KIWIRE WIFI SECURITY
Retire the shared office WiFi password
Give every employee their own secure WiFi login with WPA2 and WPA3 Enterprise, built-in RADIUS and certificates. Connect Microsoft 365, Google Workspace or Active Directory, and access ends the day someone leaves.
No RADIUS server to install. Works with the access points you have.
WPA3
5
3
38
Enterprise ready
directory types
EAP methods
controller brands
Office WiFi
WPA3-Enterprise
Signed in as
Certificate
Valid until Oct 2027
EAP-TLS
Microsoft Entra ID
j.tan left Microsoft 365
WiFi access removed · device disconnected
Guest approved by host
Visitor network · 4 hours
WPA3-Enterprise
802.1X · built-in RADIUS
Works with the WiFi equipment you already have
Cisco · Cisco Meraki · Aruba · Ruckus · MikroTik · Ubiquiti · Huawei · Fortinet · Juniper Mist · TP-Link · Ruijie · Cambium · Peplink · Zyxel · EnGenius · Nomadix · SonicWall · H3C · pfSense
THE PROBLEM
One shared password puts the whole office at risk
Ex-staff still connect
The password leaves with every employee, contractor and visitor who ever had it.
It ends up on a sticky note
Shared passwords get written down, forwarded and posted in group chats.
No idea who is on the network
Every device looks the same, so you cannot tell staff from strangers.
Changing it breaks everyone
So nobody changes it, and a leak stays open for years.
HOW IT WORKS
Secure WiFi in three steps
1
Connect your directory
Microsoft Entra ID, Google Workspace, Okta, SAML or LDAP / Active Directory. Or create accounts in Kiwire.
2
Point your access points at Kiwire
Add Kiwire as the RADIUS server. MikroTik, FortiGate and UniFi get a ready-made setup.
3
Staff enrol their own devices
They sign in once on your enrolment page and install a profile on iPhone, Mac, Android or Windows.
FEATURES
Enterprise WiFi security, sized for any business
WPA2 & WPA3 Enterprise
• Built-in RADIUS, nothing to install
• EAP-TLS, PEAP and EAP-TTLS
• Each person encrypted separately
• WPA3 and mixed WPA2/WPA3 networks
Self-service enrolment
• Your branded enrolment page
• Signed profiles for iPhone and Mac
• Android and Windows profiles
• No IT visit for every new phone
Device control
• Limit devices per person
• Approve printers, TVs and IoT
• Disconnect any device instantly
• WiFi on a schedule by the hour
Sign in with work accounts
• Microsoft Entra ID (Microsoft 365)
• Google Workspace
• Okta and any SAML provider
• LDAP and Active Directory
Leavers lose access
• Daily check against Microsoft 365 and Google
• Suspended or deleted users removed
• Live sessions disconnected
• A safety limit stops mass removals
Network policy
• Speed, data and time per group
• Separate staff, guests and devices by VLAN
• Different rules per site or SSID
• Passpoint and OpenRoaming roaming
Certificates made simple
• Built-in certificate authority
• A certificate per person or device
• Revoke a lost laptop in one click
• Expiry tracked for you
Guests kept separate
• Guest portal on its own network
• Visitors approved by their host
• Time-limited vouchers for contractors
• Consent recorded for every guest
Visibility and audit
• Who connected, when and on what
• Failed sign-ins and their reasons
• Tamper-evident admin audit trail
• Alerts when something looks wrong
COMPARE
Shared password or Kiwire?
KIWIRE
SHARED PASSWORD
Each person has their own login
✓
–
Access ends when someone leaves
✓
–
You can see who is connected
✓
–
Each connection encrypted separately
✓
◐
Remove one lost device without affecting anyone else
✓
–
Guests and staff kept apart
✓
◐
PASSPOINT & OPENROAMING
Sign in once. Connected everywhere.
Guests install a profile one time. From then on their phone joins your WiFi on its own, and any other OpenRoaming venue around the world, with encryption and no sign-in page.
iPhone, iPad, Mac · Android · Windows
Head office · Branch · Warehouse · Campus · Airport
WHO IT IS FOR
From a 10-person office to a multi-site company
SMEs
Cloud-hosted, no server to run, set up in an afternoon.
Corporates
Directory sign-in, many sites, audit trail and VLANs.
Schools and campuses
Students and staff on their own logins, guests apart.
Healthcare
Clinical staff, patients and visitors on separate access.
Co-working spaces
Each member and company with their own secure access.
Government and finance
Run it on your own servers if your policy requires it.
SECURITY
Security designed around ISO 27001
Every control below maps to ISO/IEC 27001 Annex A, so your security review starts with answers instead of questions.
Two-step admin sign-in
Every admin uses an authenticator app. No outside service, nothing to buy.
A.9.4.2
One session per admin
A second sign-in with the same account ends the first, so a stolen session cannot stay hidden.
A.9.4.2
Tamper-evident audit trail
Every admin change is recorded with who, when and from where, and each record can be checked for tampering.
A.12.4.2
Hardened API keys
Keys are stored as hashes, limited to the addresses you allow and rate-limited.
A.9.4.1
Automatic sign-out
Idle admin sessions close on their own after the time you set.
A.11.2.8
Separate database per customer
Your guests and settings never share a database with anyone else. PDPA and GDPR consent, export and erasure built in.
Controls mapped to ISO/IEC 27001 Annex A.
FAQ
Questions people ask before they start
Do I need to run my own RADIUS server?
No. RADIUS is built into Kiwire. You point your access points at it and that is all.
Which access points work?
Any access point or controller that supports WPA2 or WPA3 Enterprise with an external RADIUS server, including Cisco, Aruba, Ruckus, Ubiquiti UniFi, MikroTik, Fortinet, Huawei and TP-Link. 38 brands are supported in total.
Can staff use their own phones?
Yes. They sign in on your enrolment page and install a profile. If the phone is lost, revoke its certificate and only that device loses access.
What happens when someone leaves?
Kiwire checks Microsoft 365 and Google Workspace every day. Anyone suspended or deleted there is suspended in Kiwire and disconnected from the WiFi.
Do you support WPA3?
Yes, WPA3-Enterprise and mixed WPA2/WPA3 networks, as long as your access points support it.
Can guests still use a sign-in page?
Yes. Run a guest network with a branded portal next to the secure staff network, with visitors approved by their host if you like.