Logging in and account security

Luna360 holds clients' financial and personal data, so access is protected at three levels: the organisation (each lender has its own data, completely separate), the password and two-factor authentication (a 6-digit code generated by an app on your phone). This article explains every screen you see before you reach the application, the first login with the temporary password, recovery codes and what to do when something does not work.

In short

• You go either to your organisation's own address (for example mikrofonden.luna360.app) or to luna360.app, where you enter the Organisation code.
• At your first login you use the temporary password you received from your administrator, then you choose your own password (at least 12 characters, upper- and lower-case letters and a digit).
• Two-factor authentication is required for all users: without it you cannot open any screen in the application.
• When you turn it on, you receive 8 recovery codes, each valid once. Keep them somewhere other than your phone.
• There is no password reset by email: if you have forgotten your password or lost your phone, an administrator of your organisation resets it from Administration → Users.
• After 5 failed attempts, the form is locked for one minute.

Who has access

Any user created by the organisation's administrator and marked Active (can log in) can log in. What they see after logging in depends on their roles (see Roles and permissions).

To reset another user's password or two-factor authentication you need the Create and edit users permission (by default only the Admin role), and you can do it only for users who have no permissions you lack.

How to reach your organisation

Luna360 hosts several lenders, each with its own database. Before asking for your password, the application needs to know which organisation you are logging in to. There are three ways:

Tip

Save the address with your organisation's subdomain, or the /o/<code> link, in your browser. That way you no longer have to enter the code every time.

The "Log in to your organisation" screen

Press Continue. If the organisation exists and is active, you move on to the email and password screen; the organisation's name appears under the Luna360 logo, so you can check you have come to the right place.

What happens behind the scenes: when you choose an organisation, any previously open session (including a login started but not finished) is closed. This way a login from one lender can never be used at another lender.

Switching organisation

At the bottom of the login screens you will find the Switch organisation link. It logs you out and takes you back to the organisation code screen. It is useful if you work for two lenders or if you entered the wrong code.

Good to know

The link only has an effect on the general address (luna360.app). On an organisation's subdomain, the address itself chooses the organisation, so you will end up at the same one again. For another lender, open that lender's subdomain.

Logging in: email and password

The Log in screen:

Press Log in. Next comes, as applicable:

1. the Two-factor authentication screen, if you have already set up the app;
2. the Change password screen, if you are using a temporary password;
3. the Set up two-factor authentication screen, if you have not set it up yet;
4. the Dashboard, if everything is in order.

Without the "Keep me logged in" tick, the session expires after 120 minutes of inactivity; after that you are asked to log in again.

The full login flow

flowchart TD
    A["Open Luna360"] --> B{"Does the address point to the organisation?"}
    B -->|"yes, subdomain or own domain"| D["Log in screen"]
    B -->|"no, luna360.app"| C["Enter Organisation code"]
    C --> D
    D --> E{"Email and password correct?"}
    E -->|"no"| E1["Error message, after 5 failures locked for 1 minute"]
    E -->|"yes"| F{"Two-factor already set up?"}
    F -->|"yes"| G["Enter the code from the app or a recovery code"]
    G --> H{"Temporary password?"}
    F -->|"no"| H
    H -->|"yes"| I["Change password"]
    H -->|"no"| J{"Two-factor set up?"}
    I --> J
    J -->|"no"| K["Set up two-factor authentication"]
    J -->|"yes"| L["Dashboard"]
    K --> L

Your first login

When your administrator creates your account, the application generates a 16-character temporary password, shown only once to the administrator, together with the organisation code. The administrator passes it on to you through a secure channel (ideally not in the same email as the login address).

Step 1: choose your password

After you log in with the temporary password, the Change password screen appears with the message "You are using a temporary password. Choose your own password to continue." You cannot open any other screen until you change it.

Press Save password. The message "Your password has been changed." confirms it.

Tip

An easy-to-remember phrase is safer than a complicated word: for example Cafea3DimineataLaBirou has 22 characters and meets all the rules.

Step 2: set up two-factor authentication

Two-factor authentication (2FA) means that, as well as your password, you need something only you have: your phone. Even if someone finds out your password, they cannot get in without the code on your phone. For a lender that handles identity data and financial situations, this is a basic security requirement and a protection expected under GDPR.

On the Set up two-factor authentication screen:

1. Install an authenticator app (Microsoft Authenticator, Google Authenticator, 1Password...). Any app compatible with TOTP codes works.
2. Scan the QR code on the screen with the app. An entry named "Luna360 – " with your email address will appear in the app.
3. If you cannot scan (for example because you are working on the phone itself), use the key shown under "Cannot scan? Enter this key:" and enter it manually in the app.
4. In the Code field, enter the 6-digit code shown by the app and press Turn on.
5. The 8 recovery codes appear. Save them (print them or keep them in a password manager), then press I saved my codes, continue.

Warning

Recovery codes are shown only once. If you close the page without saving them, you cannot see them again; you can only generate new ones from My profile.

What happens behind the scenes:

• the secret key stays only in your session until you enter the first correct code; only then is it saved (encrypted) to your account. If you give up halfway, nothing is left turned on;
• the events Password changed and Two-factor turned on appear in the audit log.

Everyday login with two-factor authentication

After the email and password, the Two-factor authentication screen appears: "Enter the 6-digit code from your authenticator app, or one of your recovery codes."

1. Open the app on your phone and read the code for Luna360.
2. Type it in the Code field (spaces are ignored) and press Verify.

Rules:

• The code in the app changes every 30 seconds. The application also accepts the code just before or just after, to make up for small clock differences.
• You have 10 minutes from entering your password to enter the code. After that you have to enter your password again.
• After 5 wrong codes, the screen is locked for 60 seconds.

Recovery codes

A recovery code looks like this: k3f9a-p2x7q (5 characters, hyphen, 5 characters). You type it in the same Code field, instead of the code from the app. Capital letters and spaces at either end do not matter.

• Each code works only once; after use it is removed from your account.
• You can see how many codes you have left in My profile: "Two-factor authentication is on. Recovery codes left: N".
• When you are running low on codes, press New recovery codes in your profile. All the old codes stop working and you receive 8 new ones.

You have lost or changed your phone

Good to know

Modern authenticator apps (Microsoft Authenticator, Google Authenticator, 1Password) can back up to your account. If you turn this on, the codes move over automatically when you change phones and you no longer need a reset.

What happens behind the scenes when the administrator resets two-factor: the key and the recovery codes are deleted, Two-factor reset appears in the audit log, and if the user is logged in at that moment, they are sent to the setup screen at their next click. Details in Users.

You have forgotten your password

Luna360 does not have a "Forgot password" link with email. The reason: the password is only half of the login, and a reset must remain a decision made by a person in your organisation who knows you.

1. Contact an administrator of your organisation (any user with the Create and edit users permission).
2. They open Administration → Users, your user record, and press Reset password ("Generate a new temporary password. The user must change it at next login.").
3. They receive a new temporary password, shown only once, which they pass on to you.
4. You log in with it and immediately choose a new password, as at your first login.

Two-factor authentication stays unchanged: after the temporary password you are still asked for the code from the app.

Changing your password on your own initiative

From My profile, press Change password. The screen is the same as at your first login, but the first field is called Current password. After saving you are taken to the Dashboard.

Logging out

Press Log out at the bottom of the left-hand menu. The session is closed and the Logged out event appears in the audit log. You are taken to the organisation selection screen (or, on a subdomain, straight to the login screen).

Tip

If you ticked "Keep me logged in on this device", only Log out ends the session. Always use it before leaving the computer to someone else.

Automatic protections

Common problems

Frequently asked questions

Can I turn off two-factor authentication? No. It is required for all users, including administrators. Only an administrator can reset it, and the user must then set it up again straight away.

Can I use SMS instead of the app? No. Luna360 only uses codes generated by an authenticator app (TOTP), which work even without phone signal and cannot be intercepted through the mobile network.

I work for two lenders. Do I need two accounts? Yes. Each organisation has its own users; an account at one lender does not exist at the other. In your authenticator app you will have two entries, each with the organisation's name.

What happens to unsaved work if the session expires? After 120 minutes of inactivity the session expires and your next action asks you to log in again. Save long forms before taking a break.

I have several printed recovery codes, but I have generated new ones. Do the old ones still work? No. When new codes are generated, all the old ones become invalid.

Can an administrator reset their own two-factor authentication? Not from their own user record if they cannot log in. That is why every organisation should have at least two users with the Admin role.

See also

• My profile
• Users
• Security and backup
• Audit log
• Navigating the application