What's next
Not yet, and what would move it
Nothing here carries a date, and nothing here is sold as though it exists. Where something has since been built it says so and names what is still missing, rather than quietly disappearing off the list. What moves an item up is a customer saying they need it.
Single sign-on
Built · needs proving
The hard half is done, and it is no longer only tested. It runs. itbudgit verifies your provider's tokens and maps your organisation to your workspace, refusing a tampered payload, an untrusted signing key, the alg:none trick, an expired token, the wrong issuer or audience, and an organisation it has never heard of. All adversarially tested. A real identity provider is connected on the hosted build and the whole path works end to end: a real sign-in, a real token, the right workspace. What remains is the enterprise directory connection itself (pointing that provider at your Okta, Entra ID or Google) and proving that specific path. A configuration step, not a rewrite.
Two people at once
Built · storage half remains
Two people in one hosted workspace enter data at the same time. Edits to different records merge, and so do edits to the same budget line in different months. Two people editing the same cell get a named conflict to resolve, never an auto-picked winner, because two people editing the same money is a judgement call and not a merge. The screen says who saved.
What remains is underneath: each save still rewrites one document rather than one row per line and month. That is what would make merging cheap at scale, not what makes it work, so a workspace with a dozen people typing at once is not a load we have measured.
Multiple currencies with dated FX
Deferred on purpose
A workspace holds one currency, and switching re-labels rather than converts. Doing this badly is worse than not doing it: every split in the engine is cent-exact and re-sums to the whole, and conversion has to preserve that or the totals stop reconciling. It is wanted, a group with a German and a US entity is not a niche, and it will be done properly or not at all.
A published API
Not started
The hosted product already talks to its own server over HTTP, but that is not a documented, versioned, supported interface and selling it as one would be dishonest. Making it public is a real commitment, to stability and to not breaking your integration, and worth making once someone actually needs to feed a BI tool or an ERP.
Depreciation schedules
Not started
Capitalised spend written down over its useful life, sitting beside the operational budget rather than in a separate workbook. It fits the ledger model cleanly, an asset is a contract-shaped thing with a term, which is what makes it a fair thing to ask for rather than a different product.
Restore an earlier version
Built · hosted
Every accepted change is recorded, which version and who wrote it and when, kept for twelve months, and the most recent version of a workspace is never removed whatever its age. Admin · Data lists them with a line count each, because against bare timestamps every row looks the same, and an admin puts one back.
A restore goes through the same writer as any other save, so it is itself recorded and itself undoable. It names the version it expects to replace, so a colleague saving between reading the list and pressing the button is reported rather than discarded, and it refuses while anything is unsaved: unsaved work is the one thing no trail holds.
The browser demo has the export and no trail. There is no server there to keep one.