Tech Blog - September 2026

New features added and issues addressed in the TurboQSA product. September 2026.

featured image for post Tech Blog - September 2026

In September we continued strengthening our TurboAI MCP capability with clearer permissions and safer agent guidance. We also advanced PCI PIN support with a more connected evidence workflow and introduced weighted project progress tracking.

Let's recap our progress in September 2026:

New Features

  • MCP security and permissions: API keys now support Read Only, Read & Update, and Full Access levels. They can also be limited to relevant MCP areas, giving teams tighter control over what each integration can see and do.
  • Weighted project progress: Projects now show a more representative completion percentage that accounts for work in states such as "Changes requested".
  • PCI PIN control matrix: PCI PIN assessments now support controls that require both document and interview evidence. Interview records are linked to the relevant controls and carried into the "Individuals Interviewed" section, while payment-channel checks appear only where relevant.
  • Evidence Archive organization: Administrators can now organize the Evidence Archive by requirement number and copy the archive password more easily.
  • ROC translations: Official PCI DSS requirements, testing instructions, and guidance are now available in Portuguese and Spanish throughout the Report on Compliance workflow. Exports also identify reports that are available only in English.
  • Global snippets import and export: Global snippets can now be imported and exported, making reusable content easier to manage.
  • Engagement tasks in API and MCP: Engagement tasks and assessment overview information are now available through the System API and MCP tools.
  • MCP assessment status tools: AI agents connected through MCP can now read Part I assessment overview status, table and row status, and total project progress.

Bug Fixes & Improvements

  • Evidence uploads: Opening the details for an uploaded file no longer launches the file-selection dialog.

  • PCI PIN: Items marked not applicable are now calculated correctly for PCI PIN assessments.

  • Consultant Phase handoff: When a Qualified Security Assessor is assigned, TurboQSA now confirms the transition from Consultant Phase to the QSA stage. The transition can be skipped when it is not appropriate.

  • MCP agent guidance: Improved guidance helps AI agents work more safely and reliably, especially when updating or deleting information.

  • Performance: Improved loading performance across the website.

  • Documentation: Updated user guides cover engagement tasks, weighted progress, the evidence library, reminder banners, and license controls. Russian documentation is now available as well.

  • Database reliability: Improved and stabilized practices of database access.

  • Engagement task enhancements: Tasks can now repeat on a semiannual schedule, and outdated tasks can be removed with new role-based delete permissions, keeping task lists clean.

  • Integration API documentation: The API docs now cover the newest endpoints and fix parameter tables that were rendering as plain text, making them more accurate for your developers.

Stay tuned for more updates as we continue expanding TurboQSA's capabilities - and subscribe to our LinkedIn page!