HOW IT WORKS
If you hold a CISSP or a CISM, you already do the learning. The painful part is proving it three years later: which podcast counted, how long that course was, where the certificate went, and whether you cleared the annual minimum you forgot existed. This keeps that record as you go.
Say it the way you would out loud. Type "I read Threat Modeling by Adam Shostack" and it finds the book, the author, the page count, and an estimate of how long that takes to read. Paste a link to a white paper and it reads the page. For everything else there is a short form.
ISC2 and ISACA do not count the same activity the same way, and most people discover that at renewal. Every entry is scored twice, with the reasoning written out in plain English, so you can see why something counts for one certification and not the other.
Nothing counts until you say how long you actually spent. Estimates from page counts and video lengths are starting points, never claims. Estimates are held in a separate column and excluded from every total until you decide.
Filing a credit normally means retyping the title, provider, date and hours into a form, then hunting down the right certificate and uploading it. The add-on fills all of that and attaches the file. You check the form and press the portal's own save button, and the next entry loads automatically.
Not just a running total. Both certifications enforce a yearly minimum separately from the three-year requirement, and the yearly one is what catches people out. The dashboard shows each cycle year, what is still missing, and how much you need per month to finish.
WHERE THE LEARNING COMES FROM
Some sources can be read automatically. Some cannot, because their terms forbid it, and we would rather tell you that than quietly risk your account.
THE PART PEOPLE GET WRONG
An hour of learning is one credit. Domain-related material counts as Group A. General professional skills such as leadership or public speaking count as Group B, capped at 30. Earn 40 Group B credits and 10 of them are wasted, which the dashboard warns you about rather than letting you find out at renewal.
ISACA counts a CPE hour as 50 minutes of active participation, so the same activity is worth more here than for CISSP. It also enforces a 20-hour annual minimum entirely separately from the three-year total. Clearing 120 means nothing if you missed a year.
From 1 January 2027 ISACA moves to the same 90 and 30 split as ISC2 and stops awarding credit for vendor product demonstrations. Activities are scored under whichever policy applied on the day you completed them, so your older entries do not silently change value.
BUILT FOR PEOPLE WHO READ THE THREAT MODEL
Your records are encrypted in your browser before they sync, using a key derived from your password. The password never leaves your device. What reaches the server is an email address, a verifier that cannot be reversed into a password, and an unreadable blob.
History is read by a browser add-on running on your machine, using sessions you are already signed into. There are no stored passwords and no access tokens, so there is nothing worth stealing from us.
A year after a certification body accepts a submission, the entry and its evidence are deleted automatically. You can shorten that, keep the ledger line while dropping the file, or switch it off.
WHAT IT DOES NOT DO
Neither ISC2 nor ISACA offers a way for software to file on your behalf, and neither accepts a bulk upload. So this drives their form instead: it fills every field it recognizes, attaches your evidence file to the upload box, and then waits. You check it and press their save button, and the next entry loads by itself. A CPE claim is your attestation, and their forms change without warning, so a person sees every entry before it goes in.
No history export records attention. A video appearing in your history proves you opened it, nothing more. So the app looks up how long the video is and asks you to confirm, rather than assuming. One click if you watched it all, a number if you did not. Nothing is claimed on your behalf.
The scoring follows published ISC2 and ISACA policy, including the ISACA changes taking effect in January 2027. It is a well-informed starting point and an audit trail, not a guarantee. The final judgement on any credit is yours.
Your password is the key that decrypts your records. We do not hold a copy, which is the entire point. If you lose it, the data is gone. Use a password manager.
One price, both certifications, no add-ons. Cheaper than the coffee you drink during one webinar.
Create your account