Everything on this page works today

Your money arrives without you chasing it #payments

• Subscribers pay online with SAS-Pay, Fawry, EasyKash, Paymob or Kashier, and the money lands in their account.
• Every payment is confirmed with the gateway itself, not with the page the customer came back from. No top-up is counted twice, and none goes missing.
• If an activation is sent twice by mistake, it is charged once.
• Work prepaid, postpaid, a mix of the two, or with cards, and print an invoice for any money operation.
• Your gateway credentials stay yours, encrypted, and there is a screen with every gateway transaction for whoever answers your subscribers.

Cards #cards

• Print cards in batches from a saved template, each card with its own validity.
• See how many cards were printed, how many sold and how many are left, and move cards or reverse a sale.
• Sell at the counter, or from an online card shop.
• Subscribers sign in by scanning the QR code on the card.
• Design the card, the invoice and the receipt yourself in the browser, with the design tool built into the panel.

Resellers without leakage #billing

• Resellers under resellers, each with a wallet, a debt limit and a credit limit that you set.
• Every transfer between two of them is recorded on both sides, so every pound in or out leaves a trace.
• Reward points with activations.

Subscribers serve themselves #subscriber-portal

• A page with your name and your logo, in five designs to choose from, that the subscriber installs on their phone like any app.
• They open it with no username and no password while on your network, even when your network shares one public IP (CGNAT).
• They top up their wallet online, and pause the line or block sites behind a PIN with parental controls.
• They can do the same from a Telegram bot or from WhatsApp, with messages both ways.
• Sites you choose do not count against the quota.
• On a hotspot, a visitor signs themselves up and gets straight on. There is also a ready interface if you have a mobile app.

Subscriber complaints in one place #support

• Complaints reach you by email, Telegram or WhatsApp and are matched to the subscriber on their own. Anyone we cannot match waits in a review queue.
• Ready replies, one action across many complaints at once, and snoozing a complaint until later with a reminder.
• A complaint can close on its own and open again, and after it closes the subscriber rates the answer.
• Every staff member keeps the filters they work with.

Routers and towers #network

• A MikroTik connects with one script you copy from your panel and paste.
• The router connects to us through a tunnel (WireGuard or OpenVPN, and ZeroTier for RouterOS 7 on ARM), so there is no fixed IP and no port to open.
• Open Winbox or SSH on the router from your browser, from anywhere.
• Monitoring for every device with limits you set, every alert in one place, and a map of where the devices are and how they connect.

Reports #reports

• The moment you open the panel: how many are online now, and today's numbers.
• Twenty kinds of report: activations, usage, debts, profits, transfers, cards, gateway transactions, shop sales, suspicious activity, who did what, sign-in attempts, and more.
• Download reports as Excel or CSV. A large report is prepared in the background while the panel keeps working.

Coming from SAS4 #migration

• Upload your SAS4 backup, and subscribers, plans, resellers, cards and accounts come across. Tested on a real 326 MB backup from v4.56.
• You can export your data back to SAS4 format at any time. Nothing locks you in.
• Coming from other software? Upload an Excel or CSV file and say where each column goes.

The server is on us #control-plane

• We run the system and update it. Updates reach you without you doing anything, and none of your subscribers drops while they do.
• An encrypted backup on Google Drive, with restore drills.
• If you need help, our support team reaches the server over a private, encrypted WireGuard management network.

The technical part #technical

If you own the network you can skip what follows. This is the part your engineer wants.

RADIUS and sign-in #radius

• FreeRADIUS 3.2 as a stateless gateway, with every decision made by a long-lived Go policy API over the rest module. No process fork per request.
• PAP, CHAP and MS-CHAPv2. CoA disconnect and update. Dynamic NAS clients by source address.
• MAC lock with first-device learning and randomised-address rejection, simultaneous-session limits, subscriber-chosen speed, IP pools.
• Limits by data, time, speed and concurrency, fair-use chains to the next plan, and a live RADIUS log in the panel.

Security #security

• Each provider's data is separated inside the database itself: Postgres row-level security on every table, with the application connected as a role that cannot bypass it.
• Staff passwords hashed with Argon2id, TOTP two-factor, and any open session can be revoked.
• API tokens scoped to an intersection of their own scope and their owner's live permissions, and never an administrator.
• Fine-grained permissions with roles you define, an append-only audit log, and signed webhooks.