— Security
We teach online safety, so we hold ourselves to it
This course exists partly because people get scammed. It would be shameful if our own site made that easier, so here is exactly how we behave and how your account is protected.
What we will never do
Never ask for your password
Not by phone, text, email or WhatsApp. Nor a 6-digit code, nor your PIN. And we never send you a code to scan.
Never ask for gift cards or wire transfers
Payments happen only on our payment page. Nobody from FirstClick will ask you to send credit to a person.
Never call about a "problem"
If someone calls claiming to be us and asks you to read out a code, hang up and contact us yourself.
How your account is protected
- Two things are needed on a new device: the code we email you and your PIN, so neither one alone is enough to get in.
- A 6-digit PIN that only works on devices you approve, like a banking app, with an email to you whenever a new device is added, and Forgot PIN by emailed code.
- Face or fingerprint, if you want it, on devices you approve. Your face or fingerprint stays on your device: we never receive it or keep it.
- Signed out after 10 minutes without activity. At 5 minutes we ask "Are you still there?" and count down, in case you walked away from the computer. Your progress is saved.
- Signed out when you leave your learning area. Click a link to the rest of the website and we ask first; leave another way, such as with the Back button, and you are signed out. To browse the website and stay signed in, open it in a new tab.
- Your PIN, and any password, are stored scrambled, in a form nobody here can read.
- Email changes need a code, your old address can still recover the account for 7 days, and every change is listed in your profile.
- A secure connection on every page, shown by the padlock in your browser.
- Card details never touch our site. Payments are handled by the payment provider.
How the site itself is protected
This site sits behind Cloudflare, a security and network company used by millions of websites. Every visit passes through Cloudflare before it reaches our server.
- An encrypted connection, so what you type travels scrambled between your device and the site.
- Attack traffic is filtered out before it reaches us, including floods of fake visits meant to knock a site offline.
- A quick security check on our forms stops automated programs from filling them in, usually without you having to do anything.
- Our own limits on top: repeated wrong passwords and codes are slowed down, course codes work once, and every sign-in, code use and change is recorded so problems can be investigated.
Computers donated to schools
Wiped before they leave our care
If a company asks our team to wipe its computers, we securely erase every drive and reset each computer before it goes to a school.
Confirmed in writing
We confirm the wipe in writing, listing each computer, for the company's records.
Or guided, step by step
Companies that prefer to wipe their own computers get our guidance, and stay responsible for removing their data before collection.
The full arrangement is in section 13 of our terms, and how we handle the company's details is in our privacy notice.
What we ask of you
Protect your email
Your sign-in codes go there. Give your email its own strong password, used nowhere else.
Keep your PIN private
Do not use 123456 or your birthday, and never send it to anyone. Check Your devices now and then, and remove any you do not recognize.
Sign out on shared devices
At a library, a friend's laptop or an internet cafe, press Sign out before you get up, and answer No, it is shared when we ask whether it is your own phone or computer.