Enterprise readiness

Last updated: August 2026

This page states what Zreta delivers today as an enterprise SaaS marketing and subscription platform — and what remains on the roadmap. It is not a SOC 2 report. Vertical products such as ChurchHub and CoreTrust run as separate applications; this site markets them and handles accounts, billing, and support.

Live today

  • Staff MFA (TOTP), email verification, RBAC, login rate limits, and session revocation that works with Redis-backed sessions.
  • Customer portal for subscriptions, invoices, licenses, and support tickets.
  • Checkout with server-side pricing, gateway webhooks, manual payment confirmation, and payment audit events.
  • Private payment-proof downloads and row-locked payment status transitions.
  • Organization workspaces with membership roles and portal org switching (shared-schema tenancy foundation).
  • Versioned REST API (/api/v1) with token auth, org-header scoping, and rate limits.
  • Celery workers for async email delivery and payment webhook processing (Redis broker).
  • JSON structured logs with request IDs, plus token-gated Prometheus metrics at /metrics/.
  • Append-only audit logs (application-enforced; no admin delete/edit).
  • CSP that blocks inline scripts; framing denied at app and nginx layers.
  • Public rate limits on checkout, contact, newsletter, and webhook endpoints.
  • Control Room and Ops surfaces for platform owners and staff.
  • Production hardening: TLS/HSTS settings, sanitized health checks, backup freshness checks, and a go-live checklist.
  • Published privacy, terms, security, refund, and status pages.
  • Product catalog linking to live external products (ChurchHub, CoreTrust) for demos and app access.

On the roadmap

  • Full tenant expansion options (schema-per-tenant for regulated customers; invite/SSO flows).
  • Public REST API expansion (webhooks API, write endpoints beyond tickets, API keys).
  • SAML / OAuth SSO for enterprise identity providers.
  • Deeper portal integration with external products (provisioning, license sync, single launch experience).

How to evaluate us

Start a 30-day product trial, review the Security overview, and check System status. For procurement questions, contact [email protected].