Changelog

Told when a source stops, a weekly summary, charts that show gaps and extremes, and links to them

• NewThe quiet-source watchdog, on every plan, Free included, with no rule to write: once a source - your Home Assistant, a collector, a script, each by its API key - has been sending for half an hour, the account owner gets one email if it then stays quiet for longer than it usually does, and one more when it sends again. It learns how long each source rests, so a Home Assistant that is quiet every night is not reported every night; it waits at least 12 hours in a source’s first week and never more than a day. Settings lists every source it watches, and there you can make it wait longer or turn it off. The quiet-source watchdog
• NewA short summary every Monday morning of the week before: the readings received against the week before that, the sources and tags that went quiet or came back, the alerts that fired and how much of your plan is in use - and, most weeks, first of all that nothing unusual happened. For accounts that sent data in the last four weeks; one click in the email, or Settings, stops it. The weekly summary
• ImprovedA new account’s first screen makes the Write key right there, for the way your data comes in - Home Assistant, the collector on Docker or on Windows, or the HTTP API - and puts it into every step to copy. It then waits for your first reading and turns into its chart the moment it arrives, without a reload.
• ImprovedOpen in My Home Assistant: the Home Assistant guide, the Explorer’s first screen and the Connectors page open Tag Historian in HACS on your own Home Assistant, and then the integration’s setup, so there is no repository address to type in. Install through HACS
• ImprovedTrends draws one value axis per unit, so a temperature and a pressure no longer share a scale; breaks the line where nothing was stored, instead of drawing straight across the gap; and shades the lowest and highest reading of every hour or day around its average, so a spike survives a long range. Drag across the chart to zoom in, with finer data loaded for the window you picked. On Auto, hourly and daily charts reach the present: the newest hours, which are summarised about ten minutes after they end, are worked out from the readings meanwhile, and a CSV saved from the chart leaves them out until then. Long ranges are not slow
• NewA Trends chart has an address of its own - its tags, its window and its resolution - so you can bookmark it or send it to someone on your team. Open in Trends on the Tags page opens that tag’s last 24 hours.
• ImprovedAlert emails, and the ntfy, Pushover, Telegram, Slack and Teams messages, link to the tag’s chart from an hour before the alert to an hour after it, with the moment it began marked, instead of to the list of alerts. The Alarms page shows a small chart beside each alert and each rule, with a threshold rule’s limit drawn in. What a message says
• ImprovedSettings shows the readings of each of the last 30 days against your daily allowance, as a chart and as a table. The plan card says how your plan is billed and when it renews - or when it ends, once cancelled - from your subscription itself; it used to show the calendar month as the billing period, on every plan, Free included.
• ImprovedCollector 1.0.48: a row of a tag file the collector cannot use is skipped and named in the log with its line and column, and the rest of the file is collected; the health line counts such rows as tagsSkipped. A tag file that cannot be read, or in which not one row can be used, stops the start with exit code 78 - now for a Modbus tag file as well as an OPC UA one. The tag file
• ImprovedCollector 1.0.48, Modbus TCP (beta): a value that holds steady is sent again every 5 minutes by default, so a “no data for” alert on a setpoint fires when the device stops answering, not because the value held. That is at most 288 readings a day for a tag that never changes; HeartbeatSeconds 0 sends changes only, as before. Polling, and what is sent
• ImprovedCollector 1.0.48: a tag name is collected from one source only, across OPC UA servers, Modbus devices, MQTT and Sparkplug B, and a second definition is skipped with an error naming both places, instead of two sources writing into one tag. At start the collector also warns once if the tags in its configuration will not fit your plan, and how many will be refused.
• FixedCollector 1.0.48: a computer clock that steps back no longer holds off writing readings to disk, nor makes the age limit drop the newest ones from the queue. A queue whose files were deleted, or that was restored from a copy, is sent from its oldest file instead of being skipped without a word. When the uplink drops
• FixedA paid plan can no longer be bought twice. Starting a checkout on an account that already pays points to Manage Subscription instead, and starting a checkout closes any older checkout page still open in the browser.
• FixedSaving a tag’s units on the Tags page no longer clears the fixed scale you set for its chart.
• ImprovedAPI: a compressionDeadband outside 0 to 1 is refused with a 400 that says what the number is - a fraction of the last stored value, not a distance in the tag’s unit. A 5 used to be taken as 500% and store almost nothing from then on. The batch endpoint, which ignores the field, is unchanged.
• ImprovedAPI: GET /api/customers/me/usage and GET /api/customers/{id}/usage report tier as the plan’s name - "Basic", "Professional" or "Enterprise" - as the 402 quota answer and GET /api/usage already did. It was a number; a script that compares the number needs the name now.
• PrivacyThe privacy policy says what the quiet-source watchdog and the weekly summary keep, for how long, and that both are deleted with the account, and that the plan card’s billing period is copied from our payment processor’s record of your subscription. Privacy policy

Excel reports, charts shared by link, OPC UA browse, and Modbus TCP in beta

• NewExcel reports: pick tags and a period on the chart page and download an .xlsx with a row per hour or per day — minimum, maximum, average and readings for each tag, in your time zone with summer time handled — and a summary sheet for the whole period. On Pro and Business. Excel reports
• NewRead-only links: send a plant manager or a customer one saved chart view, which they open without an account or a sign-in and which updates itself on a wall screen. You choose what each tag is called on their page, how long the link works (90 days unless you choose otherwise, a year at most) and whether it shows your account’s name; they see that chart and nothing else. Settings lists every link with who made it and when it was last opened, and revoking one stops it at once. On Pro and Business. Share a chart by link
• NewThe OPC UA collector reads its tag list from a CSV file you name in TagsFile, saved from Excel in any language, and its new browse command writes that file for you: every variable on the server with a suggested tag name, its data type and its unit. Delete the rows you do not want and start the collector. A row it cannot read stops it at start with the line and column, rather than leaving that tag quietly empty. OPC UA: browse and tag files
• NewModbus TCP in the collector, in beta: poll energy meters, older PLCs and Modbus RTU devices behind a TCP gateway from the same collector as MQTT and OPC UA — holding and input registers, coils and discrete inputs, 16 to 64 bit integers and floats in any word order, with scaling and a CSV tag list. Only changed values are sent, and a device that stops answering is marked in its tags’ history, never filled in. Beta means it has been tested against a Modbus TCP simulator — every data type and word order, and devices that stop answering — but not yet against a real meter or PLC: tell us what you run it against. On every plan, like the other collector sources. Modbus TCP (beta)
• NewA guide to Sparkplug B, in beta like the collector source it covers: subscribing to a namespace on your own MQTT broker, filters and a tag budget for edge nodes that announce hundreds of metrics, the full list of what each node announced before you collect any of it, and what the collector publishes: a rebirth request, plus its own STATE if you set HostId to make it a host application. Sparkplug B (beta)
• ImprovedOne Home Assistant recommendation, wherever you read it. The website, the Connectors page and the welcome email now all put the Tag Historian integration from HACS first — you pick the entities in a dialog with your tag quota in view, and each reading arrives with its unit — and Home Assistant’s own InfluxDB integration second, as the way without HACS. A setup that already works with the built-in integration does not need to move. Home Assistant
• ImprovedThe pricing cards now say what has always been true: every plan, Free included, takes as many team members as you invite, each as Viewer, Editor or Admin. The Pro card no longer says “Most Popular”, which was not a fact about the plan; it says what Pro keeps, a year of full detail. Pricing
• ImprovedThe Connectors page links the website’s guide from every card that has one: line protocol and Telegraf, webhooks (the alerts guide) and the MCP server, whose guide is now marked beta like its card.
• ImprovedThe pricing comparison lists two more hosted services, TagoIO and emoncms.org, priced by device and by feed, and no longer says nothing sits between free software you run and a managed historian. Every price in it was read again on the vendor’s own page on 21 October. What a data historian actually costs
• ImprovedThe InfluxDB page no longer says Home Assistant’s InfluxDB app is end-of-life: it left the add-on store in August and came back in September. It now gives both good answers — keep InfluxDB and send to Tag Historian beside it with the integration, or drop the server without losing the years of history it holds. Leave InfluxDB, keep the history
• FixedUnits and descriptions set in the collector now reach the tag: an OPC UA tag’s or a Modbus row’s Units and Description, an MQTT source’s Units and a Sparkplug metric’s engineering unit. The upload every collector uses dropped them, while the guides said they were stored. One the collector sends now replaces the tag’s, as one sent with a single reading always has; leave it out and the tag keeps what it has. A collector’s deadband still does not set the tag’s: on OPC UA it is a filter at the PLC, and each tag keeps its own. Picking CompressionDeadband
• SecurityAn old sign-up endpoint is gone. It made an account without checking the email address — marked verified on the spot, with no confirmation mail — and answered with an Admin API key that never expired. It was still listed in the public API reference, but nothing had called it, or made an account through it, as far back as our logs go (August 2026). The website’s sign-up has used another endpoint, which checks the address, since April.
• PrivacyThe privacy policy now says what a read-only link shares, who can see it, how long it is kept and what we record when someone opens it, and that the dashboard remembers in your browser the time zone you last picked for an Excel report. Privacy Policy

No more short pauses when storage is slow for a moment

• ImprovedThe API keeps answering when the storage behind it is slow for a moment, or when the long-term archive is busy. Until now either could take it out of service until its next health check passed: in the month before this release that happened four times, for about a minute in all. Storage that refuses writes, or stops answering for more than a minute, still takes it out of service, as it should. Service status

Two-factor sign-in, a security page, and this changelog

• NewTwo-factor sign-in for the Explorer. Turn it on under Security in Settings with any authenticator app, and signing in asks for a code from the app after your password. Ten recovery codes get you in without your phone, and we email you whenever two-factor sign-in is turned on or off, moved to a new phone or given new recovery codes, and whenever a recovery code is used. Signing in
• NewAn Admin who has two-factor sign-in on can require it of everyone on the account. Members without it set it up at their next sign-in, and the team list shows who has it. API keys are not affected.
• NewA security page for whoever has to approve a new supplier: where your data lives, encryption, sign-in and API keys, how the service is built and run, what we do not have yet, and how to report a vulnerability, also in machine-readable form at /.well-known/security.txt. Security
• NewThis changelog, from v1.0.31 on, with an Atom feed at /changelog/feed.xml for your feed reader.
• SecurityEvery account also had a hidden access key, made with the account, that worked as an API key with the account's role: Admin for every account made by signing up. It could not be revoked or rotated, and no release since August 2026 has shown it to a customer. It no longer exists: the keys you create in Settings are the only API keys there are.
• SecuritySince December 2025, one tag's aggregated readings (the API's .../aggregated endpoint), when read with an API key, were kept for 60 seconds and given to anyone who asked for the same account, tag and time range in that minute, with another account's key or with no key at all. Reads from the Explorer were not kept. Fixed: every answer now goes only to the account it belongs to, and a test calls every endpoint with one account's credentials against another's. The service has held only our own test accounts so far, so no customer's readings were exposed.
• SecurityThe live-updates status endpoint (/ws/status) told any account how many live connections the whole service had. It now reports only your own.
• SecurityWrong passwords and wrong two-factor codes sent at the same moment now each count toward the account's lock. Before, a burst of them counted about once, so guesses sent together got past the five that lock an account for 15 minutes.
• SecurityRemoving someone from your team, or turning on two-factor sign-in, now ends the sessions it should at the very next request. Before, they kept working for up to 30 minutes, long enough to make an API key.
• PrivacyRemoving someone from your team now deletes their sign-in sessions with them, each of which kept the network address it was signed in from. Sessions that earlier removals left behind are deleted too.
• PrivacyThe privacy policy names what we keep that it did not name before: your full name, when you last signed in, each sign-in session with its network address, the alerts your rules raised, and what two-factor sign-in keeps. It says when each is deleted, what Export everything holds, and which endpoints return the rest. Privacy policy
• ImprovedThe collector image you pull as collector:latest now moves only when we release, so it is always the newest release, never a build that has not been released.

The first restore drill: the account database, from Sweden South

• ImprovedWe rehearsed restoring the account database from its daily copy in Sweden South: the newest copy was restored and every table matched it. Where your data lives now says which restore paths have been rehearsed and which have not, and why there is still no recovery time to publish. What we do not claim

A daily copy of the account database outside Sweden Central

• NewThe account database — sign-ins, tag definitions, API keys, alert rules and saved charts — is now copied every day to storage whose second copy is in Sweden South, the paired Swedish region. Each copy is restored into a scratch database and checked table by table before it counts, and is kept for 35 days. If the whole Sweden Central region were lost, the account database's data would now survive in that copy, short of at most a day of changes. Where your data lives
• PrivacyThe privacy policy names the daily copy among our backups, and where it is kept. Privacy policy

Export everything: your data in one archive

• NewExport everything, in Settings, builds your account's data into one archive: every tag's readings at full resolution for your plan's window, its hourly and daily summaries, tag settings with former names, alert rules, notification channels and chart views — as CSV or Parquet, with a README that explains every file. It is built in the background, we email you when it is ready, and it can be downloaded for 7 days. How long data is kept
• FixedUnits, descriptions and other tag settings saved while we were rolling out an update could be undone by that update. They are kept now.
• FixedA batch of readings refused with a 503 and then retried could be partly skipped as unchanged, because the refused attempt had already moved the tag's last value. A refused batch now changes nothing, so the retry is stored as sent.

Bring your Home Assistant history, and rename tags without losing it

• NewImport history with its original timestamps — for example what Home Assistant's recorder already holds. Imported readings do not count against the daily readings quota; they are limited to your plan's full-resolution window and an import allowance per account, and importing the same history twice stores it once. The Home Assistant integration does it from its Configure dialog from version 2026.11.0. Home Assistant (HACS)
• NewRename a tag, or merge one into another, on the Explorer's Tags page. The history stays readable under the new name, and alert rules and saved charts follow it. The Home Assistant integration follows entities you rename in Home Assistant.
• NewA guide for leaving a self-run InfluxDB without losing the years you already have, and a Grafana dashboard for Home Assistant entities by name and unit. Leave InfluxDB, keep the history

A safer upgrade for the Windows collector

• FixedUpgrading the Windows collector in place now waits for the old program to exit before replacing it. Before, an upgrade could now and then stop on a file in use and leave the service stopped. In the Windows download from collector 1.0.41 on.

The Windows collector, linked from the guides

• NewThe MQTT and OPC UA guides link the Windows collector download: one program and an install script in a zip, released beside the Home Assistant integration. OPC UA (beta)

The collector on Windows without Docker, and a shorter first hour

• NewThe collector runs as a Windows service: one program and an install script, with no Docker and no .NET needed on the machine. The program is not code-signed yet, so Windows SmartScreen warns about it; the guides say how to get past that. MQTT
• ImprovedSigning up on taghistorian.com signs you in to the Explorer, with no second password prompt, and a paid plan goes straight on to checkout.
• ImprovedA new account's Overview offers three ways in — Home Assistant, the collector for OPC UA, MQTT and Sparkplug B, and the HTTP API — each with its first step and its guide.
• ImprovedThe dialog for a new API key opens on Write, the scope sending data needs. Grafana and other tools that only read get a Read key.
• ImprovedTags from Home Assistant carry the entity's friendly name, and its unit when Home Assistant sends one, so charts are labelled the way Home Assistant labels them.
• NewAccount emails: a welcome once your address is confirmed, one reminder a day later if no data has arrived, and a notice when your account passes 80% of the day's readings, uses them up, or reaches its tag limit. Settings names the tags the limit refused today.
• SecurityA crafted sign-in link could send you on to another website after you signed in. Where the sign-in page sends you is now always inside the Explorer.
• SecurityOur release pipeline signs in to Azure with short-lived tokens instead of a stored secret.

Email to us arrives

• Fixedsupport@taghistorian.com and sales@taghistorian.com now receive mail. Before this, messages to both addresses bounced. If you wrote to us and got a bounce, please write again.
• ImprovedReplying to any email from us reaches our support mailbox.
• PrivacyThe privacy policy and the terms say that email you write to us is kept in our support mailbox, which an account deletion does not reach, and that we delete it by hand when you ask.

Behind the scenes: steadier starts and stricter checks

• FixedTwo copies of the service starting at the same moment, as they do during an update, could stop one of them from starting. They now wait for each other.
• ImprovedOur build now fails on any compiler or lint warning, and nothing is released from a build that failed.

Alerts by email and push on every plan

• NewAlerts, including the one for a source that has gone quiet, reach people by email, ntfy, Pushover, Telegram, Slack and Microsoft Teams on every plan, Free included, and by signed webhook on Pro and Business. A rule can wait out a short spike, clears itself when the value is back to normal, and stays quiet while a value flaps; the Test button sends a sample to a channel. Alerts by email, push and chat
• NewA status page says whether the API and the Explorer are answering right now. Service status
• ImprovedA collector sends up to 5,000 readings per upload, compressed, so one collector keeps up with a Business plan's daily volume and catches up quickly after an outage.
• SecurityThe website and the Explorer send a Content-Security-Policy that allows no third-party scripts, tell browsers to stay on HTTPS, and refuse to be framed by other sites. Both moved to Next.js 16.4, which closed every open critical and high advisory, and dependency updates are now proposed every week. Security
• ImprovedWe are alerted when the API, the Explorer or this website stop answering, and when the database, storage or the nightly backup have trouble.
• FixedThe Alarms page fits a phone.

Two ways to lose readings during an update, closed

• FixedDuring an update two copies of the service overlap for up to about a minute, and both could append to the same file and overwrite each other's readings. Only one copy writes at a time now, and readings recovered after a restart are kept until they are safely stored.
• FixedA storage error could make a new file replace an existing one. Files are only ever created new now.
• PrivacyAn account deletion is complete only when every store that holds the account's data has answered that nothing of it is left. Before, a storage error could let it report done too early. The privacy policy and the terms list our service logs, kept 90 days, among what outlives a deletion.

Late readings reach the hourly summaries

• FixedReadings that arrive late — a collector catching up after an outage, for example — now reach their hourly and daily summaries. Before, they could be left out, and the summary is what remains once the full-resolution window has passed.

Hashed sessions, working reset links, and an Explorer that fits a phone

• SecuritySign-in sessions are stored only as hashes, as API keys already were, so a copy of our database holds no session anyone could use.
• FixedPassword-reset and email-confirmation links stopped working after an update. They survive one now, and a confirmation link lasts the 7 days its email promises.
• FixedThe Explorer's live demo no longer makes failing requests, and the Overview and Connectors pages fit a phone.
• ImprovedEvery price on the website and in the Explorer shows what a consumer in Sweden pays beside the price excluding VAT.
• FixedThe nightly archive rebuilds missing hourly summaries for a day before it archives the day, instead of archiving it without them.

A year of full resolution on Pro, a 30-day trial, and long ranges in Trends

• NewPro keeps every reading at full resolution for a year, up from six months, and its storage allowance is 6 GB.
• NewPro can be tried free for 30 days. Checkout asks for a card; cancel before day 30 and you are not charged.
• ImprovedTrends has 30-day, 1-year, 2-year and All ranges, draws long ranges from the server without losing their shape, says what resolution it is drawing, and keeps Live within the API limits.
• FixedRate limits follow your current plan. Before, a Pro key could be held to the Free limit, and a plan change did not always take effect.
• FixedThe storage figure now goes down when old readings are deleted. Before, it only grew, so an account that kept sending would in time have been refused.
• SecuritySigning in is limited to 10 attempts a minute per network address, on top of locking an account for 15 minutes after five wrong passwords.
• SecuritySigning out revokes the session on our side too, so it cannot be renewed, and signs out every open tab.
• ImprovedThe collector's quick start works on a first try, on amd64 and arm64: the first start writes an annotated example configuration and says what to change.
• ImprovedThe Home Assistant guide follows the setup dialog Home Assistant ships today. Home Assistant
• FixedA delayed payment event could bring back a cancelled Pro subscription. We now ask Stripe for the subscription as it is before changing a plan.
• PrivacyThe privacy policy names the company behind Tag Historian, the onboarding dates we keep and why, and how to object to that. Privacy policy