In brief
Three copies, two kinds of media, one off-site. We applied the oldest rule in backup to a two-year guest Wi-Fi archive: box disk, SFTP copy and offline export.
An old rule for a new archive
The most repeated rule in backup is 3-2-1: keep three copies of your data, on two different kinds of media, with one copy somewhere else. It applies to everything from photo libraries to accounting databases. In this article we apply it to the guest Wi-Fi records you have to keep for two years.
One thing first: Hotspot-Box keeps the records in the box, on your premises. They do not go to the cloud or to us. That is an advantage; you know where every copy is. But it also means the answer to "who makes the copies" is you.
Copy one: the box disk
The box collects each day's internal IP assignment records, links them to the previous day with a SHA-256 hash chain and obtains an RFC 3161 timestamp. That record stays on the box disk for 730 days. From the panel you can pick any day, verify it and export it.
Copy one is the working copy; daily tasks and the first inspection question are answered from here. But boxes get stolen, get wet, and disks wear out. One copy is no copy.
The disk usage alarm in the panel guards this copy. When the threshold is crossed you hear about it by e-mail, Telegram or webhook.
Copy two: off the box by SFTP or FTPS
In the panel you define an archive target: a NAS on your premises, a file server at head office or a rented server. The box sends each day's signed archive there together with its manifest and timestamp file.
Three suggestions for copy two:
- Keep it on a different device. A disk on the same shelf, plugged into the same socket as the box, does not count as "different media". At least a separate device, ideally a separate room.
- Grant write-and-forget permission. Let the SFTP user write to the target directory but not delete. Even if the box were compromised, the old copies stay.
- Set retention on the target too. Make sure the target server's own clean-up job does not delete the archive before 730 days.
The panel shows the time of the last successful transfer and any error. During the acceptance test you need to log into the target server and see that the copy really arrived; "connection successful" and a file on disk are not the same thing.
Copy three: the offline export
From the panel you select a date range and export it as a ZIP. It contains day directories, record rows, manifest, timestamp files and the verification report. You put that ZIP on media that is not connected to the network: an encrypted portable drive, a USB stick in the safe.
The value of the offline copy is its disconnection. Ransomware, a wrong command or a disgruntled former employee cannot reach it. The cost is that it is manual; if it is not in the calendar, it does not happen.
How often?
| Copy | Frequency | Who | Where it shows |
|---|---|---|---|
| Box disk | Continuous, automatic | The box | Panel archive list |
| SFTP/FTPS | Daily, automatic | The box | Panel transfer history |
| Offline ZIP | Monthly or quarterly, manual | You | Your own backup log |
Tie the monthly export to the first working day of the month; you take the previous month in one go. Quarterly may be enough, but then check the health of the SFTP copy every month in between.
How do you test a restore?
Backups are taken, restores are tested. Whoever skips the second did the first for nothing. A quarterly routine:
- Pick a random day from the SFTP copy. Download one day from the directory on the target server to a different computer.
- Check integrity. Compare the SHA-256 digests in the manifest with the files; verify the timestamp file with
openssl ts -verify. The commands are detailed in our article on the archive's contents. - Compare with the panel. Verify the same day in the panel; the two results must agree.
- Open the offline ZIP. Confirm your latest ZIP opens and the verification report reads correctly. Portable media can fail silently.
- Write down the result. Date, day chosen, outcome. That note answers the second half of the inspection question "do you have a backup": yes, and I know it works.
Two common mistakes
Leaving the timestamp out of the backup. Record rows alone do not answer "when was this signed". The timestamp file and manifest are part of the archive; the box sends them together, so keep them together.
Putting the backup target on the box's own guest network. A NAS reachable from the guest network is a risk, not a backup. The SFTP target belongs on the business network or at a separate location; the box already separates the guest network with a firewall, so keep the target on the right side of that wall.
What if the box is replaced?
If the box fails or is swapped for a new one, the old archive remains in the SFTP copy and the offline ZIPs. The new box's chain starts on the day it is installed; old days are not signed retroactively, but they were signed already. At an inspection you present the two periods side by side. Signing key and configuration backup are covered in a separate article.
See the box and virtual machine options on the products page, or use the contact page for installation questions.