Changelog

​

Security & Compliance

• Sanctions-compliant access controls. Access from OFAC-sanctioned jurisdictions is blocked at the network edge, with audit-grade match logging.

​

New

• Self-serve enterprise downloads. Eligible customers retrieve signed Nebula bundles, signatures, and SBOMs directly, replacing email delivery.

​

New

• Microsoft 365 connectors. First-party ingest for OneDrive, SharePoint, Outlook, and Teams. Joins Google Workspace, Slack, and Notion as supported sources.

​

Improved

• Cursor-stable pagination. List endpoints move to keyset pagination — consistent under concurrent writes, faster at scale.

​

New

• In-house SDK generator. Python and Node.js SDKs now generate from our own pipeline, replacing Stainless. Ships with a canonical error envelope, and new endpoints land in the SDKs within minutes of release.

​

Changed

• zeroset.com is now our primary domain. trynebula.ai continues to work as a transparent alias, so existing integrations, allowlists, and bookmarks keep working without changes.

​

Security & Compliance

• Signed releases. Every container image ships with a signed SBOM and provenance attestation, gated on a CVE scan. Available on request for security review and procurement.

​

New

• Per-customer release notifications. Enterprise customers subscribe specific recipients with per-customer delivery preferences.

​

New

• On-premise. Nebula ships as a docker-compose bundle for evaluation and a production Helm chart for self-hosted Kubernetes.

​

Improved

• Two-stage cold-collection admission. When a cold collection takes its first query after a quiet period, foundation load and cache-fill now run as separate stages — queries land far sooner.

​

Security & Compliance

• Leaked-password protection. Registration checks new passwords against the Have-I-Been-Pwned database and rejects known-compromised credentials.
• Hardened network perimeter. Customer-facing services are reachable only through our managed edge; direct-to-origin paths are closed.

​

Security & Compliance

• RS256 access tokens. All API access tokens move to RS256 signatures end-to-end.
• Centralized audit logging. Account and infrastructure audit logs consolidate into a single retained store for SOC 2 and customer audit windows.
• High-availability database tier. Every Nebula deployment runs with a warm cross-AZ replica for automatic failover.

​

Improved

• Zero-downtime deploys. Rolling restarts drain gracefully; in-flight requests are no longer dropped.

​

Security & Compliance

• Encryption at rest. All workload and customer-facing storage is encrypted at rest with managed keys.

​

New

• Live document sync. Slack, Google Drive, Gmail, and Notion sources update through change webhooks instead of interval polling. New content reaches memories within seconds of creation.

​

New

• Contract-first public API. Every public endpoint derives from a published OpenAPI contract — the single source of truth for the API surface.

​

Improved

• Batched entity merges. Per-group merges and deduplication runs collapse into a single relationship scan, eliminating the N+1 path that previously dominated dedup latency on collections with thousands of related entities.

​

Improved

• Retrieval, rewritten. Ground-up rewrite of the query engine with single-pass evaluation and filter pushdown. Latency and quality gains across the board.
• Stronger recall on time-anchored questions. Questions about specific events, moments, or “when” something happened return more relevant results.

​

New

• Selective OCR for PDF ingestion. PDFs route page-by-page through OCR only when needed, on a unified streaming pipeline. Faster ingest and higher fidelity on mixed text/image documents.

​

Improved

• Persistent warm-search state. Search state for active collections stays warm continuously instead of cold-starting on demand, eliminating most cold-start penalties before they happen.

​

Improved

• Resilient embeddings. The embedding pipeline absorbs upstream rate limits transparently and keeps ingestion infrastructure warm. Transient failures on large uploads largely disappear.