Portalknowswhojoinsyournetwork.Accessknowswhoentersyoursystems.Bothonrecord,bothinoneaccount.
Manages guest and corporate WiFi access: a branded login screen, the verification you choose and the record the law requires.
Opens a single app to an outside vendor — not your network. Time-boxed and recorded. No VPN, no open ports, no shared passwords.
Every guest is tied to a verified identity. “Who and when” is clear in any audit.
Personal data is deleted automatically and irreversibly when retention ends.
MAC addresses, API keys and passwords are stored encrypted.
TOTP-based second factor for admin logins.
Every critical action is written to an audit log that is never edited afterwards.
All traffic encrypted; strict security headers and CSP.
Portal as an on-prem install, Access as Apache-2.0 open source. Your data stays with you, even air-gapped.
One location. No credit card.
Captivo works fully with pfSense, OPNsense and MikroTik. FortiGate, Cisco Meraki, Ruijie/Reyee and UniFi are also supported; UniFi connects through the Captivo Connector (no RADIUS required), while the others integrate over RADIUS with a branded portal template. Any captive portal system that supports RADIUS can be integrated.
They do different jobs. Captivo Portal is for guest WiFi and corporate network access — guests, staff, devices; it governs who gets onto your own network. Captivo Access is for third-party vendors reaching your internal systems, and it replaces a VPN: time-boxed, passkey-verified and recorded access to a single application. They can be used independently, and one Captivo account signs in to both.
Yes. Guests can be verified by phone number, e-mail, voucher, a local user account, sponsor approval or a hotel system (PMS); whichever you use, who connected and when is recorded in line with Turkey's Law No. 5651. In the cloud (SaaS) edition, traffic logs stay in your own firewall or SIEM — Captivo doesn't store traffic data; it provides the identity verification records in a compliant format. In the on-premise edition, you can optionally send device logs to Captivo's Log Server module: logs are collected on your own server and retained for 2 years with a daily signed evidence chain.
Two steps: entering the RADIUS settings on your firewall and uploading the portal HTML. How long that takes depends on your access to the firewall and how fast your network admin works -- there is no wait on our side. Step-by-step setup documentation is available for each hardware platform.
Yes! İleti Merkezi, Netgsm and Twilio integrations are ready. Connect your own account to use your SMS credits and keep benefiting from your corporate agreements.
The free plan covers one location (1 NAS device) and 20 guests at the same time; there is no ceiling on total guest records or on the SMS you send. If you have more than one site, the Pro and Enterprise tiers cover more locations — payments are not open yet, so we raise accounts by hand; see the Pricing page. For each location you can define a separate portal design, different verification methods and custom settings.
Yes, the on-premise version is live now! It installs with a single Docker command, keeps all data on your own server, and works independently of the internet (LAN / air-gapped). A 15-day free trial is included — visit the /en/on-premise page for details.