Trustworks Release Notes — October 2026

This release brings vendors, partners and other outside collaborators directly into your Trustworks work with External Contributors. Alongside it, we're shipping more flexible assessments, richer AI Use Case records, smarter Initiative insights, and several improvements to DSRs and exports.

Spotlight: External Contributors

You can now add vendors, partners and other outside collaborators to Trustworks as External Contributors. They take part in the assessments and tasks you assign them without needing an account, a password or a login. Each person gets a secure, personal link by email that opens exactly the task they've been asked to work on.

Why it matters

Privacy and compliance work rarely stays inside one organization. Vendors answer due diligence questionnaires, partners supply details for a new initiative, and outside advisors review evidence. External Contributors bring these people into the same workflow as your team, so their input lands where the rest of the work lives.

Setting up an External Contributor

  1. Go to Settings › Users and click Create User (previously "Invite User").
  2. Turn on the External user toggle.
  3. The role is set to Contributor automatically (Admin and Member can't be selected), and Send invite email switches off, so no invitation is sent.
  4. Assign the person to an assessment or task. They'll receive an email with a link to it.

What External Contributors can do

  • Assessments: respond to or collaborate on assessments, including those launched from workflows, New Assessment and Bulk New Assessment.
  • Tasks: open standalone tasks assigned to them, update the task status and add comments.
  • Comments: when someone @mentions them, the notification email takes them straight to the right place.

External Contributors only see the items assigned to them. They can't browse the rest of your workspace, and they can't be selected as owners, reviewers or approvers on other records, such as risks, assets, processing activities or initiatives.

Secure access by design

Every link is tied to one specific assessment or task, so it can't be used to reach anything else. Access can be revoked at any time. Existing vendor links keep working and now run on the same secure access model.

Easy to spot and manage

  • The Users list has a new Type column (External / Internal) that you can filter by.
  • Wherever you pick a user, for example when assigning a task or an assessment, External Contributors are labelled (External) next to their name.
  • If an External Contributor later needs full access, an admin can switch them to an internal user and invite them. Users who already have an active account can't be switched to external.


Assessments

Supporting attachments on assessment questions

Template creators can now turn on Allow attachments for individual questions, including smart questions. Respondents answer the question and upload supporting evidence in the same place, so there's no need for a separate File upload question. Reviewers see each attachment right next to the answer it supports.

Required file uploads

File upload questions now support the Required flag. An assessment can only be submitted once all required files have been uploaded.

Send one assessment to several respondents

When creating a new assessment, you can now select several respondents. Each person gets their own separate assessment.

Initiatives and AI Governance

Initiative summary

Initiatives now include a short AI-generated summary, based on the initiative's name, description and any reference documents. It's created automatically when an initiative is submitted (unless AI features are turned off in Settings), and you can refresh it at any time with the button next to the summary.

Custom fields for AI Use Cases

Admins can now add custom fields to AI Use Cases, the same way as for Assets, Processing Activities, Legal Entities and Risks. Track the extra details your AI governance, compliance and reporting need right on the AI Use Case page.

Data Subject Requests

Clearer DSR dates: Submitted vs. Created

DSRs now clearly separate the date a request was submitted from the date it was created in Trustworks. This is especially useful for requests you log manually after receiving them.

  • The manual DSR creation form now asks for the Submitted On date.
  • The DSR list shows a Submitted At column.
  • The DSR details header shows the Submitted On date.
  • The first event in the DSR timeline shows when the request was created in Trustworks.

Exports

You can now export a single Processing Activity as a shareable document.

Processing Activity and Data Flows export

Export any individual Processing Activity as a polished, multi-page document that's ready to share with colleagues, auditors or clients. Start the export from the Processing Activity view. It's separate from the existing RoPA spreadsheet export. The document covers:

  • Basic information
  • Data mapping
  • Controllers, processors and sub-processors
  • Data policies, including legal basis and retention schedules
  • Risk management
  • Additional information

You can choose to include the Data Flow diagram in the export. This option is off by default.

Still need help? Contact Us Contact Us