Captivo On-Premise
Run guest WiFi management on your own server. All data stays with you, works offline (air-gapped), single-command Docker install.
$ chmod +x docker/onprem/install.sh
$ ./docker/onprem/install.sh
✓ Secrets generated (.env.onprem)
— Back up DATA_ENCRYPTION_KEY securely
✓ Starting services...
✔ Container captivo-postgres Started
✔ Container captivo-migrator Exited
✔ Container captivo-radius Started
✔ Container captivo-web Started
✓ Installation complete!
Panel: http://localhost:3000
The setup wizard will guide you on first launch.
A fully configured stack, on your own server.
Captivo ships with every production-ready component preconfigured — no separate installs, version juggling or wiring. One command, a running stack.
Next.js
Node.js
TypeScript
Go
PostgreSQL
Prisma
FreeRADIUS
Docker
Caddy
Tailwind CSS
Let's EncryptFeatures the cloud doesn't have
The on-premise edition unlocks capabilities that only exist when your data stays with you. These are not available in the SaaS version.
5651 Log Server
Captures every device's raw syslog and seals each day with a hash-chain + Ed25519 signature — the 5651 legal record, whether or not the device is recognized. Recognized vendors (pfSense, OPNsense, MikroTik, FortiGate, Cisco Meraki, UniFi, Ruijie) are additionally parsed into searchable events and correlated with guest sessions. 2-year retention. On-premise only.
Full Data Sovereignty
Logs, guest records and signed evidence never leave your server. No third-party cloud — the physical location of your data is entirely under your control.
Zero Telemetry
No usage data, analytics or phone-home. The system emits no signals to the outside world.
Offline License
License validation needs no internet and works fully on air-gapped networks. The .lic file is verified locally.
Unlimited Local Retention
Retention period and volume are bound only by your own disk. No per-record fees or cloud quotas — keep as much as your hardware allows.
Signed Evidence Chain
Each day's logs are signed with your Ed25519 key and linked by a SHA-256 hash-chain. Tamper-evidence you can prove in an audit.
SaaS or On-Premise?
The same core product; what differs is where it runs and the on-premise-only capabilities.
| Feature | SaaS (Cloud) | On-Premise |
|---|---|---|
| Shared Foundation | ||
| Branded captive portal | ||
| RADIUS authentication | ||
| SMS/SMTP verification + vouchers | ||
| Analytics & scheduled reports | ||
| KVKK & 5651 guest logging | ||
| Multi-branch & role management | ||
| Operations | ||
| Setup & maintenance | Managed by Captivo | You (single-command Docker) |
| Updates | Automatic | On your schedule |
| Data location | Captivo cloud | Your own server |
| Modules | ||
| VPN & RADIUS MFA | — | |
| 802.1X enterprise network access | — | |
| Directory (AD/LDAP) login | — | |
| On-Premise Only | ||
| Air-gapped (offline) operation | — | |
| 5651 Log Server (syslog + signed evidence) | — | |
| Signed evidence chain (Ed25519) | — | |
| Zero telemetry | — | |
| Unlimited local retention | — | |
| Offline licensing | — | |
Have licensing questions? Get in touch.
Why On-Premise?
For organisations that cannot send data to the cloud, require network isolation, or need full control.
Data Sovereignty
Guest records, MAC addresses and all log data stay exclusively on your server. Nothing is sent to Captivo cloud.
Compliance-Ready
Logs stay in your own infrastructure, personal data is encrypted at rest, automatically purged at retention end. Audit-ready exports included.
Air-Gapped / Offline Networks
Works fully in networks with no internet access. Docker images can be bundled offline and transferred via USB or secure file transfer.
Single-Command Install
install.sh generates all secrets, starts the Docker containers and brings the panel up in minutes — no manual config needed.
Same Product, Your Server
Captive portal, RADIUS authentication, SMS/SMTP integration — all the core features of the SaaS edition on your own infrastructure — plus on-premise-only capabilities such as the 5651 log server.
Enterprise Compliance
Designed for organisations that cannot send data to the cloud due to ISO 27001 requirements, corporate IT policy or sector regulation.
Up and Running in 3 Steps
A Docker-ready Linux server is all you need. install.sh handles the rest.
Copy files to your server
Copy the install package (docker/ folder) to your Linux server. Docker Engine 24+ and openssl are all you need.
Run install.sh
One command: auto-generates all secrets, starts PostgreSQL + FreeRADIUS + the web panel.
Follow the setup wizard
Open :3000 in your browser. The 10-step wizard configures admin account, server address, portal design, RADIUS and licensing.
Licensing
A 15-day free trial starts automatically after installation with all features enabled. After the trial, upload the .lic file obtained from your vendor in the panel to activate your licence. Air-gapped (offline) networks are fully supported — no internet connection is required for licence validation. Contact us with any licensing questions.
Frequently Asked Questions
Does it work on an air-gapped (offline) network?
Yes. Docker images are pre-packaged on an internet-connected machine (build-offline-bundle.sh) and transferred to the target machine via USB or secure file transfer. In offline environments, Let's Encrypt certificates cannot be obtained — use your corporate CA certificate or HTTP for internal testing.
Where does my data go?
Nowhere — it stays entirely with you. In an on-premise installation, no communication is made with Captivo cloud servers. All guest records, MAC addresses and log data are stored exclusively in your own PostgreSQL container.
What hardware is required?
A Linux server running Docker Engine 24+ (Ubuntu 22.04+, Debian 12+, or RHEL 9+ recommended). At least 2 GB RAM and 10 GB disk space; 4 GB RAM and 20 GB+ disk recommended for production.
How is this different from the SaaS version?
In the SaaS version, the panel and data are hosted in Captivo's cloud — ideal for fast onboarding. In the on-premise version, all components run on your server: designed for organisations requiring data sovereignty and network isolation. The core feature set is the same; the on-premise edition additionally unlocks on-prem-only capabilities such as the 5651 log server, offline licensing and a signed evidence chain.
How long does installation take?
With prerequisites in place (Docker-ready Linux server), the install.sh script completes in 5–10 minutes. The 10-step setup wizard takes an additional 15–20 minutes. Most installations are done in under 30 minutes.
How does licensing work?
A 15-day free trial starts automatically after installation. After the trial, upload the .lic file obtained from your vendor in the panel to activate your licence. Air-gapped licence validation requires no internet connection.
Get started with Captivo On-Premise
Install in one command, try free for 15 days. Your data is always yours.