warranty end dates worked out from warranty months, stock at the quantity on hand, licences and maintenance records. A preview shows what would be created; it lands in one go or not at all; running it again creates nothing already here. The token is never stored. Tested against Snipe-IT 8.7.
• Migrate from GLPI through its REST API on the same page: computers, monitors, network equipment, peripherals, phones and printers with their users, locations, financial information and MAC addresses, the location tree, people, statuses read from their names in English or French, consumables and software licences. Tested against GLPI 11.0.

Single sign-on

• Okta, Google Workspace and any OpenID Connect provider (Keycloak, Authentik, JumpCloud, OneLogin, AD FS) as well as Microsoft Entra ID. The form asks for what each provider needs, the role claim can be a dotted path, and PKCE is used with every provider. Google Workspace needs an allowed domain, checked on every sign-in. Tested against Keycloak 26 and Authentik 2025.6; Okta and Google are built to their documented token formats and not yet tried against a live tenant.
• A directory group can be mapped onto an access group by name, re-checked at every sign-in.

Mobile

• Audit mode works offline. Scans made where the server cannot be reached are saved on the phone with the time they were made and sent by themselves when it is back, or on Sync now. The audit is recorded at the time of the scan, a late scan never undoes a newer audit, and anything the server refuses is listed with the reason. Only audit scans queue.
• The asset screen lists the asset's issues and can report one. Buttons follow the person's permissions.
• These arrive with the app update below and need this server release.

Security

• Browser single sign-on callbacks are bound to the state cookie again, so a sign-in callback the browser did not start is refused. The mobile app's own flow is unchanged.
• The public account sign-up endpoint is closed. Accounts are only created by the setup wizard and by accepting an invite.
• Fixed: on installs set up since July the owner was missing from the users list and was not the account kept when a licence lapsed. A migration adds the missing record on existing installs.
• Fixed: a save that failed validation on the server reset the form. Forms now keep what was typed.

Update check

• The daily update check now carries the install's random identifier (the one shown on the licence card) and the month the server was set up, so installs can be counted rather than requests. Nothing else is sent, and the check can still be switched off in Application settings or with UPDATE_CHECK=false.

Staying in touch

• Update check: once a day the server asks for the latest Tagaris version and shows a small "Update available" notice in the header to the install owner and organisation admins. It can be turned off in Application settings or with UPDATE_CHECK=false.
• Keep in touch: an opt-in at setup, and a one-time dashboard card on existing installs, to receive release notes and security advisories. Managed, and withdrawable, under Application settings.
• Send feedback: a Feedback page (Help in the menu) that sends a message to Goodhall Solutions, open to every signed-in user.
• The in-app Plans page, prompts and licence card lead to the free 30 day Team trial and card checkout on the pricing page.

The companion app

• Tagaris for iOS (iPhone and iPad) is on the App Store. It pairs with your own server and signs in the same way as the browser, including two-factor and single sign-on, so your security policy applies unchanged.
• Scan a QR label to open the asset, change its whereabouts or status, log maintenance, open attachments and raise a linked ticket. Scan an unknown serial or tag to create the asset on the spot.
• Audit mode walks a room label by label. Stock, accessories, components and consumables are on the phone too, and an optional Face ID or Touch ID lock guards the app.
• Works with the free tier and needs Tagaris 2.3.0 or later on the server. Android followed in October 2026.

Security and mobile

• Seven dependency vulnerabilities patched across all published images, which scan clean again with no critical or high findings. Pull the image again; there is no migration.
• Mobile app: an optional app lock in the Account tab. Opening or returning to the app asks for Face ID or Touch ID, with the device passcode as fallback. The sign-in session is unaffected.
• Mobile app: a failed keychain read on launch no longer leaves the app on the splash screen; it starts unpaired instead.

Specifications, custom fields and status shortcuts

• Hardware specification on assets: CPU, RAM, storage and GPU are fields on every asset. Device sync fills them from Intune and Jamf where available, only where you have not set them yourself, and they appear in the discovered-devices review and the data export.
• Custom fields can be limited to one or more categories, can be a yes/no or a dropdown as well as text, number or date, and can be marked required. A starter set of specification fields can be added per category for switches, servers, access points, UPS, NAS and more.
• Per-asset replacement age: an asset can override its category's rule. The asset page shows the computed due date, and the replacement-due flag, daily digest and calendar feed honour it.
• Status quick actions: one-tap next steps from the current status on the asset page, web and app, plus a Change status menu listing every built-in status and your custom labels. Disposal keeps its own flow.
• Mobile app: an appearance setting (match the device, light or dark), and custom status labels on the change-status screen.
• Fixed: changing status from the app or the bulk action now detaches a custom status label, so the change shows.
• Security: two high-severity advisories patched and the images rebuilt for advisories in the base image. Pull the image again; no migration.

Tickets, and the groundwork for the app

• Tickets on assets: link any service desk ticket to an asset by URL, or connect a Jira Cloud site under Settings, Integrations to raise tickets from the asset page with the details filled in, link by issue key and see each ticket's status. Tagaris only creates issues and reads their status. Ticket links appear in the asset history and the data export.
• The daily digest can raise a Jira ticket carrying the same items, so devices needing attention land in the service desk queue as well as inboxes.
• Credential expiry warnings: API keys with an expiry date appear in the daily digest, and each integration (Jira, Intune, Jamf) can carry a credential expiry date that warns 30, 7 and 1 days before it lapses.
• Stock item images: accessories, components and consumables can carry a product image, from the web or the app's camera. Stored with photos, so existing backups cover it.
• The server side of the mobile app: the app signs in like a browser, password with two-factor or single sign-on, so the same security policy applies, and it works on the free tier.
• The API's asset list now honours the documented filters.
• Security: two high-severity dependency advisories patched; the image scans clean.

Licensing and security

• Licensing tightened: purchased keys activate once through the Goodhall Solutions licensing service and are then verified offline on your own server. Air-gapped servers apply a licence file instead, with no internet access at all.
• Routine hardening of the Docker image: development and build tooling no longer ships in the runtime image.

Added

• Asset attachments: receipts, invoices, warranty certificates and manuals on an asset, alongside photos. Attachments appear in the asset history, the data export and existing backups.
• Scheduled backups with restore: one archive holding the database and, optionally, photos and attachments. Run by hand or on a daily or weekly schedule with a retention count, optionally encrypted with a passphrase, and optionally copied to S3-compatible storage. Restore asks for a typed confirmation, and an archive from another install can be uploaded, so moving servers is download, upload, restore.
• Search on every list page, shareable in the URL.
• Deeper location trees: breadcrumb paths, sub-location rollups, full paths in every picker, and an include-sub-locations filter on the asset list and export.
• Searchable popup pickers for people, locations and assets.
• Personal API keys, created in My account and capped at the holder's role, next to organisation keys for integrations. Every key has a chosen expiry, and the API can be switched off install-wide.

Security and fixes

• The Docker image scans clean, with no critical or high findings.
• Photo uploads over 1 MB no longer fail, and the setup account always opens its own organisation first.

Teams, security and integrations

• Roles and access: an install-owner tier above Admin, Editor and Viewer, one central permission check behind everything, and settings split into Organisation and Application areas. Cross-organisation groups grant one role across several organisations, and an access overview lists every account and how it signs in.
• Single sign-on with Microsoft Entra ID, including directory role mapping, a "require single sign-on" option with the owner as the break-glass account, and client-secret expiry warnings.
• Two-factor authentication for password sign-in: authenticator app, email code or backup codes, with a per-install policy.
• Email through Microsoft 365 or Google Workspace as well as SMTP, ahead of providers retiring basic authentication.
• Full stock and lifecycle management: check-out and check-in, accessories, components and consumables with low-stock alerts, maintenance records, straight-line depreciation, a physical audit workflow, per-organisation custom fields, custom status labels and bulk status changes.
• Financial lifecycle: any ISO 4217 currency, a dispose and reinstate workflow with a book-value snapshot, and Disposals and Value-by-location reports.
• Device sync: pull managed devices from Microsoft Intune and Jamf into a review queue, with per-connector filters, schedule and policy.
• Migrating made practical: asset import presets for Snipe-IT and Halo, flexible people imports, and a people pull from Microsoft Entra ID.
• A built-in reports page with eight ready-made reports and a custom report builder, a getting-started checklist, and a full organisation data export, free on every tier.