Skip to main content
October stopped people from getting a second login account, cleared clutter out of Pre-Boarding and recruiting, and closed a set of security gaps found in a full review of the product.

​
Highlights

  • No more duplicate login accounts. When HR moves an employee to Onboarding or Active and no Microsoft account is linked yet, Swiss HR Easy asks for the company e-mail. That way the first Microsoft sign-in finds the existing person and does not create a new account. Settings → Users flags likely duplicates, and a new Merge duplicate account action moves an existing duplicate into the real person.
  • Ask employees for missing data from the app. Actions → Request missing data now sends the request from the app’s own mailbox, in the employee’s language. It lists the missing fields and links to the portal form where the employee fills them in.
  • Security review. A full review closed several ways to take over another account. Anonymous feedback now stays anonymous, and feedback, address and family data are visible only to people who are allowed to see them. Details are in the section below.

​
Also new

  • Pre-Boarding: the PK and AHV registration steps are gone from the default journey. Finished journeys drop off the board. Every board row has the journey’s Actions menu, and you can jump straight to the employee record.
  • Bulk rejection: pick which rejection e-mail template goes out, instead of always sending the stage default.
  • Mailbox: the mail view also shows subfolders below the Posteingang, and search covers the whole folder tree, not just the messages already loaded.

​
Security

  • Signing in, magic links and redirects can no longer be abused to reach someone else’s account. An administrator can no longer change the e-mail address of an account that ranks above them.
  • Anonymous feedback can no longer be traced back to its author. Each review is visible only to its author, to the person it is about once it is submitted, and to people with result rights.
  • Managers see address, phone and family history only for employees in their scope. Changes to sensitive fields in the change log are hidden from people without access to sensitive data.
  • A SUPERADMIN can deactivate and reactivate another SUPERADMIN account, so a compromised account can be locked.
  • All server images run on the Node.js 22.23.4 security release, and third-party libraries were updated to fix known vulnerabilities.

​
Fixes and polish

The position filter on the pipeline board lists only open positions. The link on a decision task no longer leads to a “not found” page. Settings → Users stays usable even if the duplicate check fails. Leavers can no longer be linked to a company e-mail.