In brief
When your cloud service ends, how do you reach two years of archive? With the box, the archive stays on your premises. The questions to ask any provider before you sign.
The duty outlives the provider
You subscribe to a guest Wi-Fi service. Monthly fee, a portal, records in the cloud. Two years later the price changes, your needs change, the provider changes; you end the contract. So where are the last two years of records?
The retention period Law 5651 expects from a public-access provider does not depend on your contract. On the day you terminate the service, you are still the addressee for the previous 730 days of records. An official request that arrives a year later will not accept "we switched providers" as an answer.
This article is not written to criticise any provider. It is written so that you ask the right questions before signing.
Four scenarios when the contract ends
When a cloud-based service ends, the archive goes one of four ways:
| Scenario | What it means for you |
|---|---|
| Archive deleted immediately | The duty continues, the records do not |
| Archive "frozen" for a period, readable but at a new fee | Access exists, but its price and duration are the provider's call |
| Archive exported, but without verification data | Rows exist, proof of integrity does not |
| Archive handed over signed and timestamped | Independently verifiable; this is the one you want |
If you do not know which one your contract says, it is probably one of the first two. The fourth option means extra work for the provider and is rarely offered unless asked for.
Where does the archive live with the box?
With Hotspot-Box, records are kept in the box, on your premises. They do not go to the cloud, abroad or to us. Each day's records are linked by a SHA-256 hash chain and receive an RFC 3161 timestamp; only the digest travels to the timestamp service. From the panel you verify any day and export it as a ZIP. A second copy goes by SFTP or FTPS to a server you choose.
What that means on "contract ended" day:
- In the Box + Software model the licence is perpetual; there is no end date. The archive stays in the box and in your copies.
- In the Virtual Appliance model the licence is perpetual too; the archive stays in the VM and in your copies. Verification can be done independently of the device with the timestamp files and
openssl. - In the SaaS cloud service there is no device on site and no Law 5651 records are kept, so there is no archive to carry over when the contract ends. For a business with the legal record obligation this model is not enough on its own; choose the Box or the Virtual Appliance.
So the question changes from "can I get my archive back" to "was the archive always mine".
Eight questions to ask a provider
Whichever solution you are evaluating, ask the person quoting you the following and get the answers in writing:
- Where are the records physically kept? Which country, which data centre, or our own premises?
- What happens to the archive on the day the contract ends? Deleted, frozen or handed over? Within how many days?
- In what format is the archive handed over? Rows only, or with the hash chain and timestamp files?
- Can we verify the archive without your system? With which tool, which command?
- During the contract, can we pull a copy of the archive to our own server? Automatically or manually?
- Do guest phone numbers pass through your systems? If so, do we have a data processor agreement under KVKK?
- What happens if the provider ceases operations? Uncomfortable, but the most important question.
- Is there a fee for retrieving the archive? If so, it belongs in the contract.
For Hotspot-Box the answers are, in order: on your premises; nothing, it is already yours; day directories, manifest, timestamp file, verification report; yes, with openssl ts -verify; yes, daily by SFTP/FTPS; no, the box sends SMS directly to your provider; the box keeps running and the archive stays with you; none.
Two archives side by side during the transition
When you move from one provider to another, the two-year retention window does not reset. For the first 730 days you hold two archives: the records handed over by the old provider and the chain that starts on the day the new box is installed. The box does not sign retroactively; the old records are kept in the form they were delivered.
What to do in that period is short:
- On the day you receive the old archive, take a SHA-256 digest of it and note the handover date. From that date on, at least, you can show it has not changed.
- Store the old archive in a separate directory on the same server as the new box's SFTP target, so one backup routine covers both.
- Write the switch-over date into your installation documents. At an inspection, that date is the answer to "why are there two formats".
If the old provider handed the archive over unsigned, that remains a gap; do not hide it, explain it together with the switch-over date.
"But the cloud is more convenient"
It has real points. Cloud solutions have no hardware to worry about, updates are invisible, and managing several sites from one screen is easy. None of that is to be dismissed.
The question is whether you have to choose between convenience and control of your archive. With the Box and the Virtual Appliance the two are separated: licence and management from the cloud, records on your device. The platform sees the device's health (disk, timestamp status, credit); it does not see guest data. The SaaS cloud service keeps no records; the archive question never arises there, but it does not meet the legal obligation either.
The evening before you sign
Read the offer in front of you against the eight questions above. Every question without an answer becomes a question you must answer yourself two years from now. The two most critical: what happens to the archive on the day the contract ends, and can you verify it without the provider.
See the three product models side by side on the products page and the SaaS model in detail on the SaaS page. Contact us with your questions.
This article is general information and is not legal advice.