In brief
An administrative inspection is not a law-enforcement request. Here are 12 questions an inspector is likely to ask and where each answer lives in the panel.
Inspection or request?
There are two different doors, and mixing them up scares businesses for no reason.
An administrative inspection checks whether you are meeting your record-keeping duty. It is not looking for a particular guest; it wants to see that a system exists. The questions start with "how".
A judicial request asks for a specific record for a specific date and IP. That is where export and delivery come in, and we cover it in a separate article.
This article is about the first door. The 12 questions below are the ones an inspector is likely to ask once they sit down at your desk. Next to each one we say where the answer sits in the Hotspot-Box panel. The exact list varies by institution and period; this is a preparation guide, not an official checklist.
The record-keeping system
1. You offer guests internet access. Do you keep records?
Open the archive section of the panel. A list of records grouped by day, with the timestamp status next to each day. That screen alone says "yes, and regularly".
2. What exactly do you record?
Device MAC address, assigned internal IP, session start and end, NAT details where present, and the guest's verification detail (encrypted phone number, coupon code or e-mail). Sites visited, content and location are not recorded. Do not recite this from memory; open one day's rows in the panel and show them.
3. How long are records kept?
730 days. The retention setting and the date of the oldest day are visible in the panel. If the box is less than a year old, the oldest day equals the installation day; be ready to explain that.
4. How do you prove the records were not altered afterwards?
Each day's records are linked to the previous day by a SHA-256 hash chain and receive an RFC 3161 timestamp. Pick any day in the panel and run verification; the report shows the chain is intact and the timestamp valid. Doing it in front of the inspector is the most convincing way.
5. Where does the timestamp come from, and what is sent?
Only the day's digest goes to the timestamp service; the records themselves stay in the box. The panel shows the service status and the time of the last successful timestamp. This is also a KVKK question: no guest data leaves the premises.
Identity and login
6. How do you verify who the guest is?
The primary method is phone verification by SMS code. Coupon, e-mail and registered-user options may also be enabled. The login methods setting in the panel shows which are active. Every session record carries the method it was opened with.
7. Can anyone get online without verification?
Not beyond the walled garden (the list of addresses reachable before login). Show that list in the panel; it usually contains only a handful of addresses such as the SMS provider and your own website. Devices with a MAC exemption (printer, POS, TV) are listed separately and are business equipment, not guests.
8. Are the guest network and the business network separate?
Yes; they are separated by VLAN and the box sits in front of the guest network as a firewall. The interface and VLAN definitions in the panel show this. If client isolation is enabled on the AP side, mention it.
Clock, backup, access
9. Is the box's clock right?
NTP status in the panel: synchronised, drift value and the difference against the timestamp service. A record with the wrong time is open to dispute even if it is intact, which is why inspectors ask.
10. Is there a backup of the records?
A second copy of the archive is sent off the box by SFTP or FTPS. The panel shows the target, the time of the last successful transfer and any error. If you can, show the directory on the target server as well.
11. Who can access the records?
Role-based permissions. The user and role list in the panel shows who can see what. Guest phone numbers are visible only to an authorised role, and masked. The audit trail records who did what and when, including exports.
12. Would you know if recording stopped?
Alarm settings: e-mail, Telegram or webhook channels; alerts for disk usage, timestamp service, SMS credit and offline status. Open the alarm history and show the latest notifications. "No alarm has ever fired" is also an answer, as long as you can show a test notification was sent.
Summary table
| Question | Where in the panel |
|---|---|
| 1-3 Records exist, what, how long | Archive list and retention setting |
| 4-5 Integrity and timestamp | Daily verification, timestamp status |
| 6-8 Identity and network separation | Login methods, walled garden, VLAN |
| 9 Clock | NTP status |
| 10 Backup | SFTP/FTPS setting and history |
| 11 Access | Roles and audit trail |
| 12 Alarms | Alarm channels and history |
The evening before the inspection
Set aside half an hour. Check in the panel that the last 7 days are timestamped, that no days are pending, that the SFTP copy is current and NTP is synchronised. Verify one day and print the report. Have your post-installation acceptance test sheet and the current version of your consent text to hand.
The question of who the addressee is remains debated in some settings: a unit in a shopping mall, a residential complex, a co-working space. Get legal advice on it; the box keeps the same records either way.
See the industries page for sector-specific notes and the FAQ for common questions.
This article is general information and is not legal advice.
This article is for information only and is not legal advice; confirm your obligations with your legal adviser.