Most small organisations manage access with physical keys for far longer than they should. It works until the day someone leaves without returning theirs, or a cleaner needs access on a Sunday, or you realise you have no idea how many copies of the front door key exist. At that point you either re-key the building or accept that you do not control who can enter it.
Moving away from keys is not one decision but three: what credential people carry, what the door hardware is, and who administers the whole thing. Getting the third one wrong is what usually causes the trouble.
The problem with keys
A physical key has two properties that make it unsuitable once a handful of people are involved. It cannot be revoked — only the lock can be changed, at cost and inconvenience to everybody. And it leaves no record, so after an incident you know only that someone with a key was involved.
Keys also get copied, and any key marked “do not duplicate” can be duplicated. None of this matters much for a two-person studio. It matters a great deal for an office of twenty with contractors and a cleaning company.
Three credentials, three sets of trade-offs
PIN codes
The cheapest to deploy and the easiest to get wrong. A single shared code is barely better than a key: it is never changed, it spreads by word of mouth, and it tells you nothing about who used it.
Per-person codes are a different proposition entirely. Issued individually, they can be revoked individually and they appear in the log by name. They suit contractors and cleaners particularly well because you can set them to work only on specific days and hours. The genuine downsides are that codes can be shared or observed, and that keypads wear in a pattern that eventually reveals which digits are used.
Cards and fobs
The pragmatic choice for most offices above about ten people. A card or fob is easy to issue and revoke, works instantly, costs very little per person, and nobody needs a smartphone or an app. Access logs are per-credential, so they are meaningful.
The weakness is that a card is a physical object that can be lent or lost, and low-end card technologies can be cloned with cheap equipment. If you are specifying a new system, ask for encrypted card technology rather than the older unencrypted formats, which are trivially copyable. A supplier who cannot answer that question clearly is telling you something.
Phones
Convenient, hard to lend casually, and free of credentials to hand out. The catch is dependency: a phone can be flat, forgotten or updated into misbehaviour, and Bluetooth unlocking is occasionally slow in a way that becomes infuriating at a door in the rain.
Phones work best as the primary credential with a card or code as a fallback, rather than as the only way in. Never make a phone the sole means of access for a building people must be able to enter.
Do not remove the mechanical override
Whatever you fit, there must be a way in when the electronics fail. That means either a mechanical key cylinder retained on at least one door, or a key safe with a code held by two responsible people, or both.
This is not hypothetical. Batteries flatten, controllers fail, network switches lose power. A building whose only entry method depends on working electronics will eventually lock everybody out, and it will happen at the worst possible time.
Hardware: what actually goes on the door
Smart locks
Replace or retrofit the existing lock, with the intelligence in the door itself. Quick to fit, no wiring, and ideal for a single entrance or an internal room. The limitations are battery management and that each lock is administered on its own, which stops being reasonable somewhere around five doors. Our door sensor guide covers the contact sensors you will want alongside them.
Readers with a central controller
A reader at each door, wired back to a controller that holds the permissions and the log. This is the right architecture once you have several doors, multiple credential types or any need for reporting, because permissions are managed in one place rather than per lock. It needs cabling, which means it suits a fit-out or a renovation far better than a retrofit into a finished office.
Retrofit cylinders
Worth knowing about specifically for leased premises. These replace only the cylinder inside the existing door, leaving handles, frame and door furniture untouched, and can be swapped back at the end of the lease. Frequently the only option a landlord will approve.
The part everybody forgets: administration
Access control is not a product you install, it is a process you run. Before choosing hardware, answer these questions.
- Who issues and revokes credentials? Name a person and a deputy. If the answer is “whoever is around”, credentials will never be revoked.
- What happens on the day someone leaves? Revoking access belongs on the leaver checklist next to returning the laptop. Without that, ex-employees retain access for months.
- How are contractors handled? Time-limited credentials that expire on their own are the only approach that survives contact with reality.
- How long are logs kept, and who may look at them? Decide before you have a reason to look, not afterwards.
- What happens if the administrator is unavailable? One person holding the only account is a single point of failure with a holiday booked.
Logs are personal data
An access log records where identifiable people were and when. In the EU and UK that is personal data, and a few principles keep you comfortably on the right side of it.
Collect it for a stated purpose — security and safety — and do not quietly repurpose it for monitoring attendance or productivity. That repurposing is where most organisations get into trouble, and it destroys trust faster than any technical failure. Set a retention period and stick to it; a few months is usually ample. Tell staff the system exists and what it records. And restrict who can query it, because an access log is an unusually revealing document about individuals' movements.
A sensible progression
You do not have to arrive at a full system immediately, and most organisations should not.
- Under five people, one door: a good smart lock with per-person codes, plus a mechanical key retained. Notifications on unlock. This is genuinely sufficient.
- Five to twenty people: cards or fobs on the main entrance with a small controller, per-person credentials, time restrictions for cleaners and contractors, and a documented leaver process.
- Twenty and up, or several doors: readers and a central controller, integrated with your staff directory so joining and leaving update access automatically. At this size, manual credential administration is the thing that fails.
Wherever you stop, the two things that matter most are the same: credentials that belong to one person and can be revoked, and a named human whose job it is to revoke them. The hardware is the easy part.