What's new

What each release of Oho changed, newest first. The version you are on is shown at the bottom of the Resources menu in the app, beside the link that brought you here. Where a change needs you to turn something on, the linked page says how.

This page starts at v1.0.0

v1.0.0 (11 September 2026) is the first release on the current platform. Oho has been changing for longer than that, and anything earlier is described in the pages it affects rather than here.

v1.30.0 — 29 October 2026

Personal contact details from your HR system are now opt-in, per connector. A worker's personal phone, personal email and home address are personal information, so Oho brings them across only when you ask it to: edit the connector, open Settings and switch on Import Personal Contact Details. With it off, the next sync removes those values from the records that connector manages, and they return on the first sync after you switch it on. Work and personal details are also no longer mixed — a company mobile is saved as the work phone, and a personal email is no longer used as the work email where none is set. If you rely on a personal phone or email — for WWC Connect, for instance — switch the setting on before upgrading. → Add a connection
A custom check can no longer use a course code as its reference number. A credential's identity is its type plus its reference number, so everyone who typed the shared course code — HLTAID011, say — landed on one record and shared its attachments. A course or unit code, or a placeholder like N/A or TBC, is now refused on the capture form, in Add / Edit credential and over the API alike, naming the field. Records you already hold stay editable, but people merged onto one need their own number entered. → Create a custom credential
The Recruitment Overview is now the Recruitment Dashboard, and it reports the screening pipeline the way the Check Requests page does: the same request statuses rather than a separate set of outcome buckets, how long each candidate has been waiting, and a time-to-hire figure. An applicant can be reviewed or converted from the dashboard itself instead of opening their profile, and chasing a candidate is Send reminder everywhere, including on an expired link. → Understand your Recruitment Dashboard
Text-message allowance is visible, and capped. A billing section shows the texts used over a period, and sending stops at the allowance rather than running past it. → Set up notifications
WWC Connect keeps a linked worker's contact details current. After linking, Oho compares each listed worker's phone, email and address with what it holds and uploads only the rows that differ, re-checking until Connect shows the change. Each row starts from Connect's own values, so nothing Oho does not hold is blanked, and a worker you ended in Connect is never added back. → Working With Children
The WWCC Connect readiness report shows the name on the card. A card held in another name — a profile reading "Sarah Gibson" against a card issued to "Sarah King" — could not be spotted before nomination. The report now carries Card holder name and Name differs from card, with a count of mismatches at the top. → Working With Children
A qualification's profile now answers "does it count for childcare?" A Childcare approval card shows the ACECQA tier, the approval outcome and any state limit, the designated roles the qualification approves, and the ASQA integrity finding where there is one. Conditions-apply and not-assessed are explained where they appear, so neither reads as a refusal, and the card is hidden on a qualification that has never been checked. → Qualifications
Confirming a duplicate-worker review now actually moves the credentials. The merge was being refused as it wrote — nothing moved, the duplicate stayed live, and the review still reported itself resolved. Reverting now restores the records too, and the retired record's open fetch requests are cancelled. Three related fixes: a pair raises one review rather than a mirrored second, surnames are matched regardless of case, and a pair is raised while either worker is active, so a returning rehire against a switched-off record is caught. → Review & Decide
A credential is no longer frozen at "Not verified yet" by a decision that no longer applies. → Review & Decide
Measure against position requirements is hidden when the position check is off. The lens and its "No requirements set" card had no data behind them while the check was off; a lens left selected falls back to All records. A worker whose only outstanding required record is still pending now counts as At risk under that lens rather than passing. → Understand your Compliance Overview
Verify stays available on an Australian passport until it has actually passed. The button was hidden on every Australian passport on the assumption the citizenship shortcut had approved it, which left a passport whose earlier check errored with no way to re-run. → Right to work
A police check ordered through Oho stays the card's answer. Where an HR system carried its own "Clear" row against the same reference while the ordered check was still running, the HR row could take over the card and the worker read as cleared. The ordered check now outranks other copies, and one retired into an HR copy is reinstated. → Run a police check
A credential from IntelliHR with a future issue date now syncs without it, instead of failing the whole record. Since v1.27.0 Oho refuses a future issue date, and NDIS clearances dated exactly five years before expiry were tripping it, so those credentials stopped updating entirely. The status, expiry and worker link now land, and the run report names the record so the date can be corrected at the source. → Connect IntelliHR
A worker with a future-dated leave in iChris stays on their current position until it ends, rather than taking the new row the moment it is keyed. → Connect iChris
iChris can set a police check's expiry from the position's renewal period, as the old Oho did. Chris21 records how often a position's check must be renewed, and Oho can read that and set the expiry to the issue date plus that many years — or no expiry where the position needs none. It is off unless you ask support to switch it on, and an expiry somebody edited in Oho by hand is left alone. → Connect iChris
A Victorian teacher registration check now says when the register is challenging us, rather than reporting that it could not be reached, and an SA teacher registration check says when it ran out of attempts at the register's puzzle instead of failing silently. → Teacher registration (VIC)
A fetch request asking only for details can be submitted. A request with no document to attach could not be completed. → Send a fetch request

v1.29.0 — 28 October 2026

Single sign-on works again. On v1.28.0, SAML sign-in answered with a server error instead of the blank page it answered with on v1.27.0. The v1.28.0 fix moved the sign-in request out of the page and into a redirect, which pushed the response headers past a size limit on Oho's gateway, and the gateway dropped them. The limit is raised; deep links, which produce the largest requests, failed hardest and work now. Nothing changes at your identity provider. → Set up SSO
The WWC Connect upload file is accepted by Service Victoria. Connect rejected every row of the file Oho produced — the Worker and Carer Exclusion Scheme column shipped blank, which that form treats as a missing answer. It now carries No, which is right for everybody but a foster or kinship carer, so check that column if you have any. State is written as the code the template expects, so "Vic" or "Victoria" from your HR system no longer breaks the row. Victorian cards recorded under a generic working-with-children or teacher code are now included too; they were being dropped from both the upload and the readiness report. → Working With Children
Victorian clearances can be nominated in WWC Connect automatically. Where the upload file asks you to log in and upload it, Oho can now do that run for you: it signs in to your Service Victoria account, checks it is your business by ABN before anything is sent, uploads the clearances not yet listed, and reconciles against Connect's own worker list until each one appears. A clearance already listed is recognised rather than re-sent. Ask support to set it up for your organisation. → Working With Children
A failed check no longer re-queues itself forever. A credential that has never verified carries no last-checked date, and a failed check does not set one — so the failure read as a brand-new credential and queued another check, around the clock. Nine malformed AHPRA numbers on one account were enough to hold the shared AHPRA connection and halt that account's weekly sweep three weeks running. A credential paused, superseded or moved to "in application" while it waited in the queue is now skipped rather than checked. → How monitoring works
A malformed AHPRA number now comes back as "not found" rather than as a check that errored, so it reads as a number to correct rather than a fault to report. → AHPRA
A university can be picked from the register instead of typed. The Issued by picker searched training organisations only, so a degree's issuer was always free text — and because ACECQA approvals are matched on that text, "RMIT University" against "Royal Melbourne Institute of Technology" downgraded a genuinely approved teaching degree to one needing a person to confirm. Universities now come from TEQSA's national register, shown in their own group beside the RTOs, with free text still there for overseas and in-house issuers. Across ACECQA's own list, picking the provider takes institution confirmation from 93.5% to 100%. → Qualifications
The qualification-plus-registration rule now covers nurses as well as teachers. An Early Childhood Teacher has always meant both halves — the qualification and current registration. The same join now runs for nurses and midwives, where registration is the gate and the degree is supporting evidence, and the registration is attributed to the Nursing and Midwifery Board rather than to AHPRA in general. → Qualifications
A custom check is now one card per person, with its renewals behind it. A tenant-defined check usually gets a new number each time it is redone, and Oho was treating every renewal as its own live card — no History, and the old certificate never retired. Each holder now has one card per custom type: a later certificate renews the earlier one, which is kept as history with its own details. Built-in types are unchanged and still keyed on the card number. → Create a custom credential
Review & Decide's A–Z ordering now arrives with the upgrade. v1.28.0 fixed the sort but the corrected ordering depended on a search index rebuild; that rebuild now runs as part of the upgrade, so there is nothing to wait for and nothing to ask for. → Work the Review & Decide queue
A document an administrator uploads is no longer sent for automatic reading. Document recognition is for the files people send in through a capture form, where nobody has seen the original; a file an administrator is holding in front of them has already been sighted. The capture form also stops offering a scan on credential types your OCR settings do not cover, instead of starting one that was never going to run. → Add a credential
A capture form submitted while Oho is unavailable now says so, and keeps the request open. Submissions made during an upgrade hung for minutes and then reported "Submission failed. Please try again", with the request already closed behind them. A submission now stops at the first failure, says the problem is at our end, and leaves the link usable so the person can finish later. → Send a fetch request
A credential merged into an existing one keeps its fetch request, so the request that produced it still shows what was asked for and who answered. → Send a fetch request
A worker arriving from your HR system for the first time is recorded as new, rather than as matched to a record that did not exist a moment earlier. HiBob, ADP, BambooHR, UKG and IntelliHR resolved each worker twice in a run, and the second pass found the one the first had just created — which made the match provenance on those five connectors meaningless. → Ingest your data
Reference checks can be filtered. The list can be searched by name, description or question text, and narrowed by screening package, by sector, and by whether a check is in use.
A referee's questions can be previewed before the check is sent, so you can read what the referee will be asked.
A PharmacyID police check asks what the check is for in plain terms. The purpose field now asks for the job title and the setting — "Registered Nurse in aged care" — and says so when what was entered is too thin to submit. → Run a police check

v1.28.0 — 27 October 2026

Single sign-on works again. Since v1.27.0, signing in through SAML returned a blank page on every account using it — the security policy added that release blocked the page that forwards you to your identity provider, and the usual fallback link was hidden. The request is now sent in a form no policy touches. Nothing changes at your identity provider. → Set up SSO
Qualifications ASQA has cancelled are now flagged. When ASQA cancels a provider's registration it separately decides whether to cancel the qualifications that provider issued, and publishes that apart from the national register — so Oho could only ever tell you the provider's registration had ended, while saying the training itself was completed while they were still registered. That sentence was reassuring about precisely the qualifications ASQA had cancelled. Each qualification now carries an ASQA Integrity verdict — Cancelled, Review required, Provider under action, Not flagged, or Not assessed — filterable in search, with the first two raising a Review & Decide task carrying the notice itself. Not assessed is not a clearance. A cancellation is not final and nothing is written back onto the qualification's status: the finding is recorded and the decision stays yours. → Qualifications
On a credential Oho can verify, the expiry date is yours — a payroll sync can no longer overwrite it. Working with children checks, teacher registration, AHPRA, NDIS screening, visas and passports take their expiry from the register or from whoever read the card; your HRIS holds a copy that is keyed by hand and rarely revisited, and it used to win every night. WA's check is the clearest case: that register publishes no expiry at all, so the date was only ever one a person entered. A sync still fills in a date where Oho has none, and credentials with no register behind them — first aid, CPR, a driver's licence — keep taking renewals from your HRIS. → Keeping data in sync
Credentials from iChris no longer say they expire in 2159. Chris21 cannot record "never expires", so it stores a far-future placeholder, which Oho was reading as a real date — the credential never appeared in an expiry report and never asked anyone to renew it. Dates already carrying the placeholder are not corrected automatically; ask support to clear them. → Connect iChris
An applicant match that cannot be anything else is now confirmed for you. Where a new worker and an already-screened applicant agree on first name, last name, date of birth and middle name, Oho links them the moment it finds the match rather than waiting for somebody to open the queue. The review still appears, resolved, showing the score that settled it, and Revert undoes it. Anything weaker still waits for a person, as does any worker more than one applicant fits. The bar is yours to move, or turn off, under Settings → Manage → Review & Decide. → Review & Decide
Measuring against position requirements now narrows the list, not just the numbers. Under that lens the queue is headed Not Meeting Position Requirements and holds exactly the people the bands above it counted, with each row showing only the findings that bear on their role — an expired licence no role asks for no longer heads a row. The At risk and Non-compliant tiles open that queue rather than a search filtered on the all-records verdict, which was a different group of people under the same number. The default All records view is unchanged. → Understand your Compliance Overview
All Workers keeps your filters when you leave the page and come back. Narrowing to one service, opening a worker and returning used to put the whole roster back. The filters, search, sort and page are now part of the web address, so Back, refresh and a link you paste to a colleague all land on the same slice. A Clear filters button sits beside the chips. → Find and manage workers
Sorting Review & Decide by name now groups by person, and sorts properly. A name sort used to leave the queue grouped by priority, dealing one person's Urgent and Medium decisions pages apart. Names were also compared by character code, so "SMITH John" sorted ahead of "Sarah Adams" and "van der Berg" fell after Z. Both are fixed; the corrected ordering appears once your instance's task index has been rebuilt. → Work the Review & Decide queue
PDF documents preview on screen again. Since v1.25.0 the preview panel came up blank wherever a PDF appeared — the Review & Decide screens, the Documents tabs, police checks, and the preview a worker sees before uploading. Images were unaffected, which is why it looked intermittent. Nothing needs re-uploading; only the display was affected. → Verify a credential
iPhone photos attached to a credential are converted again. HEIC files had been uploading as-is since v1.25.0, so reviewers saw "preview unavailable" and had to download them. Photos already uploaded stay as they are. → Add a credential
You can upload a testamur to a qualification yourself. The Attachments section on a qualification now has an Upload button, so an admin holding the certificate no longer has to send the worker a request for a document they already have. It raises the same Qualification document review as a worker's upload — a shorter route is not a skipped check — and where your plan includes document verification the file is read and checked against the national register first. PDF, JPEG, PNG or HEIC up to 5MB. → Qualifications
Qualification types can be configured for your organisation. Define the types you recognise with their acceptable course codes, ACECQA tier and how long they stay current, under Settings → Manage → Qualifications. A validity period bounds a qualification's expiry: a date typed on the record can shorten currency but never extend it. Existing records pick up a matching type without anything being re-entered. → Qualifications
Workers can be sent a renewal link before a check expires. Turn on Send workers a renewal link under Workforce notifications and an expiring police check emails its holder a link to start the new one, with a per-credential-type switch beside each expiry override. → Set up notifications
A referee can be sent their invite again, with the contact history on the request. The resend reuses the same link rather than minting a new one, and refuses once the referee has answered or the reference has been cancelled. Reference checks can also ask a follow-up question in response to an answer.
ACT teacher registration can now be recorded and checked, alongside the other states' registers. → Credentials
More training codes are recognised, with the SIS, TAE, SITXFSA and BSB families added to Oho's copy of the national register — so qualifications in those families are matched to the register rather than reported as not assessed. → Qualifications
The referee form works with a screen reader and a keyboard. Labels are tied to their fields, errors are announced and point at the field they belong to, the non-response reasons can be chosen with the keyboard, and the answer buttons and expanding sections now say which is selected and what is open.
"Sign in with SSO" no longer dead-ends on an account with no identity provider configured, the sign-in field says what it accepts, and the "Logging in…" message no longer outlives the attempt. → Sign-in and two-factor
The Compliance Overview CSV says whether each credential has a supporting document, and when the latest one was uploaded. The Record columns gain Has Attachment and Latest Upload Date, and the existing count is renamed from Attachments to Attachment Count — point any spreadsheet or import that looks for the old name at the new one. The cells stay blank on exemption, declaration and ban-check rows, where a blank means "not reported" rather than "none on file". → Export compliance data
A Content Security Policy set in configuration now applies to the application page too, where it previously governed only files and API responses. If you set SECURITY_HEADERS_CONTENT_SECURITY_POLICY yourself, add 'nonce-{nonce}' to its script-src or the application will not load, and check the rest of your policy against the one Oho ships — yours replaces it rather than adding to it, so PDF previews need frame-src and HEIC conversion needs worker-src 'self' blob:.

v1.27.0 — 23 October 2026

"No compliance records" is gone — a worker with nothing on file now reads as Compliant. The fourth state sat beside Compliant, At risk and Non-compliant everywhere, which made an empty file look like a mark against the person, including for people no rule asks anything of. Whether a worker has to hold something is what your compliance rules decide. The card, its slice of the donut, the No records filter options and the grey badge are all gone, and those workers count as Compliant instead — so that figure rises on the day you upgrade with nobody's records changing. Somebody who has never supplied a credential their position requires now reads Non-compliant, which an empty file used to suppress. A saved search or report filtering on No records will no longer match anything. → Understand your Compliance Overview
A credential can't be saved with an issue date in the future, or an expiry date already past. A future issue date is nearly always a slip — 2027 for 2017, or a day/month date read the other way round — and it made somebody holding nothing valid read as freshly current. Past expiry dates are refused only where a person types them; registry results, HR syncs and spreadsheet imports still record a lapsed card, because that is what an expired credential looks like. Records already holding a bad date stay editable, and the correction is always allowed. → Add a credential
Oho now recognises a person by their preferred name, not only their legal one. The two reviews that ask whether two records are the same person compared legal names only, and only when they matched exactly — so somebody who reaches Oho as "Xu (Iris)" in one system and "Xu" in the other was simply two people, with no review raised. Preferred names, alternate names such as a maiden name, and the displayed name all count now. It is still a review and never an automatic merge: a match reached through a preferred name scores below an exact legal match and says so, and two records with genuinely different dates of birth are still ruled out. Duplicates you already live with are not re-examined. → Review & Decide
Correcting a worker's name now corrects it on their credentials. A credential keeps its own copy of the holder's name, because that is what the registry is searched on — and that copy was never refreshed, so fixing a typo fixed the worker while their credentials went on failing their checks under the old name. Only copies are corrected: a card deliberately recorded in a maiden or former name is left alone, as is one the registry itself has confirmed. A credential whose name changes is re-checked automatically, and the correction is recorded as a human edit, so an older spreadsheet won't quietly put the old name back. → Keeping data in sync
The holder name can now be edited on any credential. Passports and VEVO checks, ImmiCard, most teacher registrations, police checks and the general-purpose types offered no way to correct it at all — while raising reviews about exactly that field. Editing one now shows Holder name on the credential beneath the form. Leaving the given name empty is how you record someone with a single legal name: put it in Surname. → Add a credential
A credential stuck "Under review" with no review in existence is released. Closing a name-mismatch review after the credential had moved to a different holder left the hold in place for good, so the credential read Under review and its holder May not engage with nothing anyone could action. The hold is now released when the row closes, and re-applied if a new holder's name also disagrees. → Review & Decide
An applicant's credential no longer picks up an unrelated worker as its owner. Where two people were recorded against the same reference number — placeholders like N/A, In ELMO or 1 are the usual cause — the next worker to claim it was quietly added to the applicant's record, putting one person's document on another person's profile and raising a name mismatch that looked like a wrong upload. A worker and an applicant now share a credential only when the worker was actually converted from that applicant. Records already affected are not repaired: raise them with support rather than confirming the match. → Review & Decide
A worker's records can be copied to another worker. Copy to another worker on the worker menu previews what would move, copies it on confirmation, and can be undone in one click, with both profiles showing the link. Mistaken applicant conversions can be put right too: a deleted worker no longer counts as "already converted", can be restored, and an already-converted applicant can have its records brought across. Reviews dismissed when a record was deleted reopen if that record comes back. → Find and manage workers
An uploaded testamur is read before anyone opens it. Oho now reads the national training code, course title, issuing organisation, completion date and the name printed on a qualification document, asks its copy of the national register whether that code and provider are real, and names anything that disagrees in the Review & Decide item — "CHC30121 vs CHC33021" rather than "check the code". A clean read never closes the review: no reading of the paper establishes that this person earned the qualification, only a person sighting it can. A document that could not be read says so, and is never reported as a finding. → Qualifications
Qualifications now raise webhooks. qualification.added, qualification.updated and qualification.transferred join the credential events. → Webhook payload reference
Resending a webhook delivery now sends it to one receiver. A redrive re-sent the stored delivery to every subscribed endpoint, so fixing one receiver meant every other receiver got the event again. → Webhook operations
Verifying an SA Working With Children Check over the API no longer fails with an empty error. SA is the only register behind a portal login with an emailed passcode — minutes, where every other register answers in seconds — and the connection was closing before the check finished. Retrying made it worse: each attempt started another sign-in and sent another passcode. Calls for the same organisation now join the sign-in already running, so a burst produces one passcode email. If you verify SA WWCCs from an integration, send "async": true: Oho replies immediately with 202 and a correlationId, and delivers the outcome on the credential.verified webhook. → Working With Children Check (SA)
A police check that never reached the provider is now visible, and retried. A submission that failed on a dropped connection, a provider error or a rate limit is resent automatically; one that needs a person — missing configuration or applicant details, a rejected request — says so on the check in the provider's own words, instead of sitting there looking like a check in progress. → Run a police check
Check types can be searched by their abbreviation. Typing "ESSA" now finds Exercise and Sports Science Association, and a custom credential is searchable by the code you gave it, in every picker — including Settings, where an admin previously could not find a definition by its own code. → Create a custom credential
Document recognition reads a surname from the document's own label rather than inferring which part of a printed name is the family name.
Reference check questions can be edited and can branch. A question from a prebuilt pack can be reworded rather than replaced, and a question can be set to appear only when an earlier answer calls for it, so a referee sees the follow-up and nobody else does.
API: a blank given name or middle name on PATCH /v1/credentials/{id} now clears it, where it was previously ignored. Omitting the field, or sending null, still leaves the stored value alone. If an integration sends "" for a name it simply doesn't have, change it to omit the field. The surname has no clear: every registry lookup matches on it. → Workers & Credentials API

v1.26.0 — 22 October 2026

The Compliance Overview can tell you what each centre has on its books. A Staffing Mix section gives, per service, the headcount, how many hold a Diploma or above, and how many are Early Childhood Teachers — rolled up across an operator's centres counting each person once. An ECT means both halves, so somebody with the qualification but no current registration in that centre's state is not counted, and Oho says which half is missing. Figures resting on something provisional are labelled: working towards for an active enrolment, conditions apply for an ACECQA approval Oho cannot settle. It is not a ratio and is not marked pass or fail: the National Regulations count educators in ratio at a moment in time, and Oho holds no roster, no attendance and no child numbers. The section appears only if you use services. → Understand your Compliance Overview
An evidence pack you can hand to an authorised officer. Each centre in Staffing Mix has an Evidence pack button that downloads a dated PDF for that service: who is on its books, what each person holds, the designated roles and who fills them, and the staffing-mix figures — with the check behind every claim rather than the verdict alone. Beside each credential it says what was checked, by whom and when, and a registry's answer and a reviewer's decision are shown as the different things they are. Each pack carries the time it was generated and states in its own words that it describes who is on the books, not who was working at any particular moment. → Understand your Compliance Overview
Designated Roles has moved, and is now kept per service. The register is a third tab on Compliance Rules, beside Position Requirements — the two sound alike and are not: a position requirement says every worker with that job needs these credentials, a designated role says at least one named person at this service holds this duty. Existing links still work. The register is now kept per service rather than per organisation, because that is how the regulator reads it: a provider running six centres appoints six Nominated Supervisors, and a centre is not covered by somebody appointed down the road. A role can be switched off at one centre without affecting the others. → Compliance rules
A register nobody has set up no longer reads as all clear. Two green zeros above a page of untracked rows were both true and both meaningless — nothing is on the register, so there is nothing to count. Until at least one role is tracked, the page says so instead. → Compliance rules
A referee who declines can be replaced without starting the check again. The applicant is emailed and asked to nominate somebody else, and the request moves to the new referee. Referee reminders also get an on/off switch, for organisations that would rather chase people themselves.
The capture form asks for a passport's issue date. Australian and New Zealand passports take the citizenship short-circuit, which makes no call to VEVO and so never returns a date — those credentials were left with no issue date at all, and an HR sync would fill the gap with the date it happened to run. Visa holders are unaffected: the registry's grant date still wins. → Right to work
Converting an applicant now carries their qualifications across, along with any reviews raised against them, instead of leaving them on the applicant record. → Applicants
Qualification documents can be uploaded, listed, fetched and deleted over the API, the same way credential attachments already could. → Workers & Credentials API
A card replaced by one with a new number now points at its replacement. Adding a new Working With Children card retired the old one and said so only in its description, leaving a superseded record with an empty History tab and nothing naming what replaced it. Both cards now show the hand-over, and a replaced card keeps its own details. → Credentials
A second person submitting the same reference number now gets their own record. A credential's identity is built from its type and reference number, which is what makes a resubmission safe to repeat — but a custom check whose reference is the same constant for everybody (a form named after the organisation, say) meant the second person's submission landed on the first person's record and was refused outright. Each claimant now gets a record of their own, and existing records are untouched: whoever holds one keeps it. → Credentials
A right-to-work check no longer reports a problem with the worker when the day's VEVO allowance is spent. Home Affairs meters VEVO across all of Oho, so a large batch could exhaust it and every later check — on any account — came back looking like a failed check. Oho now stops calling until the allowance resets, and says the allowance is used up and that checks resume on their own. → Home Affairs VEVO
A custom credential type set to never expire no longer picks up an expiry date from your HR system. Hiding the field on the forms did not stop a connector or the API writing one, so an orientation certificate could arrive with an expiry equal to its issue date and read as Expired. Dates already stored are cleared, and a credential wrongly marked Expired or Expiring returns to Active. → Create a custom credential
Deleting a position's requirements now tells you when it was refused, rather than reporting success and leaving them in place. → Compliance rules

v1.25.0 — 21 October 2026

Oho can now hold your services — your centres and sites — as records of their own. A new Settings → Customize → Services page takes each centre once, with its service approval number, approved places, state and rooms. Workers attach themselves: list the values your HR system already sends for a centre — a business unit, a cost centre, a site name — and any worker carrying one is attached automatically. Set a worker's centre by hand and the next sync leaves your choice alone. Approved places is yours: Oho never infers or adjusts it, and hovering the figure says when it was last entered and by whom. Rooms take a name and an age group, not a capacity — Oho holds no roster to compare one against. A centre that closes can be switched to not operating, which keeps its workers, rooms and history readable.
A register of who holds each designated role. Designated Roles, in the left menu under Continuous, lists each role for each organisation — Nominated Supervisor, Responsible Person, Educational Leader, and the first aid, anaphylaxis and asthma management qualified persons — who is designated to it, and whether those people still hold what the role asks for. A role declares its requirements the same way a position does, and is checked by the same compliance rules, so a role filled by someone whose first aid lapsed last month reads as not covered rather than as filled. Roles with nobody designated are counted separately, because the fix is an appointment, not a renewal. Until you set the register up, every role reads as not tracked and nothing is reported. Oho records who is designated; it holds no roster, so it cannot say who is on site.
A requirement that asks for an ACECQA-approved course reads as "not assessed" for now. Oho's copy of ACECQA's list carries the staffing tiers — ECT, Diploma, Certificate III — but not yet the approved-course lists for first aid, anaphylaxis management and asthma management. Such a requirement is never reported as a failure, and the register says so where it appears. Requirements that ask for a credential are checked normally. → Qualifications
A qualification requirement can name a course code, and a listed qualification can be checked against the uploaded transcript. Where someone has attached their USI transcript, Oho verifies the qualifications they listed against it rather than taking the list on trust. → Qualifications
Switching off the Position Role Requirement Check now releases the workers it had already judged. Its last verdict used to stay on each record and keep counting, so a worker could sit at May not engage for requirements nobody was checking any more — and supplying the missing credential never cleared it, because the check was off. While the check is off, workers are judged on what they hold; switching it back on re-assesses them, and nothing stored is deleted. Expect some workers to move out of May not engage shortly after the upgrade: that is the correction. → Compliance rules
Previewing a send now warns you when the sweep would be declined. With the position check off, the daemon refuses the whole sweep — but Preview next send still reported "N workers would be emailed". The preview now leads with the warning, the CSV carries a NOTHING WILL BE SENT heading, and Send packages on the Compliance Overview is disabled with the reason on screen. → Export compliance data
The WWCC Connect readiness report now covers only cards that are switched on. A card you retired in Oho no longer appears, and a worker whose only Victorian card is deactivated is no longer counted as a card holder — previously such a record with no number on file read as a gap. The report says how many were left out, so the figures reconcile against the upload file beside it, which already excluded them. Expect Victorian card holders in scope and % ready to move, usually upwards. → Working With Children
Managers can request a police check. Request new gave a Manager a form that could never be submitted: the Verification source list came back empty and Request stayed greyed out with nothing to explain why. The list was being read through the permission that governs connecting a data source, which only a Super Admin holds. Observers, who can view checks but not create them, still can't. Connecting a verification source remains a Super Admin job. → Run a police check
Managers and Observers can now tune their own alerts. They received credential alerts like everyone else but could not reach Settings → Manage → Notifications to change them. The personal Your alerts card is open to every role; the organisation-wide settings beneath it stay with administrators. → Set up notifications
A teacher holding more than one VIT registration now gets the right expiry against each. The register reports the registrations as a set, and a manual decision recorded against one combination no longer stands over a different one. → Teacher registration (VIC)
A single credential file can be resent to your webhook receiver. The resend window now offers the attachment events and asks which file, so a receiver that missed one no longer has to have the file removed and re-added. credential.linked and credential.unlinked are offered for every credential type rather than NDIS cards alone — they report a worker becoming the credential's owner, which every type has. attachmentRemoved is listed but cannot be resent: the file is still attached, and a receiver acting on it would delete its copy. → Webhook operations
A new password can't repeat any of your last eight, and can't be changed twice in a day. Without a minimum age the history is used up in one sitting and the original password is free again. The 24-hour wait doesn't apply when a change is already due — an expired password, one inside its 14-day warning window, or one an administrator forced. → Manage users
Oho now enforces a Content Security Policy. The policy tells the browser which scripts may run on an Oho page, so an injected one is refused rather than executed. It was previously sent in a report-only mode that enforced nothing.
Cross-site requests to Oho are rejected. An action that changes data is accepted only when the browser says it came from Oho itself, closing a gap where another site could act in Oho on your behalf while you were signed in. Signing in with SSO, the worker-facing capture pages and API integrations are unaffected.
Postmark delivery webhooks should carry the shared secret as a header. Oho's webhook URL carried it as ?token=<secret>, and anything on a URL is written verbatim into web-server and proxy logs. Re-register each webhook in Postmark against the plain URL and add the secret under HTTP headers as X-Oho-Webhook-Token, then rotate it — the old value is already in those logs. The URL form still works for now, so nothing stops while you migrate. → Set up notifications

v1.24.0 — 20 October 2026

Referees who don't reply are now chased for you. Oho sends a reminder on days 1, 2, 3 and 7 after the request, stopping the moment the reference arrives, and you can resend a request by hand from the referee list. The schedule, the cap on how many reminders go out, and how long a referee's link lasts are all in Settings → Customize → References. The link now lasts 14 days rather than 30, matching every other link Oho sends — chasing finishes on day 7, so days 8 to 30 were a link nobody was being nudged about. Links already sent keep their original date.
A referee can decline from the email itself, and has to say why. The request email carries a Can't provide this reference? link, and declining asks for a reason — conflict of interest, doesn't know the applicant, not authorised by their organisation, not enough basis to comment — with room to add more. Whoever requested the reference is emailed when it happens, because a nominated referee refusing is worth knowing about rather than discovering as silence.
A referee's details can be corrected, or the referee replaced, before they respond. Applicants can fix a wrong email on their own nomination, and administrators can edit or remove a referee from the request. Removing the last referee on a check reopens the step so somebody else can be nominated.
Reminders about workers missing NDIS linking details are now one per organisation. The details the Commission's new form needs are the kind a payroll system either holds for everybody or for nobody, so the first accounts to switch this on saw one task per worker — 1,595 of them in one case. You now get a single reminder per organisation, titled with the number affected and broken down by which detail is missing, listing the first 25 workers by name. The per-worker tasks are closed automatically as replaced. → NDIS Worker Screening
Victorian clearances can be exported as a WWC Connect upload file. Download report → WWC Connect upload file (VIC) writes a CSV in Service Victoria's own Add Worker Details format — one line per clearance, so a worker holding both a WWCC and a VIT registration gets two — instead of re-keying each one into Connect by hand. Run WWCC Connect readiness (VIC) first to see whose details are too thin to submit. Two columns Oho cannot answer for you are left for you to fill, and a clearance you have switched off in Oho is left out and counted back to you. → Working With Children
Candidates are emailed their police check link. A National Crime Check police check now sends the person a link to complete it, rather than relying on somebody passing it on. Checks that run through the PharmacyID portal are unchanged — that journey has no link to send. → Run a police check
Qualifications now record the designated roles they approve, alongside the staffing tier they already carried: first aid, emergency asthma management, anaphylaxis management, family day care coordinator and suitably qualified person. ACECQA's list has always covered both, and the roles are what answers "who is this service's first aid qualified person". A qualification carries one axis or the other — a first aid certificate approves a role, it does not make its holder Diploma-level. → Qualifications
The rest of Oho now meets the same colour contrast standard as the applicant capture pages. Where the brand orange carried text or sat behind white text — the Forgot password and authenticator links, the referee form's section headings, View credentials on a worker's card, the confirm buttons on Add credential and the Review & Decide windows — it is now a deeper orange, as are focus rings, focused input borders, ticked consent boxes and selected options. Orange is unchanged wherever it is decoration. Nothing moves and nothing is renamed.
Screen readers can find their way around a page. Settings, the worker and applicant lists, the task inbox, the analytics pages and every profile now start with a heading that names the page, so jumping by heading no longer lands mid-page. The preview and remove buttons beside an applicant's uploaded files now name the file they act on instead of reading out as "button". Nothing looks different on screen.
Entering the right password no longer resets the lock-out budget before the code step. Wrong passwords and wrong authenticator codes deliberately share one count of five, because a six-digit code is guessable in far fewer tries than a password. Re-entering the correct password used to clear that count before the code was checked. Only a completed sign-in clears it now. → Manage users
QLD Blue Card linking can sign in to the portal again. The sign-in needed a key it was looking for under a name nothing supplies; linking has never completed on any account until now. → Link QLD Blue Card holders
An address for a worker, credential or user who no longer exists shows a "not found" page, instead of an empty profile that looks like a record with nothing in it.
A webhook delivery that hits a dropped connection is tried once more before it is recorded as failed. → Webhooks and event delivery

v1.23.0 — 20 October 2026

Passwords now expire after 90 days. Anyone who signs in with an email address and password chooses a new one every 90 days, offered with a Not now button from 14 days out and unavoidable once it expires. A new password can't repeat any of the last five. Existing passwords are treated as set on the day you upgrade, so nobody is locked out at once, and single sign-on users are unaffected. Administrators can force a change with Expire Password on the user's row. → Manage users
Five wrong sign-in attempts now lock an account. Wrong six-digit codes count towards the same five, a successful sign-in clears the count, and a wrong attempt only counts for 15 minutes. A locked account shows a Locked badge in the user list; completing an emailed password reset unlocks it, as does an administrator. There is no automatic unlock after a wait — that would let someone wait and resume guessing. → Manage users
An administrator can now reset two-factor for someone who has lost their authenticator. Reset MFA on their row clears the pairing and nothing else; they set up a new authenticator at their next sign-in. Deleting and re-inviting the account used to be the only way back once the backup codes were spent. → Sign-in and two-factor
Two-factor pages now have to be reached through a sign-in. Setting up or entering an authenticator code only works as part of a sign-in that just checked the password, within five minutes of it — so a bookmarked authenticator page no longer opens on its own. Resetting a password also stops signing you straight in where two-factor applies: you set the password, then enter a code as usual. → Sign-in and two-factor
Stored passwords are now protected with Argon2id instead of a single round of SHA-256, which makes guessing them in bulk against a stolen copy slow and costly. Nobody needs to change their password: each one is upgraded the next time that person signs in, and accounts nobody signs in to are upgraded in place.
Re-importing a spreadsheet no longer duplicates your workers. A Worker ID that a spreadsheet saved as a number — 02579 becoming 2579 — is now recognised as the same payroll number, and the four ways of connecting the template (Excel, Google Sheet, SFTP, CSV) count as one source rather than four. Duplicates created before this change stay as they are. → Import a spreadsheet
Phone numbers can be included in the Compliance Overview export. Work Phone sits under Work contact and is on by default; Personal Phone sits under Personal details, which stays off by default. The two are kept apart deliberately — a work number is not an answer to "how do we reach this person". → Export compliance data
A childcare position can require an ACECQA tier instead of a list of codes. A requirement can name Early Childhood Teacher, Diploma-level or Certificate III-level, and Oho reads the tier it already records against each qualification — ACECQA's list runs to hundreds of codes per tier. "Early Childhood Teacher" means both halves: an ECT-level qualification and current teacher registration. → Qualifications
Educators working towards a qualification no longer have to read as At risk. A new switch in Settings → Manage → Qualifications, off until you turn it on, counts an educator enrolled in an approved qualification as holding it, provided the enrolment is evidenced and has an expected completion date. The concession lapses on its own 30 days after that date, so someone who stops studying reappears without anyone remembering to check.
A worker can hold more than one position, and must meet the requirements of all of them. Workers with a single position are unaffected. → Workers
An equivalence set can offer a bundle as one of its options — "a first aid certificate, or CPR together with manual handling" — where the second choice counts only once the worker holds both. Screening packages can now build and maintain sets for you; a set Oho maintains says so, and edits to it are replaced next time that package is saved. Over the API, a bundled set reads back with an empty members list and its choices in a new options list. → Compliance rules
NDIS linking asks you once for what the Commission's new form requires. Your NDIS verification source has a Link Details step for the two things Oho cannot invent: how your worker types map to the Commission's fixed employment types, and any work-location names of your own. Workers missing a detail raise a task naming exactly which fields are absent, which closes itself when the data arrives. Linking remains paused until the Commission's portal accepts it. → NDIS Worker Screening
A scheduled credential check that failed before it started now reports Failed. Such a run used to finish as Success with "Total credentials found: 0", so a source could fail every week without anyone noticing. Expect to see Failed runs on sources that have been quietly showing Success — those runs were already failing. A run that checked its credentials and hit a few errors along the way still reports Success. → How monitoring works
TAS Working with Vulnerable People checks run on schedule again. One credential with a damaged link to its worker was enough to stop a run before it looked at anything. Credentials left showing an error are cleared by the next scheduled run. → Working with Vulnerable People (TAS)
A cleared NSW Working With Children Check now records its expiry date, instead of arriving with the date missing. Where the register's answer can't be read as a date, the check is still recorded and the run reports a warning naming it. → Working With Children Check (NSW)
NSW teacher registration checks work again. NESA retired the search Oho was using; checks now go to its public register API, and a response Oho cannot read is reported as an error rather than as "not found". → Teacher registration (NSW)
Webhooks now fire when a credential's files change. credential.attachmentAdded and credential.attachmentRemoved cover uploads and deletions, and attachmentLinked, attachmentUnlinked and attachmentTransferred follow the matching ownership event once per file — so a subscriber copying files into an HR record sees the ones uploaded while the credential belonged to an applicant. No event carries the file or a download link; fetch a fresh one from the attachments API. → Webhook payload reference
The HiBob connection now maps sites to organisations, brings across credentials and imports every current role as a position. → Connect HiBob
The All Workers list stops hiding things. The Department filter lists every department rather than the twenty largest, Work Email and Location no longer clip to an ellipsis on a laptop screen, and a Columns menu above the table remembers which ones you want. → Find and manage workers
Removing a task from Review & Decide is harder to do by accident, and no longer leaves the credential stuck. The red Delete link beside Review is now Remove from queue in the row's overflow menu, and a removal releases the review hold — a credential that used to read "Under review" for good returns to its unverified state rather than being passed. → Work the Review & Decide queue
A credential alert that hits a mail-gateway failure is retried rather than dropped. Those alerts had no second attempt, so one blip meant an administrator never heard a credential was expiring. → Set up notifications
Scanned documents are read more reliably. A photo or scan is cropped to the card itself, a sideways card is stood upright, and a multi-page PDF is read from its first page.

v1.22.0 — 16 October 2026

NDIS worker screening now reads from the Commission's new provider portal. The Commission moved worker screening to it on 12 October 2026 and is retiring the old one. Expect some disruption while the change goes out: NDIS checks may be slower than usual and some may need to be retried. Existing records are untouched, nothing is deleted, and every other register is unaffected. NDIS linking stays paused, as it has been since 11 October 2026. → NDIS Worker Screening
A referee is asked to consent before they see a single question, can decline the request outright with a reason, and ticks a declaration and signs before submitting. A decline is a result in its own right rather than silence: reminders stop, the link closes, and the reason they gave is shown with the request.
A reference can carry notes that only your team can see. They sit with the reference on the worker or applicant, and are open to anyone who can already edit that person's record — a manager invited to one organisation does not get them on another's.
A document attached to a qualification now raises a "Qualification document" decision. A testamur or statement of attainment used to sit on the record with nobody asked to look at it. Accepting the decision is what records the qualification as document verified; rejecting it, asking for another document or dismissing it changes nothing. Removing the file closes the decision. → Work the Review & Decide queue
Qualifications now carry an ACECQA verdict as well as a register one. Oho records which tier a qualification counts as in an education and care service — ECT, Diploma or Certificate III — whether it is on ACECQA's approved list, and any state the approval is limited to. All three can be filtered on. The register check is left alone: the two answer different questions and disagree routinely. → Qualifications
Picking a credential type is now grouped and searchable. The Add Credential and screening package pickers group types into families — the WWCC ones, the right-to-work ones — and search on everyday words, so "visa" brings back all five right-to-work types instead of guessing one. Driver's licences name their state. → Add a credential
One stray space in a reference number no longer slows AHPRA checks for everybody. A registration number saved with surrounding whitespace was read by the register as a challenge Oho could not answer, which throttled AHPRA verification across every account. Numbers are now trimmed before the register is searched. → AHPRA

v1.21.0 — 15 October 2026

NDIS worker linking is switched off. Since 11 October 2026 the NDIS portal has refused the request Oho uses to link a worker to your Worker Screening register, so Link new workers and Re-link NDIS are greyed out rather than retrying. Nothing already linked is affected and NDIS verification keeps running, but a worker added from now on shows no NDIS screening until linking is turned back on. QLD Blue Card linking is unaffected. → NDIS Worker Screening
Credentials waiting to be linked are now reported once per organisation, not once per credential. A register whose link run has never reached it raised hundreds of near-identical reminders — 796 on one account. Those are now a single reminder per organisation per register, titled with the number affected, and one action clears them all. A credential a link run did reach and failed on keeps its own reminder. → Review & Decide
Qualifications with an expiry date are watched the same way credentials are. First aid, CPR, anaphylaxis, asthma and child protection refreshers move to Expiring soon and Expired on their own, using the thresholds already set in Settings → Manage → Notifications. A blank expiry date is never read as expired, and training still in progress is left alone. → Qualifications
Oho warns before a second record is created for someone already on your worker list. Both Add Worker and Convert to worker look for a matching employee ID, or the same surname and date of birth, and show you who they found. Nothing is blocked — rehires are real — and the conversion form can link the applicant to the existing worker in one click. → Add a worker
A new "Possible duplicate worker" decision appears in Review & Decide. Confirming it moves the duplicate's credentials onto the record you keep, carries across the applicant they were screened as, and retires the other record. You choose which record survives, and the decision can be reverted. Dates of birth are never shown in the queue. → Review & Decide
Verification checks now appear on the worker's Activity tab, alongside the manual changes that were already there — a scheduled sweep, the check when a credential is first added, or someone pressing Verify. An audit can read one worker instead of opening each of their credentials in turn. → Audit trail
A verification run cut short by a register now comes back the same day — an hour later, then four, then twelve — instead of waiting for the next scheduled run. Credentials it did not reach keep their previous status, and the run history says how many were missed and when the next attempt is due. → How monitoring works
An unusable work email from Oracle HCM no longer stops the rest of a worker's update. The address is left out and the name, job title, status, start and end dates are saved; the count appears in the import's run report so it can be corrected at the source. → Connect Oracle HCM
A visa check the visa service refused now says so plainly, rather than showing an internal error. It deliberately does not say the worker's passport could not be matched: a refused request is as often a fault on our side. These are reported to us automatically and need nothing from the worker. → Right to work
A NSW teacher registration check tells a changed register apart from an unreachable one. Where NESA has changed how it accepts searches, the check now says it could not be completed and has been reported, instead of promising an automatic retry that was never going to succeed. → Teacher registration (NSW)
Webhooks from thirteen newer instances now carry the right instance name. tenant.id and the X-Oho-Tenant header sent the shared placeholder oho on instances created since mid-September; they now send the instance name in your Oho web address. If your receiver filters or routes on either value, update it before the change reaches you. Nothing else about the messages changes. → Webhook payload reference
A webhook has to point somewhere on the public internet. An address naming a private or internal location — 127.0.0.1, a 10.x or 192.168.x address, a bare name with no domain — is refused on save, and an existing one stops with "Destination refused" on the delivery record. Those addresses could never reach your systems. → Webhook endpoints
An upload now has to declare the file's size. POST /openapi/v1/attachments/upload requires fileSizeBytes, and the link it returns accepts exactly that many bytes; the getPresignedUploadUrl GraphQL query requires it too. Documentation and link attachments are capped at 5 MB, the limit credential and police check attachments already had. Uploading through the Oho web app is unchanged. → Bulk import

v1.20.0 — 14 October 2026

An NDIS Worker Screening clearance that lapsed while the worker is renewing reads as "In application", and keeps them on the Compliance Overview as At risk. It previously read as a current clearance with no expiry date, which took the worker off the overview entirely. → NDIS Worker Screening
A new "Waiting to be linked" decision names a credential that has sat more than seven days without the scheduled run that links the person to your organisation in the regulator's portal. It closes itself once the credential links. → Review & Decide
Administrators can remove a task from Review & Decide without deciding it, for reviews that should never have been raised. A removal is not recorded as a decision: it is written to the person's activity log with your name and your reason. → Review & Decide
The QLD Blue Card "Link new workers" list no longer offers cards held by workers who have left. Expect a shorter list; nothing is deleted, and a reactivated worker reappears straight away. → Link QLD Blue Card holders
Pressing Verify on an NDIS screening with no result explains that the result comes from the linkage step, instead of reporting an internal error. → NDIS Worker Screening

v1.19.0 — 13 October 2026

Expired and paused credentials no longer ask you to decide a name. Entries already open on one close themselves the next time the credential is updated. → Review & Decide
"Withdrawn by the issuer" no longer counts records carried over from an older system. On an account migrated from another product the number falls, in some cases to near zero — nothing about those credentials has changed. → Understand your Compliance Overview

v1.18.0 — 12 October 2026

Review & Decide can be searched by name, sorted A–Z, and narrowed to an organisation or a kind of check. Decisions already in the queue before this arrived sort to the bottom until Oho refreshes them. → Work the Review & Decide queue
A decision waiting on a check now follows the person from their applicant record onto their worker profile, and onto the new holder whenever a credential is transferred. It keeps its place in the queue rather than reappearing as new work. → Review & Decide
A name-mismatch review can be closed once the credential has moved to someone else, and a shared policy or course number no longer collapses a whole team onto one credential. → Review & Decide
A correction to a credential's expiry date holds, instead of being overwritten by the next sync. A later expiry from your HR system still lands, because that is a renewal. → Keeping data in sync
Fetch requests can be cancelled in bulk, instead of one click per request. Requests somebody completed while the page was open are left alone. → Send a fetch request
iChris internal notes no longer have to come across onto the credential. A Bring Across Internal Notes toggle sits with the other credential settings, on by default. → Connect iChris

v1.17.0 — 11 October 2026

A credential the issuing authority has taken away is reported even when the person has left. A Withdrawn by the issuer line counts every revoked or suspended credential on the account. → Understand your Compliance Overview
Workday visa records no longer set a worker's passport country, which had been recording synced visa holders as Australian citizens and skipping the VEVO check entirely. Countries already overwritten are not corrected automatically. → Connect Workday

v1.16.0 — 9 October 2026

Confirming an accreditation transfer now moves credentials off a duplicate worker record, and tells you plainly when it can't — a confirmation that moved nothing no longer reports success. → Review & Decide
A worker arriving from your HR system is flagged when they already have a profile created by converting the same applicant, instead of quietly becoming a second record. → Review & Decide
Declarations, reference requests and ban checks are visible to organisation-scoped users again. Existing records are backfilled in the background, so expect these counts to go up for anyone who is not a Super Admin. → Roles and access
Workers created or updated via the REST API are linked to their organisation automatically. Workers that already exist are not backfilled. → API Reference: Workers
Scheduled syncs no longer split their history across a stray "[CLI] …" data source. Existing placeholder rows are safe to delete. → Ingest your data
New passwords must be at least 15 characters, and a password that is common, breached or little more than the person's own name is refused. Existing passwords keep working and nobody is asked to change theirs. → Invite your team

v1.15.0 — 8 October 2026

A worker can be marked On leave. It is a label you set by hand, with its own status chip and filter — it does not pause checks or expiry warnings. Use Active for that. → Workers
A renewed Victorian Working With Children Check updates the check it renews, instead of appearing as a second one. All issues of one card are now a single check carrying the most recent expiry date. → Working With Children Check (VIC)
Correcting a credential's reference number no longer leaves a duplicate card behind — the attachments, source links and history move to the corrected record. → Add a credential
An IntelliHR credential's reference now identifies the record it came from, rather than the qualification type, so it can be traced back to the exact row. → Connect IntelliHR

v1.14.0 — 7 October 2026

The Compliance Overview can measure workers against their position's requirements, not just against every record they hold. A Measure against switch sits beside the Organisation and Manager filters; All records stays the default. → Understand your Compliance Overview
Correcting a credential re-checks it against the register about a minute later, instead of leaving the old verdict in place until the next scheduled run. → How monitoring works
Workers who go by a single name can be recorded, and verified. Legal first name is now optional, and South Australian checks search the register correctly for them. → Working With Children Check (SA)
South Australian reference numbers are tidied up before the register is searched, so a number written in any of its accepted forms no longer comes back "Not found". → Working With Children Check (SA)
A check Oho couldn't complete now reads "Couldn't verify", in grey — not "Error" in the same red used for a worker who may not engage. → Check results
Long "choose one" steps on the capture form are searchable. A step offering sixteen or more options opens with a search box and groups the rest by level, and Back, Skip for now and Next are pinned within reach on every step. → Screening packages
The Add Credential form says what it is waiting for instead of greying out the button: each incomplete field is marked, and you are taken to the first one. → Add a credential
Screen readers now convey the parts of Oho that were only ever shown in colour or layout — required fields, the capture form's step bar, and the worker and applicant lists.
The SmartRecruiters request log can unstick an order, with a Status filter and Retry and Resend result actions, instead of only reporting the problem. → Connect SmartRecruiters
The Manager filter on the Compliance Overview lists every manager, and can be searched. → Understand your Compliance Overview
Deleting a group now tells you what it costs, and the group Oho creates alongside each organisation cannot be deleted while that organisation exists. → Manage users

v1.13.0 — 5 October 2026

Registry downgrades can wait for a person before they reach your other systems. Move a credential type into Confirm registry downgrades and a registry withdrawing that credential is held for a decision rather than published straight through. An unanswered hold auto-confirms after a window you set (default 72 hours). → Review & Decide
Applicants and workers can go back into a submitted check, correct it, and resubmit. Because the amendment can unsettle a verdict already reached, the change goes to Review & Decide rather than silently replacing it. → Review & Decide
ImmiCard is now checked against the Home Affairs VEVO service instead of being taken on trust. → Right to work
A WA Working With Children Check the register says is valid no longer shows as expired. The WA register doesn't publish expiry dates, so a stale typed-in date used to override a positive register answer. That date is now cleared and the credential asks for the real one in Review & Decide. → How monitoring works
Equivalence sets can be picked directly in a screening package. → Compliance rules
A new "USI Transcript" check asks a person to list the nationally recognised training on their USI transcript and saves every line to their qualifications.
Emptying a cell and deleting its column now mean different things on the Workers sheet. → Spreadsheet template reference
iChris syncs continue from where the last successful sync got to, on their own. A connection with a date already saved in Last Processed Datetime stays pinned to it until you clear the field. → Connect iChris
Manager users can be restricted to only the workers they manage. → Roles and access
Recruit / Continuous access can be managed by group membership. → Roles and access

v1.12.0 — 2 October 2026

A worker's compliance banners are consolidated into one summary card on their profile. → Workers
A user with no role no longer receives credential alerts. → Set up notifications
iChris can skip the credential fetch for terminated workers, which is the bulk of the run on a tenant with a long leaver history. → Connect iChris

v1.11.0 — 1 October 2026

Bulk Send now starts from the credential, not the worker. It used to ask you to pick up to fifty workers out of the whole workforce before naming a credential type — which meant knowing who was short of what before you opened it. Now you pick the credential types (grouped, searchable, each showing how many workers are missing, expired or expiring) and Oho finds the workers who need them. You still review the whole list before anything sends. → Send a fetch request
Regulator red flags get their own queue in Review & Decide, instead of sitting among ordinary decisions. → Review & Decide
An exemption can carry attachments, so the evidence behind it lives on the record. → Record an exemption
A hand-corrected name stays settled when the HR sync reverts it, instead of raising the same name-mismatch review again on the next run. → Review & Decide
An employee ID can be collected when you create a worker, and a worker converted from an applicant is given one. → Add a worker
A declined HRIS check is recorded as a refusal, not a pending result, so it stops looking like something still in progress. → Keeping data in sync
An NDIS decision no longer reappears in Review & Decide once it has been reviewed. → NDIS Worker Screening
The SA register's employment type is reported as the card type, and backfilled onto records already in Oho. → Working With Children Check (SA)
An IntelliHR run names the records it dropped, rather than only counting them. → Connect IntelliHR
A provider-completed police check records its issue date. → Run a police check
Settings pages work on a small screen.
An SSO user is no longer offered a password reset that could never work for them. → Set up SSO

v1.10.0 — 30 September 2026

CSV exports carry the organisation on credentials, exemptions, declarations and ban checks. → Export compliance data
A name-mismatch review no longer lands on the wrong worker. → Review & Decide
A recruitment check shows the applicant's current credential when the one it was linked to is no longer active. → Send a recruitment check
Police check queues are sorted by request date. → Run a police check
Oho's own system accounts are hidden from the Users list. → Manage users
A worker's personal details are redacted from verification logs, including the registry sidecars. → Data retention and privacy
The public capture form no longer keeps an applicant's identity details in their browser after they submit.
More of the app works with a keyboard and a screen reader — the verification timeline, the attachment drop zone and the reviewer-note fields in the review modals.

v1.9.0 — 25 September 2026

The All Workers filters are rebuilt as search-and-browse chips. → Find and manage workers
The manager and organisation filters combine on the Compliance Overview, instead of one replacing the other. → Understand your Compliance Overview
A recruitment check no longer asks for credentials the applicant has already supplied. → Send a recruitment check
A registry's bot challenge is reported as what it is, rather than as a network error, and a VEVO check rides out a Victorian register under load. → Check results
The request-tracking pages and the 404 page say what to do next instead of showing an empty list or a dead end.
The product tour no longer covers the thing it is describing, and offers Skip all tours.
The Resources menu opens on click and from the keyboard, and the whole app has one visible focus ring.

v1.8.0 — 23 September 2026

Search & Browse gains an "expiring within" filter, and the "has an expiry date" filter works. → Find anything with Search & Browse
All Workers gains a Department filter, a worker-type filter and surname sort, and hides the organisation column on a single-organisation account. → Find and manage workers
An exemption satisfies a rule that checks validity, position requirements recompute when an exemption changes, and an expired requirement is told apart from a met one. → Exemptions
One QLD Blue Card portal organisation can map to many Oho organisations, an organisation already claimed by another source is greyed out, and the picker has a Select all row. → Link QLD Blue Card holders
Duplicate credentials are grouped by normalised reference, so the same card written three ways collapses into one row. → Review & Decide
The Compliance Overview's exports and registry linkage panel respect the manager filter. → Understand your Compliance Overview
A second claimant can no longer take over a credential that already belongs to someone. → Credential ownership
The worker picker on a fetch request lists active workers only. → Send a fetch request
HR and ATS syncs are floored at once per day. → Add a connection
Pharmacy ID police checks get their own email template and configuration. → Connect Pharmacy ID

v1.7.0 — 21 September 2026

The Status column on the workforce sheet can reactivate a worker, not just deactivate one. → Spreadsheet template reference
A recruitment check asks you to confirm before it sends. → Send a recruitment check
No review is raised against an inactive worker or applicant. → Review & Decide
Search & Browse works on a small screen — the header, the summary panel and the results.

v1.6.0 — 18 September 2026

Review & Decide can clean up duplicate credentials. → Review & Decide
The Compliance Overview's tiles, rollup and drill-downs agree with each other, and a drill-down covers the same workers the tile counted. → Understand your Compliance Overview
The "expiring before" filter actually narrows the list. → Find anything with Search & Browse
A Workday leaver the organisation filter had been dropping is recovered. → Connect Workday
The CSV export options dialog is laid out correctly, and the file-name field is named.

v1.5.0 — 17 September 2026

You can preview what a dispatch sweep would send before it sends anything. → Send a fetch request
You choose what a CSV export contains, column by column, with personal details off by default. → Export compliance data
A credential can be marked superseded by the one that replaced it. → Credentials
An exemption has an Activity tab showing what happened to it and when. → Exemptions
The "no compliance records" card drills into Search & Browse. → Understand your Compliance Overview
Downloading an attachment works after you have previewed it. → Add a credential
Oracle HCM credentials are no longer keyed on Oracle's own certification id, which had been creating a new credential on every sync. → Connect Oracle HCM
The IntelliHR External ID source field is configurable. → Connect IntelliHR
Workday asks for terminated workers and qualifications explicitly, so leavers stop disappearing from the roster. → Connect Workday
An inactive worker is skipped by the compliance dispatch sweep. → Workers
Profile fields that could be edited but never shown are now visible. → Workers

v1.4.0 — 17 September 2026

The Review & Decide queue can be filtered, sorted and grouped. → Work the Review & Decide queue
The Compliance Overview's attention queue is grouped by status, and opens on batches. → Understand your Compliance Overview
Worker compliance is reconciled tenant-wide on a schedule, so a stale verdict corrects itself. → Compliance rules
A name mismatch is raised from every path that writes a credential, once per name somebody has already adjudicated. → Review & Decide
NSW Working With Children Checks are submitted in chunks, partial results are banked rather than lost, and a row the register cannot resolve is recorded as unverifiable. → Working With Children Check (NSW)
A Blue Card held by an applicant can be linked, not just one held by a worker. → Link QLD Blue Card holders
A worker converted from an applicant is labelled as one, a deleted profile can be restored, and both are written to the activity log. → Workers
A renewal no longer flaps back to the old expiry date on the next sync, and an import cannot regress a date the register supplied. → Keeping data in sync
A police check gets an expiry date, and a mirrored one honours the validity period set for your account. → Run a police check
Workday pre-start hires are kept out of compliance until they start, and an applicant's compliance carries onto the worker they become. → Connect Workday
Credential alerts can go to several scoped shared inboxes. → Set up notifications
An applicant with no organisation uses the account's default police-check source. → Run a police check
The Compliance Overview carries the manager filter into its drill-downs. → Understand your Compliance Overview
The police check queue is operable by keyboard, and its reference fields announce their errors to a screen reader.

v1.3.0 — 16 September 2026

An NDIS Worker Screening clearance held under a different name is flagged for review. → NDIS Worker Screening
An administrator can revert their own Review & Decide decision on a disclosable police-check outcome. → Run a police check
Your import sheet can record where a worker works, not just where they live. Six new Workers columns capture the work address, which is what a state-scoped compliance rule reads. → Spreadsheet template reference
A date of birth on the Workers sheet no longer overwrites one already in Oho — the difference goes to Review & Decide instead. → Review & Decide
An organisation's data can be exported in the Excel import template, ready to correct and re-import. → Import from a spreadsheet
Pausing scanning on a credential that is expired, revoked or superseded reopens the requirement it was covering. A paused problem no longer reads as compliance. → Compliance rules
A credential the register can't find no longer stays verified forever, and a replaced card does not come back to life. → How monitoring works
Someone who has never saved their notification settings is treated as being on the Critical preset, rather than as having no preference at all. → Set up notifications
A fetch request completes when the checks behind it come back. → Send a fetch request
The police check queue opens on In flight. → Run a police check
A failed NDIS link names the PRODA organisation it tried. → NDIS Worker Screening
iChris reads a worker's status from their current position, not their nominal one. → Connect iChris

v1.2.0 — 14 September 2026

An exemption clears the credential it covers, instead of leaving the requirement open. → Exemptions
The Notes tab saves on every kind of record, not just some of them.
A credential card is titled by the kind of check it is, not by the name of its holder. → Credentials
A re-import with nothing new in it no longer unlinks a credential from its worker. → Keeping data in sync
The capture form no longer reports a police check as lodged when the provider's tab was merely opened. → Run a police check
The capture form collects a person's name in parts, so it can be matched against a register.
An NDIS application the registry itself calls eligible is treated as able to engage. → NDIS Worker Screening
Four paths that could silently drop an email now report the failure. → Set up notifications
A right-to-work credential stuck on an old error is re-checked rather than staying stuck. → Right to work
A field:value search works again. → Find anything with Search & Browse

v1.1.0 — 12 September 2026

A downloaded compliance report counts unanswered checks the same way the screen does. → Export compliance data

v1.0.0 — 11 September 2026

Deleting a worker or applicant clears the reviews waiting on them, instead of leaving rows in the queue that can never be decided. → Review & Decide
A police check queue counts only what is actually waiting — a decided check is no longer reported as awaiting review, and a clean result no longer strands part-way through. → Run a police check
A credential's middle name can be cleared. → Add a credential
The Notes tab on a credential saves.
An NDIS clearance that PRODA says does not exist no longer keeps a stale expiry date. → NDIS Worker Screening
Qualification items in the attention queue are shown as qualifications, rather than folded in with credentials. → Qualifications
A ban check outcome and a worker's alternate names are searchable. → Find anything with Search & Browse

v1.30.0 — 29 October 2026​

v1.29.0 — 28 October 2026​

v1.28.0 — 27 October 2026​

v1.27.0 — 23 October 2026​

v1.26.0 — 22 October 2026​

v1.25.0 — 21 October 2026​

v1.24.0 — 20 October 2026​

v1.23.0 — 20 October 2026​

v1.22.0 — 16 October 2026​

v1.21.0 — 15 October 2026​

v1.20.0 — 14 October 2026​

v1.19.0 — 13 October 2026​

v1.18.0 — 12 October 2026​

v1.17.0 — 11 October 2026​

v1.16.0 — 9 October 2026​

v1.15.0 — 8 October 2026​

v1.14.0 — 7 October 2026​

v1.13.0 — 5 October 2026​

v1.12.0 — 2 October 2026​

v1.11.0 — 1 October 2026​

v1.10.0 — 30 September 2026​

v1.9.0 — 25 September 2026​

v1.8.0 — 23 September 2026​

v1.7.0 — 21 September 2026​

v1.6.0 — 18 September 2026​

v1.5.0 — 17 September 2026​

v1.4.0 — 17 September 2026​

v1.3.0 — 16 September 2026​

v1.2.0 — 14 September 2026​

v1.1.0 — 12 September 2026​

v1.0.0 — 11 September 2026​