HotSpotVU is currently available to businesses in Canada only.
Guide · Architecture

Implementation candidate · managed-site validation required

Keep identity, permission, and observation distinct.

The service links an enrolled device to a local network decision while preserving separate manufacturer, provider, and business responsibilities.

Developer overviewQuickstartDownload kitOpenAPI 3.1

Integration at a glance

Identity

EAP-TLS establishes which enrolled credential is present.

Permission

The site decides whether that device can use its network.

Observation

Recent measurements describe connectivity, not application health.

Target supported hardware and an enabled site. Your application retains its own health and recovery responsibilities.

Device identity

Each device has a stable registry identity and its own certificate. The private key stays with the device or its protected manufacturing environment. MAC addresses and browser descriptions are not authoritative manufacturer identity.

Wi-Fi endpoint credentials, satellite infrastructure credentials, and gateway cloud-management credentials serve different roles and must not be reused interchangeably.

Authorization and enforcement

EAP-TLS establishes the presented credential. The authenticated infrastructure identifies the site. The policy service determines whether that device has permission there.

A recognized device without site permission creates a pending request and receives no ordinary Internet access. On approval it retries authentication and receives the applicable local network policy.

Data and control paths

Device application traffic travels through the local network and its upstream Internet connection. Device status and policy events travel over authenticated management paths.

The partner API manages enrollment, permissions, and observations; it is not a tunnel that supplies Internet connectivity where no upstream service exists.

Network separation

IoT clients use an isolated network with independent capacity allocation. Satellite backhaul and management use restricted infrastructure access. Existing guest service remains separate.

Network features are disabled by default and enabled per qualified site. Established sessions can retain installed policy within its validity period during control-service interruption; new authentication fails closed and retries.

Diagram and flow

The device authenticates through an enabled site; the authentication service checks identity and site policy; dashboards receive scoped observations.
The device authenticates through an enabled site; the authentication service checks identity and site policy; dashboards receive scoped observations.
  • DEVICE

    Enrolled IoT device

    Individual certificate. Its private key stays on the device.

    EAP-TLS → HotSpotVU gateway
  • CUSTOMER SITE

    HotSpotVU gateway

    Admit approved devices. Apply isolation and local capacity controls.

    Site uplink → Your Internet servicesIdentity + policy → Verify and authorize
  • APPLICATION TRAFFIC

    Your Internet services

    Use the site’s existing uplink to reach the device application.

  • IDENTITY & POLICY

    Verify and authorize

    EAP-TLS identity checks and the business’s per-device permission.

    Scoped events → Dashboard and API
  • SCOPED OPERATIONS

    Dashboard and API

    Fleet observations, connection events and freshness timestamps.

Open full-size SVG ↗Download SVGMermaid source
Read the diagram description
  • DEVICE — Enrolled IoT device. Individual certificate. Its private key stays on the device.EAP-TLS → HotSpotVU gateway.
  • CUSTOMER SITE — HotSpotVU gateway. Admit approved devices. Apply isolation and local capacity controls.Site uplink → Your Internet services.Identity + policy → Verify and authorize.
  • APPLICATION TRAFFIC — Your Internet services. Use the site’s existing uplink to reach the device application.
  • IDENTITY & POLICY — Verify and authorize. EAP-TLS identity checks and the business’s per-device permission.Scoped events → Dashboard and API.
  • SCOPED OPERATIONS — Dashboard and API. Fleet observations, connection events and freshness timestamps.
← QuickstartFactory provisioning →