Finance
Bank branches and corporate lobbies
Internet for the customer waiting in line, and an information screen rather than an advert after login. Strict separation from the corporate network, with records an auditor can read.
- Separate from corporate LAN
- Info page after login
- Role-based access, audit log
- One box per branch
Internet in the lobby, zero contact with the core network
A customer waiting in a branch looks at their phone, and if mobile data is weak, glares at the queue display. Giving them internet is easy. Giving it to them without bringing them an inch closer to the bank's internal network is the requirement, and it is the first question your information security team will ask.
The second question is compliance. Every connection opened to a guest creates a record. When the auditor arrives, saying 'we have records' is not enough; you need to show the records have not changed and answer who looked at them and when.
The third is communication. A branch lobby is not a billboard. The page a customer sees after login should not be a campaign poster but information: opening hours, public holidays, a new branch. It is expected to be set centrally and to be identical from branch to branch.
Law 5651 and corporate audit for branches
A branch that opens internet access to its customers is a mass-use provider under Law 5651. The law expects internal IP allocation records to be kept, protected with a timestamp and retained for 2 years. Whether financial regulation adds further conditions for a guest network is a matter for your compliance team; the box delivers the records, audit log and role separation ready to use.
This page is not legal advice; confirm your obligations with your legal adviser.
Setting up in a branch
- 1
The box sits behind the branch's existing modem and switch, at the exit of the guest VLAN; branch network equipment stays, with no extra licence on the access point.
- 2
The guest SSID reaches the internet only through the box; there is no path between it and the branch LAN, ATMs or payment terminals. The box is a pfSense firewall and does not replace the corporate UTM.
- 3
Client isolation is switched on at the access point, so two customers in the lobby cannot see each other.
- 4
If the queue display or digital signage is on the guest network, it connects through a MAC exemption and never sees the portal.
- 5
The portal carries the corporate identity, and the post-login redirect points to the bank's announcement page. Each branch's box is monitored for licence and health from a single platform.
Login for customers
Sign-in method
- SMS code
In a branch, one clear route is enough: the SMS code. The customer enters their number, receives the code, types it in. Our recommended 'conference' template: 5/2 Mbps, 4-hour session, 10-minute idle timeout, 1 device, 500 MB per day. Rather than a scheduled shutdown after hours, the session length is kept short, so no session is left open once the branch closes.
Ready-made plan templates
Speed, session and device count are set per plan on the box, independent of the access point brand. The values below are our own lab recommendations and can be changed in the panel.
- Recommended for this sector
Conference
Events, fairs, waiting lounges, cinemas, bank branches
- Speed (down / up)
- 5 / 2 Mbps
- Session
- 4 hours
- Idle timeout
- 10 min
- Devices
- 1
- Daily quota
- 500 MB
- Remembered device
- Off
Low speed and one device for many simultaneous users; capacity 250 concurrent devices.
Standard
Cafés, restaurants, shops, bakeries, salons, gyms
- Speed (down / up)
- 10 / 5 Mbps
- Session
- 2 hours
- Idle timeout
- 15 min
- Devices
- 2
- Daily quota
- 1 GB
- Remembered device
- Off
Keeps tables turning; a guest who wants more gets a coupon from the till.
Staff-guest
Offices, factories, office towers, logistics, tutoring centres
- Speed (down / up)
- 20 / 10 Mbps
- Session
- 10 hours
- Idle timeout
- 30 min
- Devices
- 3
- Daily quota
- None
- Remembered device
- 30 days
Registered users or coupon groups; separate groups for suppliers and subcontractors.
Extended stay
Hotels, serviced apartments, dormitories, hospitals, residential complexes
- Speed (down / up)
- 15 / 5 Mbps
- Session
- 24 hours
- Idle timeout
- 30 min
- Devices
- 3
- Daily quota
- 5 GB
- Remembered device
- 7 days
No new code every day; in dormitories the remembered window can span the whole term.
What is recorded
- Verification detail: phone number stored encrypted, visible masked to an authorised role only
- Device MAC address
- Assigned internal IP and NAT details where applicable
- Session start and end times
- Audit log of who viewed what in the panel
What is not recorded
- Customer number, account or transaction details
- Websites visited and URLs
- Message and call content
- Location data
Example scenario
Example scenario: a financial institution with many branches
- Problem
- Guest Wi-Fi is switched off in the branches because information security sees a risk to the internal network. Marketing wants an information screen in the lobby. Compliance asks who would keep the records and what would be shown to the auditor.
- Solution
- In pilot branches the guest SSID was moved to its own VLAN and connected to the box. The 'conference' template was applied. The portal was branded with the corporate identity and the post-login redirect pointed to the bank's announcement page. In the panel, compliance was given the record verification and export role, and branch IT a status-monitoring role only.
- Outcome
- Guest traffic never touches the branch network. The auditor verifies the signed archive from the panel and takes it as a ZIP. The announcement page is updated centrally, and new branches repeat the same setup.
An illustrative example; no real business is named.
Frequently asked
Are the guest network and the branch network really separate?
The guest SSID travels on its own VLAN and leaves only through the box; the box is the firewall for that VLAN and no rule is opened towards the internal network. Client isolation at the access point also keeps customers from seeing each other. The box does not replace your corporate UTM; your existing security layers stay in place.
Is the post-login page an advert?
No, you decide what it shows. The post-login redirect points to the bank's announcement page: opening hours, holidays, new branch information. Short announcements and surveys can also be shown on the portal itself. When the central page changes, every branch shows the change at once.
What do we show the auditor?
A one-click verification report and a ZIP archive from the panel: day folders, record files, the SHA-256 chain manifest and the RFC 3161 timestamp file. The archive can be verified with openssl, independently of the box. Who viewed what, and when, is kept in the panel's audit log.
Can branch staff see the customer's phone number?
No. The number is stored encrypted on the box and shown masked in the panel; only the role you authorise sees even the masked form. Giving branch IT permission to monitor connection status and alarms alone is enough.
How do we manage dozens of branches?
One box is installed per branch; licence, health and SMS credit are monitored from one place on the hotspot-box.com platform. A box that goes offline, fills its disk or cannot obtain a timestamp triggers an e-mail, Telegram or webhook alarm. If you prefer no hardware in the branch, the same software runs as a Virtual Appliance in your existing virtual environment.
A 20-minute demo for your own venue
Let's work out your device count and sign-in method together.
Request a demo