Security in inMOLA isn\'t a checklist that puts work on the user — it\'s a layer that runs quietly in the background and protects you and your data. Login, session and audit are built as three layers. What each layer does is spelled out below in plain terms.
Protections that turn unauthorised access away at the front door.
When enabled, sign-in is two-step: even if your password is correct, we ask for a one-time code from your authenticator app. If it isn't entered within 5 minutes, the flow is cancelled.
5 wrong sign-in attempts in a row → that account is locked for 30 minutes. Too many requests from the same IP → a temporary rate limit kicks in. The lock is per-email, so other people on the same office/NAT network are not affected.
Reset links are valid for 30 minutes, single-use, and the requester's IP is logged. The link token is stored hashed in the database, never in plain text.
Control over where the session lives, how it\'s used, and who\'s using it after sign-in.
The moment an account signs in from a new device or browser, every previous session on that account closes automatically. The old session is kicked out on its next action and redirected to sign-in with "This session was closed by another device." One subscription can't be shared between multiple people at the same time.
Every sign-in and every session records IP, device / browser fingerprint, and last-seen timestamp. If the IP changes mid-session it's updated for audit; user activity is logged with IP + page on a regular cadence.
Admins can view a user's active sessions (IP + device) and force-terminate a suspicious one with one click. The call is yours; the system enforces it.
Every move is recorded — so you can look back when you need to.
If an account is used from multiple different IPs in a short window, the system flags it as an account-sharing risk. Admins see it in the security panel; a rolling summary alert also drops into the team chat.
Every successful, failed, and blocked sign-in — plus every critical action — is logged permanently: who, when, from which IP and device. Months later, "who did this, and when?" is one click away.
Account sharing is stopped automatically, every sign-in is on the record, 2FA is available, brute-force attacks are turned back, and suspicious activity surfaces in both your panel and your team chat. It all runs in the background — nothing extra is asked of you.
If you have an account-specific security question or suggestion, send it to us directly.
contact@inmola.com →