Sign-in by kiosk, QR code, or phone number is the backbone of the Threshold, and it runs on whatever internet you already have. The WiFi welcome screen is an enhancement on top of that — never a replacement for it, and never a condition of being cared for.
This page exists so a church that wants the automatic front door knows exactly what it takes, and so a church that cannot afford it is not quietly excluded.
Most churches should start at Tier 1 and never feel they are missing anything.
| Tier | What you need | What you get |
|---|---|---|
| 1 — Any church, today | A tablet or a phone, and the internet you already have. | Kiosk, QR and keytag sign-in, guest registration, the full five R’s, Aligned, the Circles, the care rail, Shepherd Care. |
| 2 — A capable existing network | Controller-managed access points already installed, and a guest network we can attach a welcome screen to. | Everything above, plus the WiFi welcome screen as a second door and returning-guest recognition. |
| 3 — The full build | The reference design below. | All of it, reliably, in a full sanctuary on a high-attendance Sabbath. |
Tier 3 belongs to churches already rebuilding the network for livestream, or large enough that consumer equipment has stopped coping.
Nearly every complaint about church WiFi is one of these, and they compound.
Hand this section to your integrator. It is written to be bid against.
| Network | Policy |
|---|---|
| Staff and office | Private, WPA3. |
| AV and livestream | Isolated, prioritised, wired wherever possible. |
| Guest | Welcome screen, device isolation on, about 5 Mbps per device. |
| Cameras and devices | Isolated, with no route to staff. |
Any controller-managed platform that supports an external welcome screen will work. Two we recommend.
Both are controller-managed and both let the welcome screen live on NORMConnect’s server rather than the vendor’s. Omada’s external portal flow is the cleaner of the two and has broken less across controller versions.
Ruckus is the upgrade when the sanctuary is a genuine radio problem. Meraki is excellent and carries perpetual per-access-point licensing that churches resent by year three — know that before you sign.
Several churches under one pastor or one conference: use a single hosted controller across sites, and decide that before the first install rather than the third.
Modern phones change their WiFi address on purpose. iOS and Android both randomise it per network and rotate it. Any system that recognises returning visitors by their device will quietly stop working — the same person looks new after an update, and nobody notices.
NORMConnect does not do that. Someone is recognised because they signed in once and told you who they are — not because we fingerprinted their phone. Which means returning-guest recognition depends on a name and an email or mobile given once, not on your network. It also means we are not tracking anyone who never opted in, which is the answer to the question your board is going to ask.
Roughly $6,000–$10,000 installed for a 500-member building — access points $2–3K, switching and gateway $1–2K, cabling and labour $2–4K.
If your church has been getting by on a $200 router, that number stings. Here is the fair way to look at it: this is the same wiring your livestream, your giving kiosk and your children’s check-in already depend on. Most churches bought the livestream rig and skipped the network underneath it — and then spent three years blaming the internet.
And if it is not in reach this year, run Tier 1. You lose the automatic front door. You lose nothing else.
Publish this spec, review your integrator’s design against it, certify the finished network, and own the welcome screen.
Sell hardware, run cable, hold a maintenance contract, or take the call about the nursery dead zone. Hire a local low-voltage integrator. Competitive bids against a written spec protect the church, and independence protects everyone.
Put both numbers on the office wall before the first service.
Welcome screen not loading, guest not recognised, sign-ins missing → NORMConnect.
No signal, slow internet, an access point offline, switch down → your integrator.
A church offering open internet to teenagers has a content-filtering decision to make, and guest logs carry their own retention questions. Decide both with your integrator and your own counsel. We specify the shape of the network; we do not advise on filtering policy or record retention, and nothing here is legal advice.
On consent. The welcome screen always offers a way onto the internet that collects nothing. Telling us who you are is an invitation, never a toll. A church that trades internet access for personal details has taught its guests exactly the wrong thing about how it sees them.
Answer these before an Opening Sabbath is scheduled. There are no wrong answers — this decides your tier, not whether you are welcome.
Tier 1 exists so it never has to.
Network Readiness Spec v1 · this page describes network requirements only and is not legal advice.