Set up your account's security
A plain-English walkthrough of every lock available on your InventiPro account — what each one actually does, exactly how to turn it on, and what we recommend for a shop till versus your own device.
Four layers, and where each one lives
Every one of these is managed from Profile → Security once you're signed in — this page is the explainer, not a login form.
🔑 Password
Your account's master credential. Always works, on any device.
Required🔢 PIN lock
A short numeric code for fast sign-in on one specific device.
Optional, per device👆 Fingerprint
Unlock with the biometric sensor already built into your device.
Optional, per device📱 2FA
An authenticator-app code required alongside your password.
Recommended for owners/adminsWhat we recommend
Owners & admins
Strong, unique password + 2FA turned on. You have access to billing, reports and every setting — this is the account worth protecting the most.
Cashiers on a shared counter device
PIN lock on that till — fast to type between customers without passing around a password. Keep the till's own device physically supervised, same as a cash drawer.
Your own phone or laptop
Fingerprint unlock — nobody else can reproduce it, and it's faster than typing anything.
A public or borrowed computer
Neither. Sign in with your full password, sign out when done, and don't enroll a PIN or fingerprint on a device you don't control.
Strong password
Every account is protected by a password first — it's the one credential that works from anywhere, and it's what everything else (PIN, fingerprint, 2FA recovery) ultimately falls back to.
What's required
The same rule set applies whether you're creating your account or changing your password later from Profile → Password — it's checked on our server either way, so it can't be skipped by typing fast through a shorter client-side check. InventiPro's default policy is:
- ✓At least 8 characters
- ✓At least one UPPERCASE letter
- ✓At least one lowercase letter
- ✓At least one digit
- ✕A symbol (!, @, # …) — not required by default
This is InventiPro's platform-wide security baseline — it applies to every account and isn't something an individual shop can loosen.
✕ Weak — don't use
password123, mystore2024, 12345678
Dictionary words, your shop name, or a keyboard pattern — the first things a real attacker tries.
✓ Strong — an example shape
Tuesday!Mango7Bridge
Several unrelated words plus a number and a symbol, 16+ characters. Longer and unpredictable beats short and “clever.” Never reuse a password from another site.
🔁 Password rotation reminders
InventiPro asks you to refresh your password every 90 days by default. You'll see a heads-up starting 7 days before it's due, and a repeated reminder if it lapses — this never locks you out mid-shift, it's a nudge you can dismiss and come back to later.
PIN lock
A short numeric code for fast sign-in — built for a shared counter device where typing a full password between every customer would slow down the till. It only ever works on the exact browser/device it was set up on.
How to turn it on
Go to Profile → Security → PIN sign-in
While already signed in with your password, on the device you want the PIN to work on.
Choose Enable PIN, then a 4 or 6-digit code
Whichever length you find easier to type at speed — both are equally supported.
Confirm your account password
Proves it's really you before anything changes.
Enter the 6-digit code emailed to you
A one-time verification code sent to your account's email, valid for about 10 minutes — enter it to finish enrollment.
What happens after
Next time you open InventiPro on that device, you'll see a “Sign in with PIN” screen instead of the password form. Pick your name, type the PIN, you're in.
Wrong PIN too many times
After 5 incorrect attempts, that device is locked for 15 minutes — the same protection your account password has. Your account itself is never at risk; only PIN sign-in on that one device pauses.
Forgot the PIN
From the PIN screen, choose Forgot PIN?, confirm your account password, and enter a fresh code emailed to you to set a new one.
Remove PIN from a device
Under Profile → Security, the device list shows every device with PIN enabled — remove any of them, including ones you're not currently using, e.g. an old till that was replaced.
Fingerprint / Windows Hello unlock
Sign in with the biometric sensor your device already has — a fingerprint reader, Windows Hello face unlock, or Touch/Face ID. Nobody but you can reproduce it, and it's the fastest quick-unlock option there is.
How to turn it on
Go to Profile → Security → Fingerprint / Windows Hello unlock
Needs a device with a biometric sensor and HTTPS (any normal browser session already has this).
Choose Enable Fingerprint and confirm your account password
Same identity check the PIN flow uses.
Enter the 6-digit code emailed to you
Valid for about 10 minutes — confirms the request is genuinely yours before your device is asked for anything.
Follow your device's own biometric prompt
Windows Hello, Touch ID, Face ID, or your phone's fingerprint reader — whatever your OS normally shows. Your fingerprint itself is checked locally by your device and never leaves it.
Not seeing the option?
The device you're on doesn't report a platform authenticator to the browser — most commonly a desktop with no fingerprint reader/Windows Hello camera, or a browser that blocks it. Use PIN lock there instead.
PIN or fingerprint — only one at a time, per device
A single device can have one quick-unlock method active. Turning on fingerprint unlock on a device automatically switches off PIN on that same device, and turning on PIN switches off fingerprint — instantly, no reload needed. Your account's password always keeps working everywhere regardless.
| 🔢 PIN lock | 👆 Fingerprint | |
|---|---|---|
| Where it works | This exact browser/device only | This exact browser/device only |
| What's needed to turn it on | Account password + a 6-digit code emailed to you | Account password + a 6-digit code emailed to you |
| Turning it on affects… | Removes fingerprint unlock on this device | Removes PIN unlock on this device |
| Length / method | 4 or 6 digits, your choice | Windows Hello, Touch/Face ID, or Android fingerprint — whatever your device already has |
| Too many wrong tries | Locked on this device for 15 minutes after 5 wrong PINs | No PIN-style lockout — the OS's own biometric sensor limits are what apply |
| Forgotten / lost this device | Reset from the PIN screen with password + a new emailed code | Just re-enroll from Profile → Security, or remove the old device from your device list |
| Also asked for your 2FA code? | No — a device you've already unlocked once skips the 2FA step | No — same reasoning |
Two-factor authentication (2FA)
Adds a second, time-limited step to password sign-in: after your password is accepted, you're asked for a 6-digit code from an authenticator app before a session is issued. It uses an authenticator app (Google Authenticator, Microsoft Authenticator, Authy, or similar) — not a code sent by email or text.
How to turn it on
Go to Profile → Security → Two-Factor Authentication
Click Enable 2FA.
Scan the QR code with an authenticator app
Or type the manual key shown if you'd rather add it by hand.
Save your 8 recovery codes somewhere safe
Each one signs you in once if you ever lose access to the authenticator app — treat them like spare keys.
Enter the current 6-digit code to confirm
Proves the app is set up correctly before 2FA actually turns on.
When it's asked for
Every time you sign in with your username and password. A device already unlocked with PIN or fingerprint skips it — those methods only work on a device you've already proven is yours once.
Lost your authenticator app
Use one of your 8 saved recovery codes in place of the 6-digit code — each works once. Out of codes too? Contact support from the email on file to have 2FA reset after we verify it's really you.
Everything else protecting your account
These run automatically — there's nothing to turn on, but it helps to know they're there.
⏱️ Automatic idle sign-out
If a device sits untouched for too long (15 minutes by default), InventiPro signs it out on its own, with a “Stay signed in?” warning in the final minute. It watches the whole browser, so an idle background tab can't sign out the tab you're actively using.
🚫 Login lockout on repeated failures
5 wrong password attempts locks that account for 15 minutes, the same protection PIN sign-in has. A separate limit also caps how many sign-in attempts any one internet address can make, so automated password-guessing gets nowhere long before it reaches that per-account limit.
✉️ Password reset links, not codes
Forgot your password entirely? “Forgot password” on the sign-in screen emails a one-time reset link, valid for about 30 minutes — a different mechanism from the 6-digit codes used to enroll PIN/fingerprint, but just as single-use. It also never reveals whether a given email is actually registered, so it can't be used to probe who has an account.
🔒 Encrypted in transit & hashed at rest
All traffic to InventiPro is encrypted (HTTPS), and your password is never stored in plain text — only a one-way hash that can verify a login but can't be reversed back into your actual password.
🏢 Your data stays yours
Every business's data is isolated from every other business's at the database level — nothing you enter is ever visible to another tenant, by design, not by configuration. See our Data Usage Policy for the full detail.
📋 See and revoke your own devices
Profile → Security lists every device with PIN or fingerprint sign-in enabled for your account, each labeled by browser/OS. Remove any device you no longer use or don't recognize — it can't be used to sign in again.
✅ Verified email at signup
New accounts confirm the registered email with a one-time code before the account can be used, so a typo'd or someone-else's address can't end up owning your account.
Frequently asked
Can I use PIN lock and fingerprint lock at the same time on the same device?
No — a device can only have one quick-unlock method active at once. Turning on fingerprint sign-in automatically switches off PIN sign-in on that device, and vice versa. You can still use your full password to sign in at any time, and 2FA (if enabled) always applies to password sign-in regardless of which quick-unlock method a device has.
Can I use PIN on my laptop and fingerprint on my phone?
Yes. Quick-unlock is set up per device, not per account — each browser/device you sign into remembers its own choice independently. Your laptop can have a PIN while your phone has fingerprint unlock, at the same time.
Is fingerprint data ever sent to InventiPro's servers?
No. Your fingerprint, face scan, or Windows Hello PIN never leaves your device — that's how the WebAuthn/passkey standard it's built on works. Your device's own secure hardware performs the biometric check locally and only sends our server a cryptographic proof that it succeeded.
What happens if I lose the device my PIN or fingerprint is set up on?
Sign in with your username and password (and 2FA code, if enabled) from any other device, open Profile → Security, and remove the lost device from the device list shown under PIN sign-in or Fingerprint sign-in. It can no longer be used to sign in once removed.
Does 2FA send me a code by email or text?
No — InventiPro's two-factor authentication uses an authenticator app (like Google Authenticator, Microsoft Authenticator, or Authy) that generates a fresh 6-digit code every 30 seconds, plus 8 one-time recovery codes you save when you set it up. There's no email-based or SMS-based 2FA code today — email is used for the separate step-up checks below, not for 2FA itself.
What if I lose my phone with the authenticator app on it?
Use one of the 8 recovery codes you were shown (and should have saved) when you enabled 2FA — each works once. If those are gone too, contact support from the email on your account to have 2FA reset after identity verification.
Am I forced to change my password every so often?
InventiPro reminds you to refresh your password every 90 days by default. It's a reminder, not a lock-out — you'll get a nudge starting a week before the deadline, and again if it lapses, but it will never block you out of the app mid-sale over an aging password.
Lock down your account today
All of this is already available on every plan — sign in and open Profile → Security to turn it on.