Frequently asked questions

Hotspot-Box is a network appliance for businesses that offer Wi-Fi to their guests. It verifies the guest with an SMS code, stores internet access logs signed in the way Turkish Law No. 5651 requires, and lets you manage all of it from a web panel.

Yes. The box sits between your modem and your guest network. The brand or model of your access points does not matter, as long as guest traffic passes through the box.

Connection and DNS records are written during the day, then closed and compressed at the end of it. Each day's SHA-256 digest is linked to the previous one and signed with an RFC 3161 timestamp. The archive is kept for 2 years and can be verified and exported from the panel.

There are two options. You can buy SMS credits from us, or configure your own account with a provider such as NetGSM, İleti Merkezi, Verimor or TurkeySMS. In both cases the text goes straight from the box to the provider.

A separate SMS provider can be set for foreign numbers. Guests who prefer not to receive a text can sign in with an e-mail code or with a voucher from reception.

In the Box + Software package the licence is one-time and tied to the device. You can try every feature for 7 days before buying. Law 5651 logging never stops, even when a trial ends.

Disk usage, services and the certificate are monitored all the time, and you are warned by e-mail, Telegram or webhook when a threshold is crossed. The signed archive can be copied every night to a target outside the box, so the records survive a hardware change.

Before connecting, the guest accepts a privacy notice that you can edit, and that consent is recorded. Contact data such as phone numbers and e-mail addresses is stored encrypted on the device, and only the data needed for logging is collected.

No. The box keeps the internal IP allocation records that Law 5651 expects: which device received which internal IP and when, when the session started and ended, and the guest's verification channel (encrypted phone number, coupon code or e-mail). Visited sites, URLs, content, messages and location are not recorded. Most traffic today is encrypted with HTTPS, so page content is invisible on the network anyway. You can optionally enable a DNS query log; it stores domain lookups, not content.

The Law expects a public access provider to keep internal IP allocation records for those using its network; whether a staff network falls under this depends on how your business is structured, so get legal advice. Technically the box supports both answers. You separate the staff network from the guest network with a VLAN; if you wish, you define a separate staff plan (for example 30-day device memory, no quota) and write their sessions into the same signed chain. Or you can keep the staff network entirely outside the box.

No, there is no retroactive signing, and we say so plainly. A timestamp proves that a record existed at that moment; a stamp obtained today for a record that was not kept yesterday proves nothing. That is why the box's signed chain starts on the day it is installed, and from then on each day links to the one before. If you hold other records from the earlier period, you need to keep them separately; we suggest legal advice on that period. It is also the best reason not to postpone installation.

Yes. The box keeps each day's records for 730 days; expired days are deleted automatically, with nothing for you to do. The deletion is written to the audit trail, so you can later see which day was deleted and when. This way you meet the two-year retention the Law expects and avoid holding data longer than necessary under KVKK, the Turkish data protection law. For the second copy you keep off the box (SFTP/FTPS), you manage the retention period under your own policy.

The signature stays valid, but the times inside the records would be off. The box keeps its clock synchronised over NTP (time synchronisation over the internet) and monitors drift; if drift grows, the panel shows a warning and raises an alarm. Each day's digest receives an RFC 3161 timestamp from an independent timestamp authority; that stamp is evidence of time independent of the box's clock, and the box's clock is reported against it. So even with drift, "this record existed no later than this date" can be verified externally. If you get the warning, check NTP access.

Only the digest. The box computes a SHA-256 digest of the day's record files (a fixed-length fingerprint) and sends just that digest to the timestamp authority. Records cannot be reconstructed from the digest; the service never sees guest numbers, MAC addresses or IPs. The stamp file signed by the service is stored on the box next to that day. On export, these files go into the ZIP and can be verified independently with standard tools (for example openssl ts -verify).

Which businesses fall into which category, and what is expected of whom, can be debated; get legal advice for your own case. The box makes no such distinction: regardless of business type, it produces a SHA-256 digest of each day's records, chains it to the previous day and obtains a timestamp. So if you are asked for an integrity value or signed records, they are ready; if you are not, you can still show that the records were never altered. There is no extra cost; it is part of the licence.

No. Internal IP allocation records, guest verification data and the signed archive stay on the box, which means on your premises. They are not sent to the cloud, to us or to any server abroad; the hotspot-box.com platform only sees the box's health status and SMS credit, which contain no guest data. The timestamp service receives only a digest, never the records. The question of cross-border data transfer therefore does not arise with this product. Where you keep the second SFTP/FTPS copy is your decision.

You do; the records sit on your box, so we cannot see them or hand them over on your behalf. From the panel you select the date range and export it in one click: the ZIP contains day folders, record files, the SHA-256 chain manifest, RFC 3161 stamp files and a verification report. You can verify integrity on the same screen before exporting. On delivery, we recommend keeping a handover note with the date, the recipient and the file digests. Get legal advice on the scope and deadline of the request.

The box is sized by the number of devices connected at the same time, not by people. Besides guest phones, staff phones, POS terminals, printers, smart TVs and other IoT devices count if they sit on the guest network. You can exempt them from the portal by MAC address, but they still add to the device count. The Box + Software licence covers 250 concurrent users. Estimate how many devices stay connected at your busiest hour; if unsure, use the 7-day trial and read the real figure from the hourly load report in the panel.

"Concurrent" means devices connected at the same moment; unique guests per day are far more. A rough formula: daily guests ≈ concurrent devices × table turnover per hour × opening hours. Example scenario: a 60-seat cafe with roughly one turnover per hour, open 12 hours, sees about 700 unique guests a day, yet devices connected at once mostly stay around 60. Devices whose session or idle time expires drop off the counter, so it clears itself after the rush. The 250 concurrent limit is enough for most mid-sized venues.

Yes, but a firewall with a specific job. Hotspot-Box is built on pfSense; it isolates the guest network from the rest of your business, passes guest traffic through its own rules and writes NAT details into the records. What a corporate UTM does, such as deep packet inspection, content filtering, antivirus or VPN blocking, is outside the box's scope. If you already run a corporate firewall, the box does not replace it; it works alongside it as the layer responsible for the guest network.

No static IP is needed. The box only opens connections outward (timestamping, SMS provider, health reporting); nothing needs to reach it from outside. That is why it also works behind CGNAT, where the operator gives you a shared IP. You do not have to switch off the modem's own Wi-Fi: keep it for staff or turn it off to avoid confusion. Guests connect to the guest SSID broadcast by the access point (AP) behind the box. Devices that join the modem's Wi-Fi do not pass through the box and are not logged; decide with that in mind.

No. The box plugs in behind your ISP's modem or your existing router; the modem keeps providing the internet connection. The box takes the line from the modem, creates a separate network for guests, passes guest traffic through the portal, plan rules and logging layer, and hands it back to the modem. On the modem side you need one cable to the box and, in most setups, a few simple settings. Fibre, VDSL or a 4.5G line makes no difference.

No. Plan rules such as speed, session length, idle timeout, device count and daily quota are defined on the box and work independently of the AP brand; your access points only need to broadcast the guest SSID and support client isolation. You do not have to buy any additional licence, cloud subscription or software module for your modem, switch or corporate firewall. If your AP supports RADIUS, you can integrate it with the box at no extra charge; if it does not, the portal still works.

Not when set up correctly. Two layers work together: client isolation is enabled on the access point so devices on the same SSID cannot reach each other over wireless, and on the box the guest network is separated by VLAN from the staff network and business devices. After installation we suggest a simple three-step test: ping one guest phone from another, try to reach the printer or POS from a guest phone, and try to cross from the guest network into the staff network; all three should fail. The AP setting is on your or your installer's side.

Roaming between access points is the APs' job, not the box's. If a guest moves to another AP on the same SSID and VLAN, the device looks unchanged to the box, the session continues and no new login is asked. Repeated logins usually come from APs broadcasting different SSIDs, the guest VLAN not reaching every AP, or the phone randomising its MAC address. On the AP side, use one SSID, one VLAN and, if supported, 802.11k/r/v roaming. Identity and device memory live on the box; the same MAC is not asked again within the period you set.

Line failover happens on the modem or router; the box does not notice and simply keeps logging. 4.5G lines are usually behind CGNAT; since the box only opens outbound connections, this is no problem: guest login, SMS sending and timestamping keep working. Even while the internet is completely down, internal IP allocation records keep being collected on the box; days that could not be stamped appear in the panel as "pending days" and are stamped once connectivity returns. A line switch therefore does not break the chain.

Updates do not touch your archive or settings. The signed record chain, plan definitions, portal branding, SMS provider settings and coupons remain exactly as they were. We still recommend taking a configuration backup from the panel before each update; it is a single file and can be restored if needed. If you also keep a second copy of the archive off the box via SFTP/FTPS, your records already exist in two places. Pick a quiet hour, since there may be a short interruption during the update.

Four pieces are enough: a working internet line, your existing modem or router, the Hotspot-Box and at least one access point (AP) to broadcast the guest SSID. One AP covers a small venue; with several APs you need a switch connecting them to the box. Your current AP works if it supports client isolation and a separate SSID. Floor area, walls and the number of devices connected at once decide the AP count: add one where a single AP struggles or the signal fades. With the Virtual Appliance, a VM on your own server replaces the box.

Only the role you authorise. The phone number is stored encrypted on the box; in the panel it appears masked, and only a user with this permission can reveal the full number. Who viewed which record and when is written to the audit trail. Everyday users such as waiters, reception or technical staff do not need permission to see numbers; report and coupon rights are enough for them. Nobody outside the box, including us, can access these numbers.

The business operating the guest network, that is you, is the data controller: you decide which data is collected and for what purpose. The hotspot-box.com platform never sees a guest number; the box sends the SMS directly to the SMS provider, and the platform only supplies API credentials and counts credits. Device telemetry contains no guest data. The SMS provider and your installer, if any, are assessed under their own contracts. Get legal advice for your own documents such as the privacy notice, consent records and data inventory; the portal displays the privacy notice and keeps the consent record.

For two reasons. First, a social media account does not verify who the guest is; anyone can open a new account in minutes, whereas the point of record keeping is to tie a connection to a genuine verification channel. An SMS code reaches a phone number registered with an operator. Second, social login brings the guest's name, photo and friend list into your business; under KVKK that is a data burden and liability you do not need. That is why we build on the SMS code and offer coupons and e-mail as additional options.

We cannot rule on which verification method counts as sufficient; get legal advice on this. Technically the strongest baseline is SMS: the code goes to a phone number registered with an operator, and that number is kept in the record. Sending the code via WhatsApp is supported on the box as an addition to SMS; a WhatsApp number is also a phone number, but delivery depends on a third-party platform and its rules. So even if you enable WhatsApp, keep SMS as the fallback. Codes read out over a voice call are not among the methods we offer.

First check the number format; the country code and an extra leading zero are the most common mistakes. SMS providers occasionally have delays. On the box you can define a backup chain of providers: if the first does not respond, the code goes through the second. If the problem persists, staff hand out one of the coupons you generated in the panel; the guest logs in with the coupon code and the record is still kept. When SMS credit drops below 100, you get an alarm by e-mail, Telegram or webhook, so credit never runs out unnoticed.

It does. The guest enters the number with its country code and the box sends the code abroad as well. International SMS cost depends on the provider and the country, so you can define a separate provider for foreign numbers on the box and route domestic and international traffic through different accounts. With your own provider account, the charge follows that provider's tariff; ask us before purchase how international sends count against our credit packages. In tourist-heavy venues, coupons are a further option: a coupon handed out at the table or reception produces the same record without any SMS cost.

Because you need the price to make a decision, and waiting for a quote wastes your time. The Box + Software list price is 45,000 TL + VAT; the licence is perpetual, covers 250 concurrent users and has no per-user fee. SMS credit packages (1,000, 2,000, 10,000) are also published on the site, and you can use your own SMS provider account instead. For the Virtual Appliance and SaaS we quote by number of installations and term, and reply the same day. The 7-day trial lets you see the product before paying.

Remote support is included and there is no hour quota: the number of support requests is not limited and you do not wait for an appointment. You get remote help with installation, configuration, SMS provider setup, exports and faults. On-site installation and on-site service are priced separately; we quote them based on your city and venue size. Alarms monitoring the box's health (offline, disk usage, timestamp service, SMS credit) are included too, so most problems surface before your guests notice.

Guest sign-in pauses: new guests cannot pass the cloud portal. Because the SaaS cloud service keeps no Law 5651 records, there is no archive held by us; your portal design, plans and reports stay in your account and resume with the same settings when you renew. If you meet the legal record obligation with your own router or firewall, those records remain with you. The perpetual Box + Software and Virtual Appliance have no subscription at all; the signed archive stays on your device.

Because the records live on the box, hardware failure is a risk to plan for; two precautions suffice. First, keep a continuous second copy of the archive off the box via SFTP/FTPS (your own server, a NAS or storage of your choice); that copy and the configuration backup are loaded onto the replacement box, carrying the chain and stamps over intact. Second, download the configuration backup from the panel regularly. Cloud solutions carry a symmetric risk: if the provider shuts down or suspends your account, the records are gone. On the box, you decide where the copy lives.