The short version: R7 lets Aproove AI prompts run on large batches and complete documents, under limits administrators control. It hardens security across the server, the login portal and the web server. And it simplifies versioning so every object has one shared draft and one current version. For regulated teams, that means AI checks that cover the whole asset, fewer places for sensitive data to end up, and no doubt about which version of a workflow is in force.
This is the seventh release of the 2026 cycle: 9 new features, 11 improvements, and 24 bug fixes. Here are the three that matter most for regulated teams, and where each one lands.
AI prompts now run on large batches and whole documents
Pillar: governed AI.
Until R7, the AI action sent every proof in a batch to the model in a single request, along with detailed word positions. On a large batch, that request outgrew what the model can accept, and the action failed without creating a single note. Prompts now run according to their type. A per-proof prompt sends each proof as its own request, several at a time. A whole-document prompt sends all the selected pages together, so the model reads a long document as one piece.
Administrators decide how hard the AI works. Each prompt template has a Max parallel executions setting, up to 12 requests at once by default, and a server-wide limit keeps a large AI run from slowing the product for everyone else. Long runs are no longer stopped after seven to nine minutes, so the AI checks every page through to the last one. AI notes now land correctly on Japanese proofs, and runs on the newly added OpenAI models report their real cost.
When marketing, compliance and legal share an asset, an AI check only helps if it covers the whole asset. A check that fails on a large batch, or stops partway through a long document, leaves reviewers assuming coverage they never got. R7 makes the coverage complete, the cost visible, and the controls the administrator's.
Every versioned object now has one draft and one current version
Pillar: built-in auditability.
Tasks, workflows, forms, step templates, section templates and tags could previously carry several drafts at once, and a "current version" checkbox meant the version in force was not always the last one published. In R7, each versioned object can have only one draft at a time, and any administrator can open, edit and publish it. While a draft exists, Edit is greyed out on every version, with a tooltip naming the draft. Publishing a version always makes it the current one. Lists show each object once, at its current version, and say when a draft is in progress.
Published versions are locked down further too. On a published workflow, step guests and step groups can no longer be changed, so the same version cannot differ from one server to another. A published task's file matching pattern is now read-only, like the rest of the task.
Auditors ask a simple question: which rules governed this project? When the last published version is always the current one, and a published version cannot be edited, the answer is one lookup. Compliance can sign off a workflow knowing the version they approved is the version running.
Security is tighter across the server, the login portal and the web server
Pillar: built-in auditability and governance.
R7 tightens web access to some application functions, removes three upload scripts the product no longer used and deletes them from existing servers on update, and stops the web server exposing an internal application folder. Aproove now runs on PHP 8.4.27, and the login portal moves with it: HTTP requests are redirected to HTTPS, the SSO library is updated with its security fixes, and passwords, tokens and keys are no longer written to the PHP log. AI provider API keys are masked in the Admin, showing only their last five characters, and are kept out of the AI log. The installers now remove their setup files when they finish, so no database passwords are left on the server.
New installations get Apache 2.4.69 with OpenSSL 3.5, replacing Apache 2.4.46 and OpenSSL 1.1.1, which reached end of life in September 2023. The Apache versions in between fix 110 published vulnerabilities, and HTTPS now accepts TLS 1.2 and 1.3 only. Existing servers keep their current Apache when they update, and moving them to 2.4.69 is planned separately.
Regulated businesses answer security questionnaires for every system that touches their content. Secrets that never reach a log file, keys masked on screen and a supported web stack are exactly the controls those questionnaires ask about. R7 gives IT and compliance firmer answers.
Also in this release
The Workflow Wizard, a guided way to build a workflow template in a few screens, is still in development and is not yet available for everyday use. Its groundwork is live in the Admin now: a workflow step opens in a resizable side panel beside the diagram, new steps can be added from a template or from scratch, and step templates can be exported and imported on their own, staying linked to the steps built from them. Extending a step's expiration date now emails only users whose task is still open. Disabling a user shows how many open tasks they hold, and a task held back by a deactivated assignee now says why. The form builder shows which team each metadata key belongs to, an import with errors is clearly flagged, and sorting the Time Tracking list keeps loading records in order. Project plan exports now carry only their own planning tasks, with every task answer, and the OpenAI provider adds the GPT-6 and GPT-5.6 models.
The 24 bug fixes focus on keeping projects moving. Projects no longer stall after a deadline conflict is resolved, and late planned-task workflows now close so the plan moves on; planned tasks already stuck before R7 are not repaired by the update, and your Aproove contact can help release them. Step names no longer grow each time a project plan is saved, exports of large project plan templates that could run for hours are now much faster, and imported step actions keep their step guest decisions. Users provisioned through SSO now see their projects, and administrators signing in through the login portal land in the Admin Portal.
Where this lands for regulated teams
Take a life insurance carrier launching a new term life product. Marketing produces a long product guide and a batch of state-specific brochure variants. Compliance checks every disclosure. Legal confirms the policy language matches the filed product.
With R7, a whole-document prompt reads the full product guide in one pass, and a per-proof prompt runs across every state variant, with parallel limits that keep the platform responsive for the designers still working on the launch. The approval workflow compliance signed off is the one running, and because step guests are locked on a published version, legal's review step cannot drop out of it. When the carrier's IT security team asks where credentials live, the answer is no longer "in a log file".
FAQ
What happens to objects that have several drafts today?
During the R7 update, objects with several drafts or no clear current version are brought into line with the new rules: one draft at a time, and the last published version as current. If your team works with parallel drafts, review them before you update. Your Aproove contact can help.
Does our existing server get the new Apache web server?
Not with this update. Apache 2.4.69 with OpenSSL 3.5 is installed on new installations. Existing servers keep their current Apache when they update to R7, and moving them to 2.4.69 is planned separately. The move to PHP 8.4.27 and the removal of unused upload scripts do apply on update.
Up next
R8 continues the Workflow Wizard, toward building real workflow templates with it and opening it from the Admin, and brings further improvements to signing in to the Admin Portal.
