Question 1

What is two-factor authentication?

Accepted Answer

Two-factor authentication (also called MFA or 2FA) adds an extra layer of security to your account. After entering your password, you'll also enter a 6-digit code from an authenticator app on your phone. Even if someone learns your password, they can't access your account without your phone.

Question 2

Is MFA required?

Accepted Answer

For supervisors and administrators, MFA is mandatory. This is a HIPAA compliance requirement because these accounts have access to associate clinical data. For associates, MFA is optional but strongly recommended. You can enable or disable it from your Account page under Security.

Question 3

Which authenticator apps do you recommend?

Accepted Answer

Any TOTP-compatible authenticator app will work with CredentialTrax. Here are our recommendations: • Google Authenticator (iOS and Android) — Simple, free, and widely used. Available on the App Store and Google Play. • Microsoft Authenticator (iOS and Android) — Free, supports cloud backup so you can recover your codes if you switch phones. • Authy by Twilio (iOS, Android, Desktop) — Free, supports multi-device sync and encrypted cloud backup. Our top recommendation for ease of use. • 1Password or Bitwarden — If you already use a password manager, many of them support TOTP codes built in. We do not recommend using SMS text messages for two-factor authentication, as they are less secure than authenticator apps.

Question 4

How do I set up MFA on my account?

Accepted Answer

1. Go to your Account page and scroll to the Security section. 2. Click "Enable Two-Factor Authentication." 3. A QR code will appear. Open your authenticator app and scan it. If you can't scan, click "Can't scan?" to see a manual entry key you can type in. 4. Your authenticator app will start generating 6-digit codes that change every 30 seconds. 5. Enter the current 6-digit code and click "Verify and Enable." 6. That's it — MFA is now active on your account.

Question 5

How do I sign in with MFA enabled?

Accepted Answer

1. Enter your email and password as usual. 2. You'll see a screen asking for your authentication code. 3. Open your authenticator app and enter the current 6-digit code. 4. Click "Verify and Sign In." The code changes every 30 seconds. If your code doesn't work, wait for the next one and try again.

Question 6

How do I disable MFA?

Accepted Answer

Associates can disable MFA from the Account page: 1. Go to Account → Security. 2. Click "Disable MFA." 3. Enter your current 6-digit authenticator code to confirm. Supervisors and administrators cannot disable MFA — it is required for HIPAA compliance.

Question 7

What if I lose my phone or can't access my authenticator app?

Accepted Answer

If you lose access to your authenticator app, contact us at support@credentialtrax.com. We will verify your identity and help you regain access to your account. To prevent this situation, we recommend using an authenticator app with cloud backup (like Authy or Microsoft Authenticator) so your codes survive a phone replacement.

Question 8

Can I use MFA on multiple devices?

Accepted Answer

If you use Authy, Microsoft Authenticator with cloud backup, or a password manager like 1Password, your codes will sync across devices. If you use Google Authenticator, codes are stored only on the device where you scanned the QR code — you would need to set up MFA again if you switch phones.

Question 9

Why does my session expire after 15 minutes?

Accepted Answer

For HIPAA compliance, CredentialTrax automatically signs you out after 15 minutes of inactivity. You'll see a 60-second warning before sign-out so you can stay signed in if you're still working. This protects your account and any clinical data if you step away from your device.

Question 10

How do I verify my email address?

Accepted Answer

When you create your account, we send a verification email to the address you registered with. Click the "Verify Email" button in that email. If you didn't receive it, check your spam folder. You can also click "Resend email" in the banner at the top of any page while signed in. The verification link expires after 24 hours. If it expires, use the resend button to get a new one.

Question 11

Is my data secure?

Accepted Answer

Yes. CredentialTrax uses three layers of encryption: • In transit — All data is encrypted with TLS 1.3 between your browser and our servers. • At rest (infrastructure) — Our hosting provider uses AES-256 disk encryption. • At rest (application) — Sensitive fields like clinical notes and uploaded documents are encrypted with AES-256-GCM at the application level, with unique keys per record. We also maintain an immutable audit log of all data access for HIPAA compliance.

Question 12

Will CredentialTrax sell my data or send me marketing emails from third parties?

Accepted Answer

Never. CredentialTrax will never sell your information or send emails on behalf of third parties. We will only contact you with platform updates, compliance reminders, and onboarding information relevant to your licensure journey. Your supervisor may also send you non-clinical notifications through the platform, such as scheduling updates or log review requests.

Question 13

What is a Super-Code?

Accepted Answer

A Super-Code is a short code (like "NACHOS") that your supervisor shares with you. When you enter it during onboarding, it automatically links your account to your supervisor — no need to re-enter their details manually. Your supervisor can also embed their code in an invitation link they send you.

Question 14

What if I don't have a supervisor yet?

Accepted Answer

No problem. During onboarding, check "I don't have a supervisor yet" and you can set up your track and start logging hours. You can add your supervisor later from your Account page.

Question 15

How do I import hours I've already logged with my state board?

Accepted Answer

During onboarding, choose "Log Previous Hours" at the Starting Point step. You'll enter each board report you've previously submitted as a separate entry, including the reporting period dates, approval date, and hours by category. Only enter hours that have already been filed with your state board. Any hours accumulated since your last board report should be logged individually from the dashboard after setup. You can also upload a photo or PDF of each submitted board report form for your records.

Question 16

Is there a CredentialTrax mobile app?

Accepted Answer

CredentialTrax is a web application designed to work beautifully on any mobile browser. There is no separate app to download from the App Store or Google Play. You can add it to your home screen for an app-like experience — see the instructions below.

Question 17

How do I add CredentialTrax to my iPhone home screen?

Accepted Answer

1. Open Safari and navigate to credentialtrax.com. 2. Sign in to your account. 3. Tap the Share button at the bottom of the screen (the square with an upward arrow). 4. Scroll down and tap "Add to Home Screen." 5. You can edit the name if you like, then tap "Add" in the top right corner. CredentialTrax will now appear as an icon on your home screen. Tapping it opens the site in a full-screen view without the browser toolbar, just like a native app. Note: This only works in Safari. Chrome and other browsers on iPhone do not support Add to Home Screen.

Question 18

How do I add CredentialTrax to my Android home screen?

Accepted Answer

1. Open Chrome and navigate to credentialtrax.com. 2. Sign in to your account. 3. Tap the three-dot menu in the top right corner. 4. Tap "Add to Home screen" (or "Install app" if prompted). 5. Confirm the name and tap "Add." CredentialTrax will appear as an icon on your home screen. Tapping it opens the site in its own window, just like an installed app. This also works in Firefox for Android: tap the three-dot menu and select "Add to Home screen."

Question 19

Will the home screen icon keep me signed in?

Accepted Answer

Yes, as long as your session is active. For HIPAA compliance, your session will still expire after 15 minutes of inactivity — you'll need to sign in again when that happens. We recommend enabling MFA for the most secure experience when using the home screen shortcut.

Frequently Asked Questions

Two-Factor Authentication (MFA)

Account & Security

Getting Started

Mobile App

Stay focused on your clients. We've got compliance handled.