Serviced apartment WiFi providers: short stays, long stays and housekeeping devices

A serviced apartment WiFi provider should run three networks on your existing access points. Short stays get an open captive-portal sign-in, like a hotel. Long stays get a private key per apartment, so guests' own devices work. Housekeeping tablets and smart locks sit on a separate device network. Keys follow your property management system's check-in and check-out dates.

Which access model should each serviced apartment guest get?

Serviced apartments sit between a hotel and a home, and your WiFi has to serve both. A two-night guest behaves like a hotel guest. They bring a phone and a laptop, sign in once and leave. A three-month guest behaves like a resident. They bring a streaming stick, a smart speaker, a printer and a work laptop that needs a VPN.

A hotel-style captive portal suits the first guest and fails the second. A captive portal is the web page a device must complete before it reaches the internet. Streaming sticks, games consoles and smart TVs have no browser, so they cannot complete it. Guest networks also usually run client isolation, which stops one device seeing another on the same network. Casting from a phone to a TV breaks as a result.

A residential setup fails in the other direction. One password per apartment, printed on a welcome card, rarely changes between stays. The previous guest's laptop, and the one before that, can still join.

The fix is not one network but three, on the same access points:

• Short stays: an open sign-in through a captive portal, run as Guest WiFi.
• Long stays: a private key per apartment, which creates a private network bubble for the guest's own devices.
• Devices: a separate network for housekeeping tablets, smart-lock hubs and building systems, invisible to every guest.

Purple runs all three through Purple Access as a cloud overlay on hardware you already own. That covers Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. There is no rip and replace, as Why your next WiFi upgrade doesn't need new hardware explains.

How do short-stay, long-stay and device networks differ?

Three terms carry the rest of this guide. An iPSK (identity pre-shared key, also called PPSK or private pre-shared key) gives each apartment its own password on a single network name. A VLAN (virtual LAN) is a logically separate segment running over the same physical cabling and access points. RADIUS is the authentication service that checks a credential and tells the access point which VLAN a device belongs in.

The table compares the three models against the shared building password most properties are replacing.

	Short-stay sign-in	Long-stay private key	Device network	Shared building password
Who it suits	Guests below your stay threshold, such as 1-6 nights	Guests at or above your threshold, such as 7+ nights	Housekeeping, maintenance, smart locks, building systems	No one: the legacy setup you are replacing
How a device connects	Captive portal with email, social or form sign-in	Unique key per apartment, entered once per device	IEEE 802.1X for staff devices, a device key for headless kit	One password printed on a card
Devices supported	Phones, tablets and laptops with a browser	Phones, laptops, streaming sticks, consoles, smart speakers, printers	Tablets, handhelds, lock hubs, thermostats, sensors	Any device that knows the password
Device-to-device discovery	Blocked by client isolation	Allowed inside the apartment's own segment only	Limited to the systems each device needs	Open across the floor or building
Credential lifetime	Session length you set, then sign in again	Check-in to check-out, from the PMS	Staff contract or device service life	Until someone changes it by hand
Revocation	Session expiry	Automatic at check-out	Staff leaver process or device retirement	Manual change that every current guest must re-enter
What you learn	First-party data with conscious-choice opt-ins	Stay-linked usage, no marketing prompt required	Operational status only	Nothing
Encryption	Open or OWE-encrypted network	WPA2-Personal with iPSK; confirm WPA3 support on your hardware	WPA2 or WPA3-Enterprise with 802.1X; iPSK for headless kit	WPA2-Personal, one key for everyone

OWE (Opportunistic Wireless Encryption, defined in RFC 8110) encrypts an open network without asking the guest for a password. Ask your provider whether your access points support it on the short-stay network.

When does a serviced apartment guest need a private network rather than a hotel sign-in?

Stay length is the starting signal, but it is not the only one. Five criteria decide which network a booking should land on.

1. Length of stay. Re-signing in every day becomes friction after a week. We suggest a threshold of seven nights, then adjusting it against front-desk WiFi requests.
2. Devices without browsers. A guest who brings a streaming stick or console needs a key, whatever the stay length.
3. Working from the apartment. Printers and screen casting rely on device discovery, which client isolation blocks.
4. Privacy. A long-stay guest's laptop and smart speaker should be invisible to the apartment next door.
5. Booking type. Corporate relocation, contractor and clinician placements usually run for weeks and arrive with work equipment.

Guest situation	Recommended access	Why
1-3 night leisure stay, phone and laptop	Captive portal sign-in	Fastest route online, and it captures consented contact details
4-6 nights with a streaming stick	Captive portal, plus a private key on request at reception	The stick has no browser for the captive portal
7+ night stay	Private key per apartment, issued at check-in	Every device joins once and stays joined
Corporate relocation of 1-6 months	Private key per apartment, extended on renewal	Supports VPN, printers and a household's worth of devices
Event or group block booking	Captive portal with time and bandwidth limits	Protects capacity when the building fills at once
Housekeeping and maintenance staff	IEEE 802.1X on the device network	Access ends automatically when a member of staff leaves

For event weeks, How to Implement Time and Bandwidth Restrictions on Guest WiFi covers how to set per-device limits without degrading long-stay apartments.

How are keys issued and revoked at check-in and check-out?

A private key should live exactly as long as the stay. That only works if the key is tied to booking events, not to someone remembering to change a password.

The key lifecycle

• Check-in. A key is created for the apartment, valid from arrival to departure. It reaches the guest by pre-arrival email or on the welcome card printed at reception.
• Extension. The end date moves. The key stays the same, so the guest re-enters nothing on any device.
• Room move. The old apartment's key is revoked and a new one is issued for the new apartment's segment.
• Late check-out. A grace window you set keeps the guest online until they leave.
• Early departure or check-out. Purple revokes the key at the check-out event. Devices left configured by the previous guest cannot rejoin.

Per apartment, not per person

Issue one key per apartment stay, shared by everyone in the booking. A family of four uses one key across all their devices, and those devices can see each other. The next stay in that apartment gets a fresh key and a clean segment.

Configuration steps differ by access point vendor. Purple's support documentation covers them for each supported platform, so this guide does not repeat menu paths or settings.

Where should housekeeping, smart locks and building devices sit?

Keep every non-guest device off both guest networks. A device a guest can see is a device a guest can probe. Split them into three groups.

Staff-carried devices

Housekeeping tablets and maintenance handhelds should authenticate with IEEE 802.1X. That standard makes each device prove an identity before it gets any network access. Cloud RADIUS checks the identity against Microsoft Entra ID, Okta or Google Workspace, and places the device on the staff VLAN. When someone leaves, disabling their account removes their WiFi access. This is the joiners, movers and leavers process applied to Staff WiFi.

Headless building devices

Smart-lock hubs, thermostats, energy meters and access-control gateways often cannot run 802.1X. Give each device class its own iPSK, mapped to its own VLAN. Restrict each VLAN at the firewall so devices reach only the cloud service they report to.

Payment terminals and back office

Reception card terminals belong on their own segment, outside both guest networks. PCI DSS allows network segmentation to reduce the scope of the cardholder data environment. Keeping payment kit away from guest traffic shrinks what your assessor has to examine.

What does a provider need from your property management system?

The private key model depends on booking data. Without a property management system (PMS) connection, someone at reception issues and revokes keys by hand, and that is where keys get missed. A provider needs these fields:

• Apartment or unit identifier, mapped to a network segment.
• Arrival and departure dates and times, which set the key's validity.
• Guest name and email, for key delivery.
• Status changes: check-in, extension, room move, cancellation and check-out.
• Stay length or rate code, so bookings above your threshold get a key automatically.

Ask four questions about how the connection works:

1. Is it event-driven, so a check-out revokes the key immediately, or does it sync on a schedule?
2. Who maintains the mapping between PMS unit codes and network segments when apartments are added?
3. What is the fallback if the PMS is unavailable, and can reception issue a key manually?
4. Which PMS platforms connect directly, and which need middleware?

How can past guests be invited back to book direct?

For a revenue manager, the short-stay sign-in has a second job. Each sign-in can capture first-party data through conscious-choice opt-ins, where the guest actively ticks to receive marketing. That consent belongs to you, not to the online travel agency that took the booking.

Consent has to stand up. Under GDPR, consent must be freely given, specific, informed and unambiguous (Article 4(11)). In the UK, marketing email also falls under PECR, the Privacy and Electronic Communications Regulations, which the ICO enforces. Record the opt-in at sign-in and send marketing only to guests who gave it.

Purple Engage sends direct rebooking email to those consented past guests. Two campaigns fit serviced apartments well. A post-stay thank-you can carry a direct-booking rate. A note ahead of the same dates next year reaches guests who come back for recurring events or projects. Every booking that comes direct avoids the commission an online travel agency would have charged.

WiFi Analytics shows repeat visits and dwell time across the property, so you can see which guests are worth inviting back. Long-stay guests on private keys see no marketing prompt. Offer them the opt-in in the welcome email instead.

How this works in practice: three serviced apartment scenarios

The figures below are modelled from each property's own numbers, not reported results. They show the arithmetic you can run on your estate.

Scenario 1: a 120-apartment aparthotel with mixed stays

Situation. A city-centre aparthotel ran one shared password per floor across six floors, changed monthly by hand. Long-stay guests' streaming sticks could not get through the captive portal. Housekeeping tablets shared the guest network.

What was done. Short stays moved to a captive portal sign-in with opt-ins. Stays of seven nights or more received an apartment key at check-in from the PMS. Housekeeping tablets moved to a device VLAN using 802.1X.

Outcome. Six shared credentials became zero. The 72 manual password changes a year (six floors, monthly) were eliminated. With around 40 long-stay apartments occupied at any time, 40 keys run in parallel, each revoked at check-out without staff action.

Scenario 2: an apartment block beside an exhibition centre

Situation. An 80-apartment block fills with exhibitors for a five-day trade show each year. 15 apartments are let to corporate relocation guests on three-month stays. During show week, long-stay guests complained that the network slowed.

What was done. Exhibitors signed in through the captive portal, with per-device time and bandwidth limits during show week. The 15 relocation apartments kept private keys on their own segments, outside the limits.

Outcome. Relocation guests kept the same experience as any other week. At two guests per apartment across 65 short-stay apartments, the property had up to 130 opt-in opportunities per show. Consented exhibitors became the audience for a direct-booking email ahead of next year's dates.

Scenario 3: a hospital trust housing agency clinicians

Situation. A public sector healthcare trust block-books 20 serviced apartments for agency clinicians on 13-week contracts. Clinicians need trust laptops, VPN and personal devices working from day one.

What was done. Each apartment received a key valid for the contract dates. Extensions moved the end date without a new key. Smart-lock hubs moved to their own device VLAN.

Outcome. 20 apartments ran on 20 keys with no shared password. Each key ended on the contract end date. No clinician re-entered credentials when a contract was extended.

What does each access model cost to run?

Licensing aside, running cost comes from four places.

• Hardware. On supported access points there is no new hardware, because Purple layers onto existing infrastructure. If apartments have weak coverage, fix it with access points rather than plug-in extenders: WiFi extender vs Access point: Which one do you need? explains why. If you are refreshing hardware anyway, WiFi 6 (802.11ax) explained covers what the standard adds in dense buildings.
• Staff time. A shared password costs staff time at every change and every guest query. PMS-driven keys remove the change and most of the queries.
• Risk. An unrevoked password is an open door for every previous guest. Automatic revocation closes it at each check-out.
• Recovered revenue. Consented contacts give you a route to direct bookings that a shared password never captures.

Purple is licensed as a plan, Connect, Capture or Engage, rather than as a hardware project. Engage includes the rebooking email described above.

What should you ask a serviced apartment WiFi provider?

Use this list to compare providers on your shortlist.

1. Can short-stay sign-in, long-stay keys and a device network run on one set of access points?
2. Which access point vendors are supported? You need your own named, not "compatible hardware".
3. Are long-stay keys created and revoked from PMS events, or by hand?
4. What happens to a key on extension, room move and late check-out?
5. Do devices inside one apartment see each other, and stay invisible to neighbours?
6. How do staff devices authenticate, and does access end when someone leaves?
7. How are opt-ins recorded, and can you prove GDPR and PECR consent?
8. Can consented past guests receive direct rebooking email from the same platform?
9. Which certifications does the provider hold?

On the last point, Purple holds ISO 27001, Cyber Essentials and B Corp certification, and is GDPR and CCPA compliant. Purple runs across 80,000+ live venues in more than 90 countries, with 500 million users and logins a year. Hospitality brands on Purple include Premier Inn and Whitbread. More on hospitality deployments is on the Hotels page.

Frequently asked questions

Does Purple work with the access points we already have?

Yes, Purple runs on the access points you already own. Supported platforms are Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Purple works as a cloud overlay, so short-stay sign-in, long-stay apartment keys and the device network run on your current hardware. Per-apartment keys and encryption options depend on what your vendor supports, so confirm your model during scoping.

How is serviced apartment WiFi from Purple licensed?

You license a software plan, not hardware. Purple offers three plans: Connect, Capture and Engage. Engage adds direct rebooking email to consented past guests. Because Purple layers onto existing infrastructure, there is no rip-and-replace cost. Ask for a quote based on your apartment count, the number of properties and the plan you need.

Can we move off a shared building password without disrupting current guests?

Yes, you can run both side by side during the switch. Keep the shared password live while new check-ins receive private keys and short stays use the captive portal. Existing long-stay guests receive a key at their next extension or a date you choose. Once every occupied apartment has moved, retire the shared password. No guest loses connectivity during the switch.

Is the guest data collected at sign-in GDPR compliant?

Yes, Purple is GDPR and CCPA compliant and certified to ISO 27001. Sign-in uses conscious-choice opt-ins, where the guest actively agrees to marketing. That meets the GDPR test of consent that is freely given, specific, informed and unambiguous. Marketing email goes only to guests who opted in, which also fits UK PECR rules. Long-stay guests on private keys see no marketing prompt at all.

Why not give each long-stay apartment its own broadband line?

A private key on the building network delivers the same at-home experience without a line per apartment. Each apartment gets its own segment, so the guest's devices see each other and stay invisible to neighbours. You avoid ordering, installing and cancelling lines as stays change. Access ends automatically at check-out, and you manage every apartment from one place.

How much effort does deployment take?

Most of the work is configuration, not installation. Purple runs on your existing access points, so there is no new cabling or hardware on supported platforms. The main tasks are defining your stay threshold and connecting the PMS. You also map apartments to network segments and move housekeeping and building devices onto their own VLANs. Purple's support documentation covers the vendor-specific steps.

Do housekeeping devices need their own network name?

No, they need their own segment, not necessarily their own network name. Housekeeping tablets should authenticate with IEEE 802.1X against staff identities in Microsoft Entra ID, Okta or Google Workspace. Headless devices such as smart-lock hubs use a device key. Each lands on a separate VLAN that guests cannot see. Access for staff devices ends when the staff account is disabled.