How RadiusOne protects your business

01

Each ISP's data is kept apart

Another ISP on RadiusOne cannot see or change your customers, sales or wallet.

• Every database query on an ISP's data must name that ISP. The exceptions are a reviewed list of system queries, such as scheduled jobs, RADIUS logins and payment callbacks.
• An automatic check runs before every change to the code is saved, and rejects any other query.
• Most dashboard work runs under a database role that can only see that one ISP's rows. Money movements and logins run on a separate, reviewed path.
• An automated test tries every dashboard operation on another ISP's data, and each one must be refused.

02

Roles and permissions

Everyone has their own login and a role, and sees only what their job needs.

• Roles for your team: ISP admin, technician and agent.
• Withdrawals, and inviting or changing members, ask for the password again.
• An account locks after five wrong passwords, for one minute at first and up to 15 minutes on further failures. Login attempts from one address are limited too.
• Passwords are stored only as a one-way hash. Customer passwords and router keys are stored encrypted.
• Payout numbers are verified, and fee rules set, by RadiusOne staff, never by the ISP itself.
• RadiusOne staff can open your ISP to help you. The audit log records every change made in the dashboard, staff included, and the dashboard cannot edit or delete it.

03

Secure router connections

Logins, usage and control between your router and RadiusOne travel only through an encrypted tunnel.

• WireGuard on RouterOS 7, SSTP on RouterOS 6, with credentials for each router.
• Logins, usage records, cut-offs and the platform's own access to the router all travel inside the tunnel. A router that tries to connect without it is refused.
• The onboarding command expires after 24 hours, or as soon as the router has connected.
• On RouterOS 7.20 and newer the router checks the platform's certificate before it runs anything.

How the MikroTik connection works

04

Backups, recovery and where your data is

If the server is lost, we can bring your data back to any point in the last four weeks.

• Backups are encrypted before they leave the server, and stored with Cloudflare, placed in Western Europe, a different company from the server.
• A full backup every week, a smaller one every day, and the changes in between as they happen.
• We have restored a full backup onto a separate server to prove it works. We are emailed if a backup fails.
• The platform runs on a server in Johannesburg, South Africa. The Privacy Policy lists every provider that handles your data.

Read the Privacy Policy

05

Payment records that reconcile

Every shilling in your wallet can be traced to the sale or payment it came from.

• Every movement of money is a double entry that must balance. No one, RadiusOne staff included, can change or delete an entry through the platform. A mistake is corrected with a new entry and a written reason.
• Each wallet entry names what it came from: a sale, invoice, top-up, withdrawal, fee or correction.
• Each mobile money payment keeps its pawaPay transaction ID.
• Your wallet is credited only after RadiusOne has checked the payment's status with pawaPay itself.

How money reaches your wallet

06

Support and reporting a problem

Tell us on WhatsApp or by email. For login problems, the dashboard often shows the reason first.

• Tell us your ISP name and, for a login problem, the customer's account or voucher code.
• The dashboard's Login failures page shows why each login was refused.
• RadiusOne can email you when a router goes offline, or runs high on CPU, memory or storage.
• We are emailed when a backup or a database update fails, or when a part of the platform keeps crashing.

07

Leaving RadiusOne

Your customers, invoices, payments and wallet entries are your records.

• Voucher sales export from the dashboard as a spreadsheet. Customers, invoices, payments and wallet entries we prepare for you on request.
• Withdraw your wallet balance before you go.
• We delete or return your customers' data when you ask, except payment records, kept for 10 years as the law and our payment provider require, and the audit log. Copies in backups expire within weeks.
• Removing the RadiusOne settings from your routers is done by hand for now, and support helps you with it.