For security & IT
Guest Wi‑Fi access control without routing user traffic through Tagnect.
Tagnect coordinates with your network controller to issue and manage temporary guest credentials. The venue's network keeps carrying user traffic; Tagnect only makes access decisions.
Topology
Your operations network never goes through Tagnect
Tagnect manages the guest network only. Checkout counters, card terminals, internal systems and the venue's own devices stay on their own network, with a fixed key, which Tagnect neither changes nor depends on. If something goes wrong on the guest network, the venue keeps selling. Read the critical network isolation documentation.
- Isolated operations networkPOS systems, card terminals, cameras and internal systems stay on a separate SSID with a fixed key, outside password rotation.
- Tagnect on the guest network onlyRotating passwords, tags and OTPs apply only to transient guests.
- If the cloud is unavailableThe operations network is unaffected and guests already connected keep browsing; only new tag sign‑ins wait for the service to return.
- Load‑testedStress tests with bursts of near‑simultaneous requests, with no errors or instability. Guest traffic never passes through Tagnect's servers.
Control plane and data path
Orchestration, not interception
Tagnect makes access decisions and talks to the network equipment through its API or the local connector. It never acts as an inline gateway for guest traffic.
- No inline choke pointTraffic never routes through Tagnect — no single box to overload or compromise.
- Outbound‑only connectorThe local connector opens only outbound connections and signs each device‑identity proof (HMAC‑SHA256).
- Hardened administrationOperator access uses JWT, MFA/TOTP and IP allow‑lists, with an append‑only audit ledger.
- Data minimizationDevice MAC addresses are deleted 15 minutes after the session or OTP expires.
Credentials and validation
Time‑scoped by design
NTags hold time‑scoped credential data that the app selects offline. The server validates the registered tag, its generation and the time context; managed controllers add device validation and access‑state controls.
- Rotating credentialsPasswords change by time block; a copied credential expires with its block and grace period.
- Restricted until validatedOn managed controllers, a device can stay in a restricted state until the server validates it.
- Delegated devicesA laptop receives a single‑use passcode from an already‑validated phone, with its own identity.
Data and privacy
The data belongs to the venue
Tagnect is designed to process only what is needed to grant access. Guests don't sign up, we don't build profiles and we don't use data for advertising. The venue sets the rules and is the controller of the access data; Tagnect acts as processor, in line with the GDPR and Brazil's LGPD.
- No guest sign‑upNo form, account, e‑mail or phone number: the guest taps the phone and connects.
- Minimization by defaultThe MAC address is deleted 15 minutes after the session ends; the tag‑read history after 1 day (configurable up to 45).
- Venue governanceThe venue decides retention and access rules; Tagnect processes the data only to operate the service.
- For sensitive sectorsClinics, law firms, residential buildings and corporate networks offer guest Wi‑Fi without creating a new database of personal data.
Compatibility
Multi‑vendor integrations
Tagnect is not tied to a single vendor: it integrates with the controller or router already installed. Session duration, time windows, grace periods, groups and OTP access work on every available platform below. Traffic controls follow each device's specifications.
| Platform | Credential model | Session, time windows, grace, OTP | Traffic controls (bandwidth, quota, VLAN, isolation, device limits) |
|---|---|---|---|
| Ubiquiti UniFi | Per‑group private PSK (PPSK) | ✓ | According to the controller |
| TP‑Link Omada | Per‑group PSK / portal | ✓ | According to the controller |
| Cisco Meraki | Identity PSK (iPSK) + group policies, straight in the Meraki cloud (no connector) | ✓ | According to the controller |
| MikroTik RouterOS 7.17+ (wifi package) | Multiple PSKs per SSID (multi‑passphrase); connector inside the router | ✓ | Networks isolated by bridge and firewall; rotation, expiry and disconnection; bandwidth and quota evolving |
| OpenWrt routers with the Tagnect controller | Rotating PSK (multiple keys) | ✓ | Rotation, expiry and deauthentication; finer controls by model |
| Juniper Mist / HPE Aruba | Per‑user PSK (Mist PSK / MPSK) | In development | In development |
Vendor details on the Integrations page. Confirm controller model and firmware with our team before a deployment.
Glossary
Technical terms used on this site
To avoid ambiguity with IT and telecom teams, we use these terms the same way across the site.
| Term | Also known as | In Tagnect |
|---|---|---|
| Access point (AP) | Wireless access point | The radio that broadcasts Wi‑Fi. Tagnect does not replace access points. |
| Controller | WLAN controller | The system that manages the access points (UniFi Network, Omada, Meraki dashboard). Tagnect integrates with it through its API. |
| SSID | Network name | The Wi‑Fi network name the guest sees on the phone. |
| Virtual SSID (VAP) | Virtual AP | An additional network on the same radio. On MikroTik, the installer creates one virtual SSID per network on each radio. |
| PSK, PPSK, iPSK, MPSK | Pre‑shared key; private, identity or multiple PSK | Per‑group WPA2 passwords that Tagnect rotates automatically each time block. |
| VLAN | Virtual LAN | Separates each group's traffic, depending on the controller. |
| Client isolation | AP isolation | Prevents devices on the same network from seeing each other. |
| Captive portal | Splash page | A login page at the network entrance. Tagnect does away with the captive portal: guests never type anything on a web page. |
| Walled garden | Restricted network | Limited access that only allows downloading the Tagnect app. |
| Deauthentication | Deauth | Disconnecting a device from the access point, used at the end of a time window and on revocation. |
Security claims and scope
Risk reduction, stated honestly
Time‑scoped credentials reduce the useful life of a copied credential, and removing the captive portal removes a phishing vector. Tagnect does not replace endpoint protection, secure transport, a properly configured firewall or the remediation of a compromised gateway.
- Kills the captive portalNo web login page for guests to type into.
- Removes weak admin panelsManagement runs under JWT, MFA/TOTP and IP allow‑lists.
- Devalues stolen credentialsRotating, time‑scoped passwords; on managed controllers they alone grant only a restricted state.
Patent pending — BR 10 2026 017581‑1
Review a deployment with our technical team
Share the controller model, firmware, guest network design and access requirements you want to validate.