A-01
Its own front door
Staff never see the WordPress dashboard or the standard login page. Failed attempts are throttled by address and by account, so an attack spread across many addresses gets capped too.
Your files, your server, your rules
Nothing leaves your hosting. There is no Koloab cloud to breach, because there is no Koloab cloud.
Already on, in every tier
None of this is a higher grade of trust you pay to reach. The security in the free Starter tier is the same security as everywhere else, because a login that is only good enough for paying customers is not good enough.
A-02
Download links that expire
Every download URL is signed to one person and dies after five minutes. Pasted into a group chat, it is useless to everybody else in it.
A-03
Documents nobody can walk off with
Policies and handbooks stream into a reader that has no download button and no file URL anywhere in the page. People can read them and that is all.
A-04
Checks that run on the server
Restrict a file by department, by name, or with a password. The check happens before the file is sent, so nothing here is bypassed by opening developer tools.
A-05
Temporary passwords expire
Invites last 24 hours and have to be replaced on first sign-in. If somebody loses a phone, one click issues a new password and kills the old one.
A-06 / recommended
Add a captcha
Koloab does not bundle one, because tying you to a provider you did not choose would be presumptuous. The sign-in form works with the common free options including Cloudflare Turnstile, hCaptcha and Google reCAPTCHA. Install whichever you prefer and it appears on the login by itself. Worth doing before anything sensitive goes in there.
What it deliberately does not do
Two things are worth knowing before anyone relies on this.
B-01
Backups are your host's job
Koloab has no backup system of its own, and that is a decision rather than an oversight: your files are already inside the site your host is backing up. Check the hosting plan has enough storage and that restores actually work before this becomes your team's only copy of anything.
B-02
There is nothing to breach at our end
Files sit in your Media Library and content sits in your database. We hold no copy of either, so there is no second place for any of it to leak from and nobody at Koloab can read your documents.
Every lock listed above is in the free tier. File passwords, per-person visibility and the read-only Policies reader are the Premium additions, for documents you cannot be casual about.
Other drawers in the same cabinet
F-01
File library
Folders that behave like folders, previews in the browser, and a search that reads what is printed inside the documents.
F-02
Notices and news
Urgent notices that scroll across every screen and arrive without anyone reloading anything. Company news for the longer pieces.
F-03
People and contacts
A staff directory, invites by email, and a book of the outside numbers everyone keeps losing.
F-05
Analytics and the Command Centre
One admin screen for files, folders, people, news and every setting, with the figures alongside.
Keep the documents on your own hosting
No separate account, no third-party storage, no data crossing a border you did not choose. Install it, add a captcha, and it is done.