Auditor Summary
A one-page summary of the venue's guest Wi-Fi record-keeping, prepared to be handed to an inspector. Fill in the blanks for your venue.
29 October 2026 · version 1.0 · hotspot-box.com
Venue details
| Field | Value |
|---|---|
| Venue | {{venue}} |
| Box installation date (the day the chain starts) | {{installation_date}} |
| Box ID | {{box_id}} |
| Responsible person and contact | {{contact}} |
Overview
{{venue}} keeps internal IP assignment records for the internet access it offers to guests, in its capacity as a public-access provider. The records are collected on a Hotspot-Box appliance installed at the venue, linked daily by a hash chain and timestamped.
Guests join the network through a captive portal. The primary authentication method is a one-time SMS code sent to the guest's phone; the venue may also enable coupon, e-mail and registered-user sign-in.
What is recorded
| Field | Description |
|---|---|
| Authentication detail | Phone number (stored encrypted, shown masked in the panel), coupon code or e-mail address |
| Device MAC address | Hardware address of the guest device |
| Assigned internal IP | Local address given to the device for that session |
| Session times | Start and end time |
| NAT detail | Mapping to the external address, where applicable |
What is not recorded
Visited sites and URLs, viewed content, messages and location are not recorded. The record shows who connected to the network, with which address and when; it does not show what they did.
How integrity is proven
A SHA-256 digest of each day's record file is computed and chained to the previous day's digest. A single changed line in a past day therefore invalidates every day that follows.
The daily digest is timestamped by an RFC 3161 compliant timestamp service. Only the digest leaves the venue; the records themselves do not.
Record collection continues during internet outages; days that cannot be stamped wait in a queue and are stamped when the connection returns. The chain starts on the day the box is installed; no retroactive stamps are produced.
The box's clock is kept in sync with NTP; the panel warns if the drift grows.
Retention and deletion
Records are kept for 2 years (730 days). Expired days are deleted automatically on the box and every deletion is written to the audit trail, so what was deleted and when can be seen later.
Export and verification report
An authorised user verifies the requested days in the panel with one click and exports them as a ZIP. The package consists of day folders, line files, a manifest holding the SHA-256 chain and the RFC 3161 timestamp file. The verification report shows the state of the chain and of the stamps.
The timestamp file can also be verified independently of the box with standard tools (for example openssl ts -verify).
Who can access
Sign-in to the management panel uses a password plus a one-time code sent by e-mail. Permissions are role based; only an authorised role sees guest phone numbers, and only masked. Actions taken in the panel are kept in an audit trail.
Where the data lives
Records are stored on the box at the venue; they are not sent to the cloud, abroad or to the manufacturer. If the venue chooses, a second copy of the archive is written to an SFTP/FTPS destination of its own choosing: {{archive_destination}}.
The manufacturer's platform never sees guest phone numbers; the box sends the SMS directly to the SMS provider. Device health data contains no guest information.
This summary is for information only and is not legal advice; adapt it to your venue's setup.