Web

• Pay Profile shows the business. With a business selected, the Pay Profile card under Send shows the business's name and PayID, its QR encodes that PayID, and the share text names the business. Personal accounts are unchanged.

• A full set of security headers now ships with the web app — strict transport security with subdomain coverage, cross-origin isolation, a permissions policy, a referrer policy, and content-type and framing protections. A content-security policy runs in report-only mode first, so it can be tuned against real traffic before it enforces.
• Sessions moved to hardened, browser-protected cookies. The browser no longer holds a bearer token: sign-in tokens, invite tokens and two-factor enrolment secrets no longer sit in browser storage, the address bar or the clipboard. One HTTP client, one authentication policy, every confirmation surface migrated — this is the load-bearing change in the release.
• Only the headers we intend reach the platform , on an explicit deny list written so a later change cannot quietly readmit one.
• Third-party tag management is gone from the signed-in app , with the content-security policy tightened accordingly.
• Security requirements fail closed. An unresolved requirement now blocks rather than passes, no source maps ship to production, off-origin navigation from a notification is refused, and the redirect guard and identity-verification SDK load are both hardened.
• Every finding from the review is closed , with automated code scanning, secret scanning and a blocking dependency-audit gate now running on every change.

• Consumer card pay-in — the payment methods enabled for you at checkout, a grouped funding chooser, real card and wallet marks, and settlement timing per rail. A refusal is scoped to that attempt rather than ending the whole flow.
• Request-to-pay — send a request, see your inbox, approve or decline.
• PayLinks match the Business PayLinks design , the list pages properly rather than silently truncating, and someone with no account and no app can pay a link in the browser.

• A faster start. The app no longer waits on two sequential sign-in calls before it begins loading your main screen, and the entry bundle is roughly 29% smaller. Content-hashed assets are served immutably instead of being revalidated on every visit.

• Settings and Support rebuilt , with Support reachable before your verification completes.
• Signing out propagates across tabs.
• A render error is caught instead of white-screening the app.
• Document upload no longer strands you. Your documents had always uploaded; a follow-on internal record could fail and leave you stuck on the step. Fixed.
• Paying a link without an account works — an anonymous payer is no longer bounced to the sign-in screen.

• Live market data with intraday charts , and FX rates on the rebuilt surface.
• An empty rates feed is shown, not hidden. The Rates panel used to disappear when the feed had nothing in it; an empty feed is a state worth showing rather than a reason to vanish.

• A parallel rebuild of the web app on the 2.5 design system — design primitives first, then the shell, sidebar, navigation and right rail, then the account, payments and product screens, all running against live APIs. AutoStack, ZAR8, PayLinks and Digital POS are live there; Spend and Cards are previews.
• A full mobile and tablet pass , with the responsive layer moved off inline styles and the wordmark now vector.
• Fixed along the way — business switching, ZAR8 yield, the deposit reference, navigation layering, cashier-mode kiosk takeover, tablet rail width and PayLinks layout.

• Circles arrives behind a flag , ahead of a gradual rollout.

• Signup attribution is sent on every path , including social sign-in.
• Android app links verify correctly , so an 80eight link opens the app as intended.

• Rebuilt create flow. A cleaner, shape-first wizard makes it faster to spin up a link and choose exactly how it should behave.
• Unlimited and never-expiring links. Create links that stay open with no cap and no expiry, for the times a one-off link isn't enough.
• Payment goals and direct requests. A goal thermometer shows progress toward a target, and direct-request links open straight to a clean pay-me landing page.
• Clearer link management. A dedicated options step, a "Total received" summary, a payer roster, and the ability to decline a request give you more control over every link.
• Right assets only. The create wizard now hides crypto that can't actually be used to pay, so you only offer what recipients can send.

• Candlestick charts. Switch any asset chart to a candlestick view, with your own buy and sell markers plotted right on the timeline.
• Your chart, remembered. Web now keeps your preferred chart type across sessions, so it looks the way you left it.
• Price alerts and order updates. A shared price-alert dialog and clearer order-cancellation feedback keep you informed, backed by proper order notifications.
• More accurate pricing. Quotes now reflect the direction-correct market leg, so the price you're quoted matches the side of the trade you're making.

• Pending applications, with a way out. Business owners can see business-account applications that are still in review and cancel a request they no longer need.
• Smoother verification. Business onboarding now collects company country for verification, wires up director KYC and consent, and surfaces clearer guidance when an address lookup or a required field is holding up the business-details step.

• Actions that match each asset. Every asset surface now respects per-asset capability flags, so you only see the actions an asset genuinely supports.
• Sharper asset visuals. Asset icons resolve from the live catalogue, ZAR8 shows its official coin logo, and any icon that fails to load falls back to a tidy lettered circle instead of a broken image.
• Cleaner ZAR8 details. Yield rewards now reflect the active reward-asset configuration, and a service charge that was never actually applied no longer appears on ZAR8.
• Payment security foundations. A new Payment Security area in settings lays the groundwork for personal step-up preferences, rolling out gradually.
• Friendlier sign-in. Logging in now lands you on your personal account instead of jumping straight into a business context, and password reset behaves correctly for social sign-in accounts.

• Presence signal. A lightweight, visible-tab heartbeat powers a more accurate online status.
• Money accuracy. Amount formatting now rounds down consistently, and a new money-endpoint parity check keeps web quotes aligned with the rest of the platform.
• Reliability. A hardened test pipeline and corrected app-link configuration make releases and deep links more dependable.

• Business Suite — foundations. Team management, roles and permissions, and business onboarding are now on the web (rolling out).
• Business verification. A full, in-app business KYB/KYC verification flow.

• Clearer trading & rates. Buy and sell rates now reflect the price you'll actually receive.
• Cleaner money display. A consistent pass across balances, amounts, and transaction details — correct currencies, precise values, and clearer receipts throughout.

• More reliable sign-in and session handling, so a brief hiccup no longer logs you out.

• Correct purchase amounts in history. A past "Bought" row now shows the exact amount paid rather than a recalculated figure that could read slightly high. Applied across the transaction list, the all-transactions view, the single-transaction detail and business-suite rows.

(Display only — your balances and the trades themselves were always correct.)

• Safer payments. Sending, withdrawing, and buying are now protected against accidental double-submits — a quick double-tap or a retried request can't move your money twice.
• Hardened account management. Fixes to password reset, two-factor settings, anti-phishing, and PIN verification, plus a tighter guard on the trade-confirmation screen.

• Accurate withdrawal fees. The withdrawal screen now shows the actual fee from the live quote — and the exact amount you'll receive — instead of a fixed estimate.
• Clearer notifications. Improved display for business, account, and PIN-reset notifications.
• Invite improvements. Your referral code now shows on the Invite screen, matching the mobile app.

(Coming soon: business tools — Business Suite, Pay Links, and in-store payments — continue to be hardened behind the scenes and will switch on for eligible accounts in a future update.)

• Tidied data handling. Standardised how your account reference is read across the app and removed a piece of legacy code, with no change to anything you'll see or do.

• 88Pay to anyone. Send to any phone number — even someone who isn't on 80eight yet. They'll receive your payment and can claim it as soon as they sign up.
• See balances your way. Choose your display currency (USD or ZAR) across your wallet and the market, with your preference remembered between visits.
• Smoother identity verification. A more flexible verification experience that supports an additional provider, so getting verified is faster and more reliable.
• Cleaner buy and sell. More accurate balances and pricing, with sensible fallbacks when market data is briefly unavailable — plus a tidier transaction history and quality-of-life polish across the app.

• Hardened account security. Strengthened account and data protection across payments and wallets, including stronger two-factor protection on sensitive actions.
• A modern foundation. Re-engineered on a fully-typed TypeScript codebase and the v2 platform, with expanded automated testing and new, more reliable hosting.

• Business Suite. Dedicated business accounts and wallets.
• Accept payments. In-store point-of-sale and shareable payment links, with scan-to-pay.
• Business ZAR8 yield. Earn yield on your business ZAR8.

(These are not yet switched on — watch this space.)