Your membership, your details and your payments are protected at every step: when you sign in, when you pay, and while your information is stored with us.
A password alone is not enough to open an NPPA account.
Every sign-in needs a one-time code sent to your email, as well as your password. There are no exceptions, so a stolen password on its own is useless.
Repeated wrong passwords or codes are blocked for a while, and too many requests for codes or reset links are refused.
Add a second email address under My NPPA → Login & email settings. If you lose access to your main email, you can still sign in and reset your password.
Changing your login email needs your current password and a code sent to the new address, so nobody can quietly take over your account.
When your password changes, every other device signed in to your account is signed out automatically.
Sign-up and password-reset forms check that a real person is using them, which keeps spam and automated attacks away from members’ inboxes.
My NPPA lists when, where and on which browser your account was used. One click on “Sign out of all other devices” ends every other sign-in.
Signing in at a library or café? Tick “This is a shared or public computer”: you are signed out after 30 minutes without activity, and the computer won’t remember you.
You get an email (also at your backup email) when your password, login email, phone number or address changes, after several wrong passwords, and when your account is used from a new country.
The website itself is built and run to keep your information safe.
Every page is served over HTTPS, so what you type and read cannot be seen by others on your network. Phone numbers and addresses are also stored encrypted, with the key kept apart from the website.
The site sits behind Cloudflare, which filters out attacks and harmful traffic before it reaches us.
Forms can only be sent from our own pages, our pages can’t be framed by other sites, and every address and input is checked before it is used.
The website’s software and the libraries it uses are kept on current, supported versions with the latest security fixes.
NPPA administrators also sign in with two-step codes and are signed out after a period of inactivity. Downloading member data needs a fresh code, the riskiest actions need two people to agree, and phone numbers stay hidden on admin pages until needed (each view is logged).
The site is checked every hour for unexpected changes and for being up, unusual sign-ins and payments raise an alert, hidden traps reveal any leak of member data, and data is backed up every night.
NPPA will never ask for your password or login code by phone, WhatsApp or email. Anyone who asks is not us.
Choose a password you don’t use on any other website, ideally saved in a password manager.
Sign in only at nppassociation.org, and look for the padlock in your browser’s address bar.
If you get an email about a sign-in or password change that wasn’t you, reset your password from the login page, use “Sign out of all other devices” on My NPPA, and write to us. If you think you have found a security problem on the website, please report it privately: see Reporting a security problem.
[email protected]Read our Privacy Policy, Responsible Disclosure Policy and Terms and Conditions.
