Trust
Security at JoinCPR
Card details go straight to Stripe or Square, every login can use two-factor authentication, each person sees only what their role allows, and the database is backed up automatically multiple times a day. Here is how each part works.
15-day free trial. No credit card required.
Card data never touches JoinCPR
Students type their card details into Stripe’s or Square’s own payment form inside your checkout, so the card number goes straight to the processor and never reaches JoinCPR’s servers.
JoinCPR never sees or stores full card numbers or security codes. The payment lands in your own Stripe or Square account, and refunds, payouts and disputes stay there too.
You connect Stripe or Square by signing in to your own account and approving the connection, so you never paste secret keys into JoinCPR. Disconnect in your payment settings removes JoinCPR’s access at any time. More on payments.
Account security
Every JoinCPR login can turn on two-factor authentication, so signing in takes a six-digit code from an authenticator app as well as the password.
- Two-factor authentication works with authenticator apps such as Google Authenticator, 1Password and Authy, and comes with one-time recovery codes in case you lose your phone. We recommend it for every administrator.
- Strong passwords. A password needs at least 12 characters, upper and lower case letters, a number and a symbol, and can’t be one that has appeared in a known data breach.
- Sign-in limits. After five failed attempts in a minute, you have to wait before trying again.
- Password checks for sensitive settings. Opening the security settings asks you to confirm your password, at most once every three hours, and password reset links expire after 60 minutes.
- Hashed passwords. Passwords are stored as one-way hashes, never as text anyone can read.
- Encrypted connections. The dashboard, your registration site and your own domain are all served over HTTPS, a plain HTTP address redirects to HTTPS, and sign-in cookies are only ever sent over encrypted connections.
Access by role
Each person on your team has one role, Admin, Staff or Instructor, and sees only what that role allows.
| Role | Can see and do |
|---|---|
| Admin | Everything, including billing, company settings and adding or removing team members. |
| Staff | Classes, registrations, payments, refunds, students and settings, but not company settings or the team. |
| Instructor | Only the classes they’re assigned to and the students in them. They record attendance and results, but can’t take payments or refunds. |
Outside your team, a corporate client’s portal users see only their own company’s employees and private classes, as an Admin who can register employees or a read-only Viewer. Students with an account see only their own classes, receipts and certifications.
Every business’s records are kept apart: the app only loads records that belong to the business you’re signed in to. When someone at JoinCPR opens your account to help with a support request, the visit is recorded in our activity log. See instructor management for how roles work day to day.
Backups
JoinCPR’s database is backed up automatically multiple times a day, so your classes, students and certification records can be restored if something goes wrong.
You can also keep your own copies whenever you like: rosters export in AHA and Red Cross formats, and every report downloads as a CSV or PDF.
Privacy and text message consent
JoinCPR doesn’t sell personal information, and students get text messages only if they choose to.
The text reminder box at checkout starts unticked, so only students who tick it are texted. They can reply STOP to opt out, START to opt back in and HELP for help. We never share mobile information with third parties or affiliates for marketing or promotional purposes, and text message consent isn’t included in the data sent to the marketing tools a business connects.
Read the privacy policy, the SMS terms and the terms of service.
Report a security issue
If you think you’ve found a security problem in JoinCPR, email info@joincpr.com with what you found and how to reproduce it.
Please give us a fair chance to fix it before telling anyone else, and don’t access, change or delete other people’s data while you look. We’ll reply to confirm we’ve received your report. For anything urgent, call (855) 223-3496, 8am to 8pm Central, 7 days a week, or contact us another way.
Start your free trial
Put your schedule online, take registrations and payments, and let reminders, rosters and renewals run themselves. $59 a month with every feature included.
15-day free trial. No credit card required.