REDCap is often described as "free," which is true but incomplete — it's free to license for qualifying organizations through Vanderbilt University's REDCap Consortium, not freely available for anyone to download and deploy commercially.
Who qualifies
The consortium license is intended for non-profit, academic, government, and healthcare institutions conducting research or related data collection — not for-profit commercial use. Qualifying organizations sign an institutional agreement directly with Vanderbilt, and each institution designates a REDCap administrator responsible for the local instance.
How the process actually works
- Initial inquiry — your institution contacts the REDCap Consortium to confirm eligibility and request access.
- Institutional agreement — a signed agreement between your institution and Vanderbilt establishes the license terms.
- Local administrator designation — someone at your institution (or a contracted infrastructure partner) is named the technical administrator.
- Software access — once approved, your institution gets access to the REDCap source code to deploy on your own infrastructure.
A common point of confusion
The license covers the software, not the infrastructure it runs on. Vanderbilt doesn't host your instance or provide server infrastructure — your institution is responsible for provisioning, securing, and maintaining the actual server environment, whether that's done in-house or through a managed hosting provider.
Researchers and administrators affiliated with more than one qualifying institution sometimes run into flags around dual REDCap accounts under the consortium's compliance monitoring. If you're supporting REDCap across multiple institutions — as an independent consultant, for example — it's worth proactively clarifying your affiliation structure with the consortium rather than letting it surface as a compliance question later.
After licensing: the actual build-out
Getting the license is the first step, not the whole project. What comes next — provisioning a proper DEV/TEST/PROD environment, HIPAA-aligned infrastructure controls, and (for FDA-regulated studies) 21 CFR Part 11 configuration — is where most of the real technical work happens, and where institutions without dedicated IT capacity typically bring in a managed infrastructure partner.
Tell us what's not talking to what.
Whether it's a data lake that needs building, an EMPI that needs replacing, or a document pipeline eating your team's time — start with a real conversation.
Start a Conversation