Skip to content
Hotspot-Box

A to Z glossary

Law 5651, KVKK and guest Wi-Fi terms; next to each term, what it corresponds to on the box.

8

802.11k/r/v
Three Wi-Fi standard amendments that help a client move between access points faster and without drops. k shares a neighbour list, r speeds up re-authentication, v lets the network steer a client to a better access point.
On the box: These are switched on at the access point; the box tracks a guest session by the device's MAC address, so roaming does not drop the session as long as the access points stay on the same guest network.
802.1X
A port-based access control standard that authenticates every user with their own credentials, usually against a RADIUS server. It suits staff networks; handing usernames and passwords to guests is impractical, so it is rarely used on guest Wi-Fi.
On the box: On the guest network the box uses a captive portal; 802.1X belongs to the staff network design and does not change the box's guest records.

A

Access point (AP)
The radio unit wireless devices connect to. It broadcasts an SSID and carries clients onto the wired network and its VLANs; authenticating users and keeping records is usually not its job.
On the box: Your existing access points stay as they are; the box works independently of the AP brand and needs no extra licence on your current equipment.
Access provider
An operator that gives its subscribers access to the internet; in practice, the carrier that sells you the line. It has its own obligations but cannot know which device inside your network was given which address.
Access record
A record showing when a user joined the network and with which device and internal IP. It does not cover the sites visited or the content; it shows who was connected, when and with which address.
On the box: For every session the box writes the verification detail, the device MAC address, the assigned internal IP, start and end times and NAT details where present.
Audit trail
A sequence of records showing who did what, and when, in a system, which is not altered afterwards. In an inspection it answers the question of who viewed or deleted a record.
On the box: Changes made in the panel, phone-number views and the automatic deletion of expired days are all written to the audit trail.

B

Bandwidth / quota
Bandwidth is how much data a connection can carry per second (Mbps). A quota is the total amount of data a guest may use in a given period, for instance a day (MB or GB). Together they stop a handful of people from consuming the line.
On the box: Download/upload speed and the daily quota are set per plan in the box and applied regardless of access point brand.

C

Captive portal
The sign-in page a device meets before it can reach the internet. The device joins the network, the user meets a condition (a code, a coupon, an acknowledgement), and only then is the internet opened.
On the box: This is the box's core job: it places the sign-in page in front of any device joining the guest network, opens the internet after verification and writes the session to the record.
CGNAT
Carrier-grade NAT, where the operator groups many subscribers behind one public IP address. A subscriber gets no address reachable from outside, which complicates systems that need inbound connections.
On the box: The box also works behind CGNAT because every connection goes outward from the box; no static IP is needed, including on 4.5G backup lines.
Client isolation
An access point setting that stops devices on the same wireless network from seeing or connecting to each other. On a guest network it prevents device-to-device attacks and accidental file-sharing exposure.
On the box: It is enabled on the access point; the box complements it by separating the guest VLAN from the business network.
Content provider
A person who produces, changes or supplies any kind of information or data on the internet. Someone publishing text on a website is a content provider; a business offering Wi-Fi is not.
Coupon
A single-use or group code entered on the portal to open the internet. Its validity period, device count and plan are set in advance; it suits cases where you prefer not to collect a phone number.
On the box: Coupons are generated in bulk and printed from the panel; usage rule, validity and plan are set in the coupon rule, and the coupon code is written to the session record.

D

Data controller (KVKK)
The natural or legal person who decides the purposes and means of processing personal data and is responsible for setting up and running the data filing system. On guest Wi-Fi this role belongs to the business itself.
On the box: Your business is the data controller; the records stay in the box, under your control, and go neither to the cloud nor to us.
Data processor
A natural or legal person who processes personal data on behalf of the data controller, under its authority. It acts on the controller's instructions and does not set the purposes itself.
On the box: Because guest phone numbers never reach the platform, hotspot-box.com does not process your access records; settle the position of your SMS provider in your contract with them.
Deletion (disposal)
Erasing, destroying or anonymising personal data whose retention period has ended. KVKK treats keeping data longer than necessary as a compliance problem too, and expects the disposal to be documented.
On the box: Daily archives older than 730 days are deleted automatically in the box, and the deletion is written to the audit trail.
Device remembering
Recognising the MAC address of a previously verified device for a set period so that no new code is requested. It improves the experience of returning guests and lowers SMS costs.
On the box: You set the period per plan; if MAC randomisation is on, recognition may fail and the guest signs in again with a code.
DHCP
The protocol that automatically gives a joining device its IP address, gateway and DNS details. Which device received which address is derived from this protocol's records.
On the box: The box is the DHCP server of the guest network; every address it hands out is the source of the internal IP allocation record.
DSAR / data subject request
A request from a person whose personal data is processed, asking the data controller what it holds about them or to delete or correct it. The controller is expected to answer within a reasonable time and in a documented way.
On the box: A request case is opened in the panel, the guest's sessions are located, the answer is documented and the record is anonymised when required.

H

Hash chain
A link formed when each record's (or each day's) digest also includes the digest of the one before. Changing one link makes every later link inconsistent, so retrospective alteration becomes visible.
On the box: Each day's manifest contains the previous day's digest; altering one day invalidates all later days and shows up in verification.
Hosting provider
A person who supplies or operates systems that host services and content on the internet, such as web hosting companies and platforms. A business offering Wi-Fi does not fall under this definition.

I

Idle timeout
How long a connected device can stay in a session without generating any traffic. When it expires the session closes and the address pool and capacity are freed for someone else.
On the box: Set separately in each plan; the recommended templates use between 10 and 30 minutes.
Internal IP allocation record
A mass-use provider's record of which device on its internal network was given which internal IP address, on which date and at what time. Within the Law 5651 framework this is the core record a mass-use provider is expected to keep.
On the box: The box collects these records in daily files, links them with a SHA-256 hash chain and obtains an RFC 3161 time stamp.

M

MAC address
The address given to every network card at manufacture that identifies a device on the local network. An IP address can change; the MAC address comes with the device, although modern phones can generate a random one per network.
On the box: It is the field that identifies the device in the session record; device remembering and MAC exemption rely on it too.
MAC exemption
An exception list that lets specific devices reach the network without seeing the portal. It is used for printers, POS terminals, smart TVs and IoT devices that cannot sign in on a screen.
On the box: These devices are added to the exemption list in the panel and pass without the portal; the exemption still appears in the record.
MAC randomisation
Phones and laptops hiding their real MAC address and using a different, random one for each network. It is on by default to make tracking harder and affects features that rely on recognising a device.
On the box: It can break device remembering; the guest either turns off the private address for this network or signs in again with a code, and the record is kept either way.
Mass-use provider
Under Law 5651, a person or business that lets people use the internet at a given place for a given time. Cafes, hotels, dormitories, hospitals, offices and shopping centres that open Wi-Fi to their guests meet this definition.
On the box: The box is designed to take on the verification, record keeping, integrity and retention duties that fall to this role in a single device.

N

NAT
Translating the private IP addresses of an internal network to a single public address as traffic leaves for the internet. An outside party sees only the public address; the NAT record says which internal device was using it at that moment.
On the box: The box performs NAT for the guest network and adds NAT details to the session record where present.
NTP
The protocol that synchronises a device's clock with trusted time servers. Records produced by a device with a drifting clock cannot be matched to events in the outside world.
On the box: The box syncs its clock with NTP and watches the drift; if it grows the panel raises an alert, and the offset against the time stamp service is reported.

O

OTP / SMS code
A one-time verification code that is valid for a short period. It arrives on the phone by SMS; entering it shows the number was in that person's hands at that moment.
On the box: It is the primary sign-in method; the code goes straight from the box to your SMS provider, and the number is stored encrypted in the box and shown masked in the panel.

P

pfSense
An open-source firewall and router operating system based on FreeBSD. It bundles captive portal, DHCP, VLAN and NAT functions and is widely used worldwide.
On the box: It is the operating system the box runs on; the box is a firewall but does not replace an enterprise UTM.
Port
A number that separates different applications on one IP address. Web traffic, e-mail and other services use separate ports; NAT relies on port mapping to tell internal devices apart.
On the box: When NAT details are recorded, the port mapping is part of that detail.
Privacy notice
The notice in which a data controller tells the data subject, before processing starts, who it is, for what purpose and on what legal basis it processes the data, to whom it may transfer it and what rights the person has.
On the box: The portal shows the privacy notice before a code is requested; the business prepares the text.

R

RADIUS / NAS
RADIUS is the central protocol used for authentication and session accounting. The NAS (network access server) is the device that asks the RADIUS server about a user, usually an access point or controller.
On the box: An access point or controller can connect to the box as a RADIUS client, so authentication and session records are gathered in the box.
Registered user
A person who signs in with a username and password set up in advance by the business; suitable for staff, long-stay guests or regular customers. The sign-in is still tied to an identity because the account was issued to a specific person.
On the box: An account is created in the panel and tied to a plan; sign-ins are written to the same access record as the other methods.
Retention period
How long a record is expected to be kept. Within the Law 5651 framework the period for internal IP allocation records is 2 years; KVKK expects the record to be disposed of once that period ends.
On the box: The box keeps records for 730 days; expired days are disposed of automatically.
RFC 3161 time stamp
The standard that defines combining a data digest with time information signed by an independent time stamp authority. The result says that this data existed no later than that moment and has not changed since.
On the box: The digest of each daily archive is sent to the time stamp authority; only the digest leaves the box, never the records, and the stamp file is kept in the archive.
Role-based access
Granting permissions by role rather than person by person. Reception can issue coupons but not view records; an administrator can verify and export, and so on.
On the box: Panel users are tied to roles; only an authorised role can see a guest's phone number, and even then masked.

S

SaaS
Using software on a subscription instead of buying it. Payment is monthly or yearly; when the contract ends so does the right to use it, which is why the question of where the data stays matters.
On the box: Hotspot-Box SaaS is a cloud service: no box or VM on site, the portal and SMS verification run in the cloud and no Law 5651 records are kept; for legal records use the Box or the Virtual Appliance.
Sender ID
The name or number shown on the recipient's phone as the source of an SMS. Commercial sender IDs are defined through the provider and go through an approval process.
On the box: Code messages go straight from the box to your own SMS provider account; the recipient sees the sender ID defined on your account.
Session duration
The longest a verified guest can stay online without signing in again. It is both a fair-use tool and the way to meet needs such as closing the network after hours.
On the box: Set per plan; the recommended templates range from 2 to 24 hours, and the guest signs in again when it expires.
SFTP/FTPS
Two protocols that transfer files over an encrypted channel. SFTP runs over SSH; FTPS is FTP protected by TLS. Both are used to move a second copy of the archive safely to another server.
On the box: A second copy of the signed archive can be sent automatically to a server outside the box over SFTP or FTPS.
SHA-256 digest
A cryptographic operation that produces a unique, fixed-length fingerprint of any file. Change a single character in the file and the digest changes completely; the file cannot be recovered from the digest.
On the box: The SHA-256 digest of every record file is kept in the manifest; verification recomputes the digest and compares it with the manifest.
SSID
The wireless network name that appears on a phone screen. One access point can broadcast several SSIDs and tie each to a different VLAN.
On the box: The guest SSID is mapped to the guest VLAN; the box is that VLAN's gateway to the internet.

T

Telemetry
Technical data a device sends so that its operating state can be monitored remotely: whether it is online, how full the disk is, which version is running, and so on.
On the box: The box sends only health data to hotspot-box.com (offline status, disk usage, time stamp service, SMS credit); it never contains guest data.
Time stamp authority (TSA)
An independent service that stamps a submitted digest with its own signature and clock under RFC 3161 and returns it. Its clock is independent of the business, so adjusting the box's clock does not change the stamp.
On the box: The box sends the daily digest to the TSA; if the service is unreachable the day waits in a queue, is stamped when the connection returns and shows in the panel as a pending day.
Traffic data
Details such as the parties, time, duration, type and data volume of a communication; it does not cover the content. The traffic data kept by access providers and the internal IP allocation record kept by a mass-use provider are different things.
On the box: The box keeps session time, internal IP, MAC and NAT details where present; it does not record visited sites, URLs or content.

V

Virtual appliance (VM)
A ready-made software image that runs as a virtual machine on an existing server instead of a physical box. No hardware is bought; the existing virtualisation platform is used.
On the box: The Virtual Appliance is the same software running on ESXi, Proxmox VE, Hyper-V and KVM.
VLAN
A way to create separate virtual networks over the same physical switches and cables. Guest, staff, POS and camera traffic flow over the same cable but cannot see each other.
On the box: Guest and staff traffic are carried on separate VLANs; the box is the gateway and firewall of the guest VLAN.

W

Walled garden
The list of addresses that can be reached before signing in on a captive portal. Limited destinations such as the portal page itself, the privacy notice and the business's website are added here.
On the box: The list of addresses reachable before sign-in is edited from the panel; your website or menu page can be added, for example.

For the context of the terms see the guides