The REDCap Consortium License Explained: What It Is, Who Qualifies, and How to Get One

REDCap is free. That's the headline — and for the right organizations, it's true. But "free" in this context means free software, not free infrastructure, and access to that free software requires a specific license from Vanderbilt University. Understanding how the REDCap consortium license works is the foundation of any REDCap deployment — and the source of most of the confusion institutions run into when they first explore the platform.

What Is the REDCap Consortium?

REDCap was developed in 2004 at Vanderbilt University's biomedical informatics group to solve a specific problem: academic researchers needed a secure, HIPAA-capable data collection tool that didn't require programming expertise or enterprise-scale budgets. The software worked so well at Vanderbilt that other institutions asked to use it.

Rather than commercializing it, Vanderbilt created a sharing model: institutions that wanted REDCap could have it for free, in exchange for joining a collaborative community that contributed feedback, tested new features, and helped improve the platform. That community is the REDCap Consortium — now over 5,900 institutional partners in 145 countries.

Joining the consortium means signing a license agreement with Vanderbilt and becoming part of that community. The software itself is provided at no charge. Vanderbilt funds development through grants and institutional support, not licensing fees.

Who Qualifies for a REDCap Consortium License?

The REDCap consortium license is available to:

• Nonprofit organizations — including 501(c)(3) organizations in the US and equivalent designations internationally
• Academic and research institutions — universities, colleges, research hospitals, and affiliated institutes
• Government agencies — federal, state, local, and tribal government organizations
• Military organizations — US and international military research entities

The license is explicitly not available to:

• For-profit companies or commercial entities
• Individual researchers or consultants (only organizations can hold a license)
• Organizations that intend to use REDCap for commercial purposes

What the License Allows — and What It Doesn't

Understanding the license terms prevents the most common compliance mistakes:

What You Can Do

• Download and install REDCap on your own servers or cloud infrastructure
• Use REDCap for non-commercial research and data collection
• Customize REDCap's appearance and configuration for your institution
• Allow your researchers and staff to use the system
• Host REDCap on third-party cloud infrastructure (AWS, Azure, etc.) as long as the provider has no access to the software itself
• Have a third-party manage your server infrastructure — but not the REDCap software

What You Cannot Do

• Redistribute the REDCap source code to other organizations
• Use REDCap for commercial purposes
• Contract out REDCap administration to a third party — IT staff must be your employees
• Allow your hosting provider to access the REDCap source code or installation
• Transfer the license to another organization

How to Apply for a REDCap Consortium License

The application process is entirely online and typically takes less than an hour to complete — though approval timelines vary.

1. Go to projectredcap.org/join — the official consortium join page maintained by Vanderbilt
2. Complete the eligibility survey — a short questionnaire that confirms your organization qualifies. Reasons for disqualification include being a for-profit entity or having insufficient IT infrastructure to self-host.
3. Review the license terms — Vanderbilt's license is standardized and non-negotiable. Read it carefully, particularly the sections on permitted use, IT requirements, and the prohibition on redistribution.
4. Identify your authorized signatory — the license must be signed by someone with authority to bind your organization (often the Director of Technology Transfer, General Counsel, CIO, or similar)
5. Submit the electronic agreement — once signed, Vanderbilt reviews and countersigns. You'll receive credentials for the REDCap Community platform and access to the software download.

The review process typically takes a few business days to a few weeks depending on volume. Having your authorized signatory identified before you start the application will speed things up considerably.

What Happens After You Get the License

Once you have your consortium license, you have access to:

• The REDCap source code — available for download through the Community platform
• REDCap Community — an internal platform with documentation, troubleshooting resources, and communication with other consortium partners and Vanderbilt staff
• Consortium webinars — regular sessions for system administrators on technical topics, new features, and best practices
• REDCapCon — the annual in-person conference for consortium members

What you don't automatically have: a working REDCap environment. The license gives you the software — you still need infrastructure to run it on. That's where managed hosting comes in.

Getting From License to Live Environment

The gap between "we have a REDCap license" and "our researchers can collect data" is where most institutions get stuck. Self-hosting requires setting up a Linux/Apache/MySQL/PHP server stack, configuring SSL, setting up email, hardening the server for HIPAA compliance, and handling ongoing maintenance. For institutions without dedicated sysadmin resources, this is a significant lift.

Managed infrastructure providers like Kapstone Systems bridge this gap. We provide the server environment — fully configured, HIPAA-compliant, and ready to run REDCap — while you install and manage REDCap itself using your consortium license credentials. Most clients go from freshly-approved license to live data collection environment within one month.

If your organization is just starting the license process, we're happy to guide you through it. We've done it dozens of times and know exactly where the friction points are.