Sutra CRM
Product timeline

What we shipped, and where we are going.

A single timeline for Sutra — recent releases in detail, earlier milestones in summary, and the work in flight and on the way. Updated at the close of each sprint. Feature requests and bug reports live on the forum.

Just shipped 4

  1. 28 May 2026 Security

    Country access

    • Allow or block sign-in by country, with the lookup running entirely on your server — no third-party service, no API key. Install the free DB-IP country database with one click from Admin → Access; refresh monthly to stay current.
    • Set installation-wide by an admin and, optionally, narrowed per user. An empty list means no restriction; the app-wide rule is the outer boundary and each user can only tighten within it on their own Access tab.
    • Lockout guards throughout: your current country is shown on every card, and saving a rule that would shut out your own location asks for confirmation first. Behind a reverse proxy, a trusted-proxies setting makes sure the visitor address — not the proxy — is the one checked.
  2. 28 May 2026 Security

    Two-factor authentication

    • Add a second step at sign-in. Authenticator-app codes work out of the box with no external service; email and text-message codes are optional channels that plug into the Admin → Integration cards. Each user picks one or more methods, and any of them satisfies the prompt.
    • Single-use recovery codes are issued the first time any method is turned on and act as a universal fallback if you lose your device; they are shown once with Copy and Download. An optional “remember this device” skips the prompt on a trusted browser for 30 days.
    • Changing your password now always requires a verification code — from your authenticator if you have one, otherwise an emailed or texted one. Turning any factor on or off sends a security-alert email (never the code itself).
  3. 28 May 2026 Integration

    Admin integrations (email + SMS)

    • A new Admin → Integration home for outbound channels. Send email through a standard mail relay or Amazon SES, and text messages through Twilio. Each card has a test-send so you can confirm delivery before relying on it.
    • Credentials are stored encrypted in the database, not in config files. This is the shared home that two-factor email and text delivery plug into — and where the upcoming currency-rates key will live too.
  4. 28 May 2026 M1.6b

    User account menu

    • The name chip in the topbar is now a real account menu: Profile, Settings (timezone preference), sign-in history, and a Security tab, alongside sign out. No more accidental logout from a single click.
    • Profile holds your display name and mobile number; sign-in history is a read-only audit of recent sign-ins (address, device, and time). The Security and Access tabs are where two-factor authentication and country access live.

Earlier milestones 13

  1. Done

    M1.6 — Schema rebuild

    May 2026

    One-click "Rebuild" from Admin reconciles every entity table with its fields — creates tables, adds columns, widens columns. Additive only: nothing is ever dropped, so a rebuild cannot lose data. Every change is logged with status, duration, and who ran it.

  2. Done

    M1.5.8 — Inline edit per card

    May 2026

    Per-card Edit / Save / Cancel state on every record. Schema-driven layout, AJAX swap without page reload, SYSTEM panel inline edit (Owner + Assigned to), group-scoped stream verbiage, concurrent-edit guard.

  3. Done

    M1.5.6 — Duplicate detection rules

    May 2026

    Multi-rule per entity. Per-field operators (Equals / Starts with / Contains / Ends with). Warn vs Block policies, Save-anyway override with audit, "Not a duplicate" pair exemptions, live check while typing.

  4. Done

    M1.5.5 — Relationships system

    May 2026

    One-to-Many, Many-to-Many, and Child-to-Parent relationships as a first-class concept. Sub-tab auto-generation on parent records, ACL-filtered counts and reads. Replaces hand-wired reference fields.

  5. Done

    M1.5 — Entity Manager + Global Pick Lists

    May 2026

    Build custom entities and fields from the admin UI — Account, Contact, Lead, Opportunity, Case live alongside admin-created entities. Picklists (Country, State, Industry, etc.) cascade and reuse across the app.

  6. Done

    M1.4.7 — Field-level audit + non-destructive restore

    May 2026

    Every save writes a field-diff event to the Stream. Audit entries are append-only; restore a previous save without losing the intermediate history. Foundation for 21 CFR Part 11.

  7. Done

    M1.4.6 — UTC storage + per-user local display

    May 2026

    Every timestamp stored as UTC; the browser shifts to the user’s timezone on render. User timezone preference persisted on the user record.

  8. Done

    M1.4 — ACL voter + role-based access

    May 2026

    Per-entity, per-action rules (own / team / all). Admin UI for roles. Query-level filtering on lists, voter checks on every POST.

  9. Done

    M1.3.5 — Filter builder + saved views

    May 2026

    Visual filter builder per list view. Saved views per user. Underpins every list view across the app.

  10. Done

    M1.3 — Detail enrichment (Activity + sub-tabs)

    May 2026

    Activity rail on every record. Live sub-tab counts for Contacts / Opportunities / Cases / Projects. Stream events on insert, update, restore.

  11. Done

    M1.2 — Create + edit forms

    May 2026

    Generic form view at /{entity}/new and /{entity}/{id}/edit. CSRF, validation, dirty-state checks, version bumps on update.

  12. Done

    M1.1 — Entity list + detail

    May 2026

    Accounts, Contacts, Leads, Opportunities, Cases. Filter chips, sortable columns, sub-tabs, dense field grids.

  13. Done

    M0 — Walking skeleton

    May 2026

    Install wizard, kernel boot, DI container, session auth, dashboard. Live at demo.sutracrm.net.

In flight 1

  1. In flight

    Security — IP access + Sessions

    In flight

    Rounds out the Security area: IP access control at both the application level (one admin allowlist for the whole install) and per user (admin sets, the user can tighten further), plus a Sessions & devices tab to review and revoke active sessions and allow or block devices. Also adds an extra verification step when signing in from a never-before-seen device.

Planned 14

  1. Planned

    Currency manager — multi-currency + rates

    Set a primary currency and manage additional currencies with exchange rates against it (manual entry plus scheduled auto-update). Becomes the single source of currencies for amount fields and per-user defaults, and powers conversion of totals to the primary currency.

  2. Planned

    M1.5.9 — Visual layout admin

    Drag-and-drop layout editor per entity. Detail, List, Side Panels, Search Filters, Mass Update, Convert Lead — full surface coverage.

  3. Planned

    M1.7 — Activity entities (Email / Meeting / Call)

    Replace the placeholder Activity sub-tab with real Email, Meeting, and Call entities. Sub-tab generation reuses M1.5.5 relationship plumbing.

  4. Planned

    M1.7b — Tasks as built-in entity

    Tasks alongside Activities. Polymorphic parent (Account / Contact / Opportunity / Case) via the M1.5.5 child-to-parent mechanism.

  5. Planned

    M1.8 — Attachments

    File uploads attached to any record. Per-entity storage policy. Audit on every upload + download.

  6. Planned

    M1.9 — Rich text fields

    Markdown-input field type with safe-HTML render. Replaces the current plain-text textarea for notes / descriptions.

  7. Planned

    M2.0 — Hierarchy / Territory ACL

    Continent → country → zone-style territory tree as a second ACL axis orthogonal to roles. WHERE-clause filter on every list query.

  8. Planned

    M2.1 — Email + calendar sync (Gmail / Outlook)

    Two-way sync with Gmail and Outlook. Inbound + outbound email logged automatically against the right contact and account; calendar events synced so meetings show up against the record without manual data entry. The most-cited evaluation blocker for growing teams — sales reps will not adopt a CRM that makes them double-enter email.

  9. Planned

    M2.2 — SSO (SAML / Google Workspace / Okta)

    Single sign-on via SAML, Google Workspace, and Okta, with SCIM user provisioning. The standard procurement gate above ~200 seats — most evaluations from growing businesses stop here if it is missing. Ships in the Business edition.

  10. Planned

    M2.3 — Workflows + automation

    If-then triggers, scheduled actions, and time-based rules (for example: "if Opportunity Stage = Proposal for more than 14 days, notify the Owner"). Includes a visual rule builder so admins can author workflows without code. Basic triggers in Community; advanced multi-step workflows in Business.

  11. Planned

    M2.4 — Public API + webhooks

    REST API covering every entity, plus outbound webhooks on create / update / delete. The integration foundation that lets Sutra plug into the rest of a growing team’s stack — accounting, support, marketing, data warehouse — and the underlying surface the M3 plugin marketplace builds on.

  12. Planned

    M2.5 — Bulk operations

    Mass update, mass import, merge duplicates, and bulk delete with confirmation, on every entity list. Table stakes at the scale growing teams operate at, where day-to-day admin tasks touch hundreds of records at a time. Builds on the M1.5.6 duplicate detection foundation.

  13. Planned

    M2.6 — Reports + dashboards

    Configurable reports and dashboards beyond the home page — pipeline by stage, forecast roll-ups, sales-rep leaderboards, activity reports, schedulable email digests. The numbers a growing sales ops or revenue ops team runs their weekly meeting from.

  14. Planned

    M2.7 — Data importer

    Guided importer for spreadsheets and exports from other CRMs — column mapping, dry-run preview, error reporting, undo. Removes the biggest friction in switching: the "we have ten years of data we can’t lose" problem. Without this, sales evaluations stall.

Long horizon 5

  1. Horizon

    Job scheduler + scheduled maintenance

    A background job runner (cron / queue), and on top of it a Cleanup job — hard-delete records past a retention window, log rotation, orphan attachment + temp-file purge, expired token / notification cleanup. Also unlocks an opt-in schema cleanup ("hard rebuild") for orphaned columns left by deleted fields.

  2. Horizon

    M2 — Vue 3 SPA frontend

    Replace server-rendered PHP templates with a Vue 3 SPA. API surface stable from M1; the SPA is just another client.

  3. Horizon

    M3 — Plugin marketplace

    Marketplace API for third-party plugins. Composer + ZIP distribution. Per-plugin licensing. The CRM module is just the first plugin.

  4. Horizon

    M4 — Compliance plugin (21 CFR Part 11)

    sutra/compliance-21cfr — audit-log wiring, electronic signatures, record lockdown, validation tracking. Built on M1.4.7 foundations. Ships in the Business edition.

  5. Horizon

    Native mobile app (companion to the Vue SPA)

    A native mobile app for iOS and Android that sits on the same API as the Vue SPA. Focused on field-sales workflows — quick lookup, log a call, add a meeting note, see today’s pipeline. Lower priority than getting the SPA right first.