Cards, fobs and keypads instead of keys

Why small businesses consider access control

Keys have served businesses for a very long time, and for many they remain the right answer. The reasons to move away from them tend to be practical. Staff change, and every departure raises the question of whether a key was returned or copied. Cleaners, contractors and delivery people need access at particular times, not all the time. An owner wants to know who came in and when. A shared entrance serves many tenants, and each wants a different level of access.

An access control system answers these needs by replacing the key with a credential: a card, a fob, a keypad entry number or a phone based credential. The door is controlled by electronics that check the credential against a list of permitted users. When someone leaves, the owner disables their credential in software. There is no key to chase and no rekey to schedule.

That is the attraction. The cost is that a system has more parts than a mechanical lock, and each part must work. A reader without power does nothing. A controller that loses its network connection may behave in ways nobody planned. A lock that fails open or fails closed in a power outage can either leave the premises unsecured or trap people. A small business is wise to understand these parts before buying.

This page covers the planning for a modest system, typically one to a dozen doors. It does not replace a design by a qualified security integrator for a larger or more demanding site, and it does not give prices, which are provided by phone. For the lock hardware side of a card reader door, see the companion page on card reader door installation planning.

The pieces of a basic system

Every access control door has a few components, and knowing their names makes conversations with an installer easier. The reader is the device on the wall that you present a card or fob to, or that has a keypad. It reads the credential and passes the information to the controller. Readers come in several types, including proximity readers that read a card held near, readers that need a short tap and keypad readers. Some combine a card and a keypad for extra confidence.

The controller is the brain. It stores the list of permitted credentials and decides whether to release the lock. In small systems the controller may be built into the reader, so each door is self contained. In larger systems a controller panel in a closet manages several doors and connects to a computer or a cloud service.

The lock hardware is what actually secures the door. It is usually an electric strike, which replaces the strike plate in the frame and releases the latch, or an electromagnetic lock that holds the door shut with magnetism, or an electrified lockset that has the lock and the electronics in one unit. Each has implications for safety and for the door, covered on separate pages about electric strike installation and magnetic locks and fire egress.

The power supply feeds the reader and the lock. It must be sized for the load and should include a battery backup so the system keeps working through a brief outage, which is relevant in a hurricane season climate where power interruptions are not unusual. Finally, a request to exit device, such as a push button or motion sensor inside the door, lets people leave without presenting a credential.

• Reader at the door that accepts a card, fob, keypad entry or phone
• Controller that stores permissions and decides whether to unlock
• Lock hardware: electric strike, magnetic lock or electrified lockset
• Power supply with battery backup sized for the load
• Request to exit device so people can leave without a credential

Choosing a credential: card, fob, keypad or phone

Each credential type has strengths and weaknesses, and the right choice depends on the people using it. Cards and fobs are familiar and fast. They can be lost, lent and sometimes copied, depending on the technology. Older low frequency proximity cards are easy to duplicate with common equipment, and an installer should discuss newer, more secure card technologies if copying is a concern.

Keypads need no physical credential, which suits a back door used by a few people. Their weakness is that a short entry number can be shared, observed or guessed, and it is hard to tell who used it unless each user has an individual number. A shared number that never changes is a weak control. Individual numbers, changed when staff leave, are better.

Phone based credentials let staff use their mobile phone as a key. They remove the need to issue cards and can be revoked remotely. They depend on the phone being charged and on the reader supporting the chosen technology. Some businesses prefer to avoid reliance on personal phones for security reasons.

Biometric readers, such as those that read a fingerprint, add a credential that cannot be lent. They bring their own considerations, including privacy, enrollment of each user and the way the system behaves when a finger is wet or worn. A small business should ask for a clear explanation of how the data is stored and who controls it.

Often the best choice is a combination. For example, a card at the front door for daily use and a keypad plus card for the server room, so that a lost card alone cannot open the most sensitive door. The more sensitive the door, the more it makes sense to require more than one factor.

Standalone, networked and cloud systems

Small systems fall into three broad styles. A standalone system has a reader or lock at each door with its own memory. You program it at the door, usually with a master card or a keypad menu or a phone app. It is simple in concept, but managing many users across many doors is tedious, and there is limited reporting.

A networked system connects the doors to a controller and software on a computer in the office. You add and remove users centrally and can view reports of who entered and when. The system depends on the computer and the network, and someone must maintain the software, apply updates and back up the data.

A cloud based system uses controllers that connect to a hosted service. You manage users from a web page or an app, from anywhere, and the provider handles the software. It suits businesses with several locations or without a technical person on staff. It depends on a reliable internet connection, and it usually involves a recurring subscription, so ask clearly what is included and what happens if you stop paying.

A critical question for any connected system is what happens when the connection is lost. Good designs keep the doors working locally, using the permissions stored in the controller, so that a network outage does not lock everyone out or open everything. Ask the installer to explain the behavior in plain words and to demonstrate it.

Also ask who owns the data and the system. If the business changes installers, can it keep its credentials and user list? Some proprietary systems tie you to a vendor. Others use open standards that allow another qualified installer to maintain them. A little thought at the start avoids being locked in later.

Planning the doors before choosing products

The best way to plan is door by door. For each door, answer a handful of questions. Who needs to use it, and at what times? Is it an entrance, an interior door or an exit? What is it made of, and what condition is it in? Where does the wiring come from, and can it be run? Is there a nearby power source and a place to put the controller?

Doors vary enormously. A glass door in an aluminum frame, like a typical shop front, has little room for hardware and needs a lock designed for narrow stiles, as described on the page about storefront door lock repair. A hollow metal door in a steel frame accepts an electric strike more easily. A wood door in an older building may need reinforcement before it can carry new hardware.

Think too about the door's behavior. Does it close and latch on its own? An access control lock does its job only if the door actually closes. A door that is propped open, or that does not latch because of a weak closer, defeats the system. Door position sensors can alert when a door is held open too long, which is a useful feature for a small business that cannot watch every door.

Wiring is often the main cost and the main constraint. Cable must reach from the controller to the reader, the lock and the exit device, and in an existing building that may mean running cable through ceilings, walls or conduit. Plan the routes and ask the installer to explain what is required, especially in concrete block buildings, which are common in Miami and make hidden wiring difficult.

Finally, check the paperwork for permits or approvals. Work that touches doors on an exit route, or that involves electrical connections, may need a permit or an inspection. A reputable installer explains what applies.

Safety and exit: the rule that overrides convenience

Whatever system you choose, people must be able to leave the building. This is not a matter of preference. Doors on a path of exit generally must allow unobstructed exit without a key, a card or insider knowledge, and there are rules about how that is achieved. The details depend on the building type, the occupancy and the local authority, so they are decided by the people responsible for life safety in your area, such as the fire marshal and the building department.

In practice this means that on an access controlled door, the side leaving the premises must release by a simple action, such as pushing a bar, turning a lever or pressing a release, or the lock must release automatically in an emergency. A lock that holds a door closed with no way out, even for an authorized person, is a hazard.

It also raises the question of how the door behaves when power fails or a fire alarm sounds. A fail safe lock unlocks when power is lost. A fail secure lock stays locked when power is lost but must still allow exit from inside. Which one is appropriate depends on the door's role. Interior doors and exits often use one arrangement, and perimeter doors that need to stay secure use another. The page on magnetic locks and fire egress explains why this matters for maglocks in particular.

Do not allow an installer to skip egress considerations to save time. Ask how the door will release in an emergency, and make sure the answer is clear. If an installer cannot explain it, find one who can.

For anything that touches exit doors, consult the local authorities or a qualified professional. A locksmith can install and service the locks and readers within the arrangement approved for the building, but does not replace the guidance of the people responsible for life safety.

Policies that make the technology work

A system is only as good as the habits around it. Decide who may add and remove users, and keep that list short. Write down the process for issuing a credential: who approves it, what the person signs, and when it is collected. Treat a card like a key, because it is one.

Plan for departures. When someone leaves, their credential should be disabled the same day, and the physical card collected. One of the real advantages of electronic access is that this step is quick, but only if it is actually done.

Review the user list regularly. It is common for a system to accumulate people who left months ago, contractors whose job ended and test users nobody remembers. A quarterly check removes these. Reports of door activity can also show unusual patterns, such as a credential used at odd hours.

Think about visitors and contractors. A temporary credential with an expiry, or a schedule that limits access to certain hours, is safer than lending a staff card. Most systems support schedules, and a small business can use them to restrict a cleaner to evening hours and a contractor to a single day.

Keep a mechanical backup. Even an electronic door usually has a key override for emergencies and maintenance, and that key needs to be controlled like any other. See retail key control policy and commercial lock audit for ways to keep track.

Document the system: where each controller is, what each door does when power fails, how to reach the installer. A one page summary kept by the owner prevents confusion at the worst moment.

What to ask before you commit

Before accepting a proposal, ask a short set of questions and expect clear answers. How will each door behave when power fails, and when the network fails? How do people exit? What credentials does the system use, and how easily can they be copied? Who has the administrator login, and can I have it? Where is the data stored? What happens if the installer is no longer in business?

Ask what ongoing costs there are, such as subscriptions, software fees, support fees or credential replacement. Ask what is included in the installation and what is not, such as wiring, door preparation, programming and training. Ask how the system can grow if you add doors.

Ask what the installer will do with the old locks. If you are replacing mechanical locks, will they be kept as a backup, removed, or rekeyed? Ask about the doors themselves: will any need repair or adjustment first? A door that sags or does not latch can make the best system fail.

Finally, ask how a quote will be given. Quotes here are given by phone after a conversation about your doors, and any complicated job needs an on-site visit with a service call charge explained before dispatch. Prices are not published, because they depend on the doors and the choices you make.

If you are weighing access control for your office or shop, call and describe the doors, the people and the problem you want to solve. A technician can explain what is practical, and recommend a bigger design where needed.

Questions people ask

Related pages

Written by Claude (AI) (AI) for 24 Hour Locksmith Miami.