June 2026
Another month of shipping - headlined by Location-Based Compliance Management for multi-site programmes and the Workflow Checks 2.0 rebuild for recurring evidence, plus AI-assisted review workflows, audit evidence consolidation, and a batch of smaller fixes our customers asked for directly. Here’s what’s new.
Location-Based Compliance Management
Sprinto now supports Location as a first-class entity, letting you run one compliance programme across many sites — each independently evidenced, rated, and audited — without rebuilding controls for every location.
What’s new
Zones — define once, apply everywhere. Create multiple Zones per org (e.g., a TISAX zone, a GDPR zone), each with its own frameworks, controls, and workflow checks defined a single time.
Location hierarchy. Build multi-level parent→child location structures that mirror your org, with group-level controls and shared policy living at a central (parent) location.
Per-control align or deviate. Each location can align to its parent — reusing central policy, evidence, and maturity rating — or deviate and keep its own local evidence and rating, routed through local + central review.
Location-level evidence, audits, and reporting. Collect evidence per location, run audits scoped to one location, freeze a location’s evidence/ratings at the start of an audit cycle, and toggle between locations inside a single report.
One-step location replication. Adding a new location to a zone auto-applies every zone control and workflow check, generates check instances per location, and aligns to the parent by default — no manual rebuild.
Why it matters
Eliminates repeated setup across sites — define controls once, not per location, and onboard a new site in one step instead of a manual build.
Matches how multi-site programmes are actually governed: a central hub holds shared policy, sites inherit it and reuse central work wherever they genuinely align.
Keeps ratings accurate per location instead of one group-wide score, with extra review rigor wherever a location deviates.
Keeps every site continuously audit-ready with independent, frozen, point-in-time evidence per location scales cleanly from tens to hundreds of locations, with location-scoped access so multiple reviewers can work in parallel without a single bottleneck.
Availability: This is an on-demand feature. Raise a request to get this feature enabled for your organisation.
Workflow Checks 2.0 — Period-Based Evidence Tracking
Workflow Checks (your recurring compliance evidence — quarterly access reviews, monthly management reviews, semi-annual risk assessments) have been rebuilt on a time-windowed, period-based architecture. Every scheduled occurrence is now its own tracked compliance window, replacing the single check-wide status of the legacy model.
What’s new
Compliance windows (Check Run Events). Each check now generates a series of time-bound windows from its frequency and activation date — e.g., a quarterly check produces a distinct Jan–Apr, Apr–Jul, Jul–Oct, Oct–Jan window each year — so one period’s evidence is never confused with another’s.
Per-window status. Pass/fail is now evaluated per period, not per check — see exactly which quarter is complete and which is still open, instead of one shared green/red status.
Evidence tied to its window. Uploads attach to the specific period they satisfy, with structured window history replacing the old raw-state log — auditors can pull last quarter’s evidence on demand, months later.
Configurable task lifecycle per check. Set an upload-reminder window (before or after the evidence period ends), an escalation-reminder window if evidence is still missing, and a non-compliance offset defining when the check is officially marked failing.
One task per pending window in the task drawer, instead of one task per check.
Why it matters
Fixes a real gap in recurring-evidence tracking: a single status per check hid whether Q1 was actually done while Q2 sat open — per-window status shows the true state of every cycle.
Gives auditors retrievable, period-specific evidence instead of “whatever was uploaded most recently.”
Reminder and escalation timing is now configurable per check instead of one-size-fits-all, cutting missed evidence and notification noise.
Availability: Gated behind the org-level feature flag workflow-checks-2-enabled.
AI Answer Accuracy Tracking in Security Questionnaires
Security Questionnaire’s AI auto-answers now track how often responses are accepted as-is versus edited — giving your team a live, trended signal for how much to trust the AI.
What’s new
Every AI-generated questionnaire answer is now tagged as approved or changed when a reviewer acts on it.
A new “Questionnaire Accuracy” chart on the Analytics page shows this as a trended percentage over time.
Works across all AI-answered questionnaires, not just a single request.
Why it matters
Gives reviewers a data-backed way to gauge how much they can rely on AI answers, instead of a gut feeling.
Supports quality governance for AI-assisted questionnaire responses — useful for your own internal audit of the AI feature.
Helps teams recalibrate review effort down as accuracy trends up.
Availability: This is an on-demand feature. Raise a request to get this feature enabled for your organisation.
Consolidated Asset Register — A Single Evidence View for Auditors
Auditors no longer have to piece together your asset inventory across six separate evidence types. A new consolidated Asset Register evidence type gives them one place to see everything.
What’s new
One evidence view combining infrastructure, repositories, people, devices, systems, and custom assets.
Each asset shown with type, classification, owner, source, and date added.
Mapped automatically to the relevant compliance controls (e.g., Asset Management, Inventory Management).
Why it matters
Gives auditors a single source of truth instead of six evidence requests to reconcile manually.
Speeds up audit fieldwork — fewer back-and-forth clarifications on “which list is the real one.”
Mirrors the internal Asset Register view your team already uses, so nothing is out of sync.
Availability: Globally available.
Custom Ingestion Entities on AI Toolkit
AI Toolkit now works with your own custom ingestion entities, not just Sprinto’s native ones — so you can build AI Agents on top of whatever data model your org uses.
What’s new
Register and ingest custom entity definitions for use inside AI Toolkit.
Build AI Agents directly on top of those custom entities.
A contextual AI drawer now surfaces automatically on any page tied to a custom entity.
Why it matters
Extends AI Agents beyond Sprinto’s built-in data — a blocker for customers running non-standard data models.
Lets teams model their own entities and still get full AI assistance in context, without leaving the page they’re on.
Availability: Globally available.
Rule Engine: Custom Tasks and Send Email Actions for Policies
Rule Engine actions now include creating a custom task and sending a policy-related email — widening what your automated rules can actually do.
What’s new
New Rule Engine action: create a custom task.
New Rule Engine action: send an email tied to a Policy.
Why it matters
Lets teams automate more of their policy and task workflows end-to-end, instead of triggering a rule and then following up manually.
Turns Rule Engine from a pure monitoring/alerting tool into a broader workflow-automation layer.
Availability: Globally available.
Quick Updates
Smaller improvements and fixes shipped this month:
Policies: You can now set the approval date when importing policies for the first time, so historical approval timelines carry over accurately instead of everything landing on the import date.
Task Dashboard: Task-level due dates are now visible, sortable, and filterable — see at a glance how long a task has been outstanding.
Controls: Custom controls no longer force a “CTRL” prefix — control numbering now matches what your team actually uses.
Wrapping Up
That’s June. As always, if you’d like a deeper walkthrough of any of these, reach out to your CSM or drop a note in our support channel.
Last updated