In brief
Installation is done and the installer has left; who holds the passwords? Installer and owner roles on the box panel, the audit trail, and a handover checklist.
When installation ends, who holds the passwords?
Most businesses have a contractor install their guest Wi-Fi, and rightly so: cabling, VLANs and AP placement take experience. The problem does not start during installation; it starts after the installer leaves. Who holds the passwords for the modem, switch, access points and the box panel? Is the installer's account still open? Who can reach the guest records?
This article covers two things: how to separate roles on the box panel, and what to take over when the installer walks out.
Two roles: installer and owner
Permissions on the box panel are role-based. Every user signs in with their own account; there are no shared accounts. Every action is written to an audit trail: who changed what, and when.
Split the roles along the nature of the work:
| Installer | Business owner (administrator) | |
|---|---|---|
| Network settings (VLAN, DHCP, walled garden) | Yes, during installation | Yes |
| Plan definition (speed, duration, quota) | Yes, during installation | Yes |
| SMS provider settings | Connection test only | Yes; the account is in your name |
| Viewing guest records | No | Authorised role only, phone numbers masked |
| Archive verification and export | No | Yes |
| User and role management | No | Yes |
| Alarm recipients | No | Yes |
The principle is simple: give the installer what they need to do the job, and no access to guest data. The installer does not need to know who the guests are; knowing the network works is enough. Guest phone numbers are stored encrypted anyway and shown in the panel only to the authorised role, masked.
The owner account must be opened with your e-mail address from day one. An administrator account the installer says they will "hand over later" is the installer's account until it is actually handed over.
AP and switch passwords are not kept on the box
The question in the title comes up often, so let us be clear: access-point and switch management passwords are not stored on the box; they live on those devices. The box does not manage the APs; it works regardless of AP brand. So the installer's access to the box panel is not access to the AP password. The reverse holds too: you do not touch the box to change an AP password.
The only secret the box shares with APs or network gear is the shared secret, if RADIUS integration is used. That secret should be rotated at handover.
What the audit trail shows
The audit trail answers "who did it". Changes made in the panel are recorded with user and time: plan changes, provider settings, user additions, exports. Even the automatic deletion of expired daily records is written to the trail.
That is useful in three ways:
- At handover: You see what the installer did on the last day.
- While troubleshooting: For a "speed dropped yesterday" complaint, you find who changed the plan yesterday.
- In a data-subject request: If a guest asks "who looked at my data", the record exists.
For the trail to be worth anything, there must be no shared accounts. On a panel where five people sign in with the same account, "who" has no answer.
Handover checklist
Close the list below together before the installer leaves. Tick every line and get a signed record.
| # | Item | Done |
|---|---|---|
| 1 | Administrator account on the box panel is in your name, password held only by you | |
| 2 | Installer account closed, or reduced to a restricted support-only role | |
| 3 | Access-point management passwords changed | |
| 4 | Switch management password changed | |
| 5 | Modem / router management password changed | |
| 6 | RADIUS shared secret rotated, if used | |
| 7 | SMS provider account in your name; credit pack or API credentials belong to you | |
| 8 | Alarm recipients (e-mail / Telegram / webhook) set to your addresses | |
| 9 | SFTP/FTPS archive copy target is a server under your control | |
| 10 | Network diagram and VLAN plan received | |
| 11 | MAC exemption list (printer, POS, TV) documented | |
| 12 | Walled-garden list and post-login redirect address documented | |
| 13 | Licence and customer portal account in your name | |
| 14 | Archive verification from the panel run together once |
If a support contract with the installer continues, reduce the account to a restricted role in item 2 instead of closing it. When support is needed you can grant temporary permission and withdraw it afterwards; the audit trail shows what was done.
The data-protection angle
The business is the data controller for guest data. If the installer can reach guest data, that is a contractual matter; if they cannot, the problem never arises. That is the real value of role separation: withhold guest-data permission from the installer and no data-processing relationship is created. Still, seek legal advice for your own situation; contracts and privacy notices differ from business to business.
On the platform side things are even simpler: hotspot-box.com never sees a guest's phone number. The box sends the SMS straight to the provider; the platform only hands out API credentials and counts credits. Device telemetry carries no guest data.
In short
- Administrator account in your name from day one.
- Network permission for the installer, yes; guest-data permission, no.
- AP and switch passwords live on the devices, not the box; change them at handover.
- No shared accounts; the audit trail only works that way.
- Close the 14-item list with a signed record.
See Box + Software for the role structure and audit trail, and the FAQ for common questions. If you want help with a handover, write to us.
This article is general information, not legal advice.
This article is for information only and is not legal advice; confirm your obligations with your legal adviser.