Skip to content
Get your three-SSID plan
Networks

Three WiFi networks run every person and device on your estate

Open for guests and onboarding. Secure for everyone you trust, on certificates. xPSK for everything that cannot hold one. Identity decides the VLAN, so the SSID never has to.

Get your three-SSID plan in 45 minutesCount your SSIDs in the planner
  • 99.999% uptime
  • 99.9% RADIUS uptime SLA
  • 80,000+ venues in 90 countries

Phones, laptops, tills, CCTV and TVs join through your access point. Cloud RADIUS checks each one and sends it to the open, secure or xPSK network by identity, each on its own VLAN; a leaver whose account is disabled is rejected.

Every deviceYour access pointsCloud RADIUSRejected: account disabled
Open
  • Captive portal sign-in
  • Consent recorded
  • BYOD onboarding lane
Secure
  • EAP-TLS from your MDM
  • Identity decides the VLAN
  • Passpoint and OpenRoaming
xPSK
  • A key per device
  • Own VLAN and bandwidth limit
  • Revoke one key alone
VLAN 10VLAN 20VLAN 40

Pick the network by who, or what, is connecting

  • Network 1

    Open

    Guest WiFi through a captive portal, and the onboarding lane for BYOD before a device gets a certificate.
    • Captive portal sign-in
    • Consent recorded for GDPR and CCPA
    • Under 15 minutes to add to a controller

    The open network

  • Network 2

    Secure

    One WPA-Enterprise SSID for every trusted user: staff on EAP-TLS with MDM, and secure guests on Passpoint and OpenRoaming.
    • Passwordless and certificate-based
    • Compliance-gated join with Conditional Access
    • Entra ID, Okta and Google Workspace
    • The largest cloud RADIUS in the world, with a 99.9% SLA

    The secure network

  • Network 3

    xPSK

    A unique key per device, person or tenant on one SSID, for things, communities, concessions and contractors.
    • Own VLAN, policy and bandwidth limit per key
    • Cisco iPSK and EasyPSK, Ruckus DPSK, Extreme and UniFi PPSK, Aruba and Mist MPSK
    • Revoke one without touching the rest

    The xPSK network

FAQ

Common questions

Ask us something else

Why three SSIDs and not one?

Because the people and devices on an estate authenticate in three different ways: a guest signs in through a portal, a trusted user presents a certificate, and a device that can do neither presents its own key. Inside each SSID, identity decides the VLAN.

Can we run two or four?

Yes. The model flexes from two to four SSIDs to suit your policy. Three is the design. Skip per-device keys and it is two. In education, eduroam makes it four. Identity still decides the VLAN on every one.

Where does eduroam fit?

Beside the three, as its own SSID. In education, eduroam makes it four. Open, secure and xPSK carry your visitors, staff, halls and devices, and eduroam keeps doing its roaming job.

Map your SSIDs onto three

Bring the list of what runs on your WiFi today. We map it onto open, secure and xPSK with you, and you keep the plan. All in a 45-minute design session.

  1. Get your three-SSID plan in 45 minutesTell us what runs on your WiFi today, and a Purple network engineer maps it with you.
  2. Map your SSIDs onto threeOpen, secure and xPSK, on the access points you already own. You leave with the plan.
  3. Prove it on one site firstJudge the result on tickets and audit evidence, then roll out.

Your design session

45 minutes. Your estate. A plan you keep.

Led by a Purple network engineer. No slides. You keep the plan.