Products

Two products for everyone who reaches your network

Captivo Portal for guests, employees and devices; Captivo Access for the vendors who come from outside. Used separately, managed with one account.

Cloud & On-premise

Captivo Portal

Guest WiFi and corporate network access. Branded sign-in page, SMS/e-mail verification, Law No. 5651 compliant logging; in the cloud or on your own server.

Explore
Open source · Cloud or self-hosted

Captivo Access

Time-boxed, recorded access for an outside vendor to one internal app or remote desktop. No VPN, no inbound port.

Explore

Where does each piece of data sit?

Each product comes two ways. What differs is not the features but who owns the infrastructure — these four flows show which step runs in whose territory.

Captivo Portal — hosted

A guest joins your network; verification and the identity record run on our infrastructure.

  • Your equipment asks RADIUS to authenticate and serves the portal page itself.
  • Setup happens on the network side — you install no server.
  • The Law No. 5651 traffic log stays on your firewall or SIEM; Captivo supplies the identity record. Collecting the traffic log in Captivo needs the Log Server module, which runs only on-premise.
  • The 802.1X and Directory (AD/LDAP) modules do not run in this model either.
Captivo Portal — on-premise

The same flow, entirely in your data centre. No guest data leaves it.

  • The feature sets are not identical: 802.1X, Directory (AD/LDAP) and the Log Server run only here.
  • Guest WiFi, the verification methods and Law No. 5651 identification are the same in both models.
  • You own updates and backups. None of your guest or operational data reaches us; the only outbound call is the daily licence check (licence key, installation id and version).
Captivo Access — hosted

A vendor signs in from the browser; the connector in your network dials out to meet them.

  • No inbound port is opened in your firewall; the connector establishes the link.
  • Session recordings are encrypted on the connector's own disk, and the key never leaves that machine.
  • Of the recordings, all we hold is an index row: who, which resource, when. The content never arrives.
Captivo Access — self-hosted

The same flow with the console and data plane yours too. No data reaches us at all.

  • Free under Apache-2.0; nothing reaches us, identity and directory data included.
  • Session features match the hosted edition; what differs is who runs the console, and sign-in is local.
  • In this model Captivo is not a data processor.

Captivo Portal modules

Beyond the guest WiFi portal: enterprise network access, multi-factor authentication, corporate identity and legal logging -- all managed from one panel.

On-premise

802.1X Enterprise Network Access

Port-based wired and wireless network access control with username/password. Group-based VLAN, MAC-Bypass, account lockout.

Explore
On-premise

Directory (AD/LDAP) Login

Employees sign in to the portal and the 802.1X network with a corporate domain account. LDAPS + your own CA certificate.

Explore
On-premise

Log Server

Firewall syslog collection, IP-to-guest correlation, daily Ed25519 signature, 2-year retention.

Explore

Frequently Asked Questions

What is the difference between Captivo Portal and Captivo Access?
They do different jobs. Captivo Portal is for guest WiFi and corporate network access -- guests, employees, devices. Captivo Access is for letting outside vendors reach your internal systems, in place of a VPN. Either can be used on its own, and one account reaches both.
Which one is cloud-based, and which is on-premise?
Captivo Portal is available in both models; of its modules, 802.1X, Directory (AD/LDAP) and the Log Server run only on-premise. Captivo Access is available both ways too: hosted by us, or on your own server. In either case the connector runs inside your own network.
Do the Portal modules work together?
Yes, the modules below are all part of Captivo Portal and are managed from one panel. In an on-premise deployment, guest WiFi, 802.1X, Directory and the Log Server can run together; the cloud offers guest WiFi and the verification methods.
Do I need to replace my existing hardware?
In most scenarios, no. We work with firewalls and access points that support RADIUS (pfSense, OPNsense, MikroTik, FortiGate, Cisco Meraki, Ruijie); UniFi devices connect via the Captivo Connector.
How do I get started?
For cloud products, sign up for free on the registration page; for on-premise deployment, see the setup guide on the On-Premise page and the 15-day free trial.
READY?

Try the right product for you — free

Start right away with the cloud edition, or run it on your own infrastructure with an on-premise deployment.

Start Free Explore On-Premise