Security Center

Zreta Security Center documents buyer-relevant controls for the marketing and billing platform. It is not a certification claim (we do not assert SOC 2 here). Product applications such as ChurchHub and CoreTrust may publish additional controls on their own domains.

Security Center map

• Authentication
• MFA
• Authorization
• Data isolation
• Encryption
• Audit logging
• Backups
• Disaster recovery
• Monitoring
• Incident response
• Privacy
• Responsible disclosure

Related: Reliability · Privacy Center · Status · Continuity · Enterprise readiness

Authentication

• Email verification required for customer portal access.
• Login rate limiting and account lockout.
• Session tracking and revocation (including Redis-backed sessions in production).

MFA

• Staff accounts require two-factor authentication (TOTP + backup codes).
• MFA challenges are audited.

Authorization

• Role-based access control for staff, operations, and control-room areas.
• Organization-scoped customer portal resources where tenancy applies.

Data isolation

• Customer billing and portal data is scoped to authenticated accounts and organizations.
• Payment proof uploads are private — served only through authenticated download views, not public media URLs.
• Live product application data (ChurchHub, CoreTrust) is isolated in those products’ deployments.

Encryption

• HTTPS/TLS for production traffic.
• Secure cookie flags in production settings.
• Passwords stored with Django’s secure hashing framework.
• Payment card data is processed by configured gateways — not stored as raw PAN on this platform.

Audit logging

• Authentication events, payments, demo submissions, outbound funnel clicks, and admin product changes.
• Append-only audit log design for security-sensitive events.

Backups

• Operator backup procedures for the marketing and billing platform database and application state.
• See business continuity for published limits.

Disaster recovery

• We do not publish invented RPO/RTO figures here.
• Signed enterprise agreements may specify contractual recovery targets separately.
• Product-application DR for ChurchHub/CoreTrust is owned by those deployments.

Monitoring

• Public component status page and /health/ probe.
• No fake historical uptime percentages on the marketing site.

Incident response

• Support tickets and published SLA first-response targets.
• Security issues should use the disclosure channel below.

Privacy

• Privacy Policy and Privacy Center.

Responsible disclosure

Report suspected vulnerabilities to [email protected]. Include steps to reproduce and impact assessment. We do not operate a paid bug bounty unless separately announced.