Key takeaways
- Old keys keep working until you rekey, and a shared code works until you change it. A new reader doesn't change either one.
- Give everyone their own fob or phone credential so you can remove one person without changing anything for the rest.
- Set cleaners, contractors and night staff to the hours they work, including shifts that run past midnight.
- Give temporary access an end date when you create it.
- Name one person, plus a backup, who removes access on someone's last day.
- Installation takes 2–4 weeks, faster with an expedite fee, so start before a planned staff change if you can.
The problem
Why shared keys and door codes stop working for a business
Shared access works fine until someone leaves. Then you have two bad choices: change the code and re-teach everyone, or leave it and hope. Keys are worse. You know how many you handed out, but not how many copies exist, and a key returned on someone's last day may not be the only one.
It also gets hard to tell who is coming and going. When the cleaning company changes crews, or a contractor needs in for a week, the shared code goes to people you've never met, and it rarely gets changed afterward.
Individual credentials fix this. Each person gets their own fob, card or phone credential. A keypad lock is programmed at the door. A cloud system runs from an app, so you can add or remove someone from your phone. With Kisi, the platform we install most, you remove a person in the app and Kisi says their access is revoked immediately. Everyone else keeps coming in as usual.
See Kisi access control installation for how we set it up, or compare standalone keypads and managed access if you're weighing a cheaper keypad.
The gap
Do old keys still work after you install access control?
Yes, in most cases. Adding a reader and an electric strike usually leaves the key cylinder on the door, because you still want a way in if the power or network goes down. Every key you ever handed out still opens that cylinder until it is rekeyed.
The same goes for an old keypad on the back door. Its shared code works until someone changes it or the keypad comes off. So a new reader alone does not lock out a former employee who kept a key or remembers the code.
Plan the rekey for the same week the fobs go live. A rekey changes the pins inside the cylinder so old keys stop working, and the lock itself stays. Keep a few new keys with the owner or office manager for emergencies, and write down who has them.
Don't stop at the front door. Back doors, the IT closet, the storage room and any door the landlord also keys need the same decision.
Read commercial rekeying, master keys and interchangeable cores for how rekeying and master keys work.
Worksheet
Write down who gets in where, and when
Before anything is installed, fill in a short table like this one. Replace the examples with your own people and doors.
Keep it short. Most small offices need three or four groups, plus a couple of people with exceptions. Give each person only the doors their job needs. "All doors, all hours" should be a choice you make for a few people, and never the default.
Keep admin rights apart from door access. The person who can open every door doesn't have to be the person who can add users. Pick a main admin and a backup.
| Who | Doors | Days and hours | When it ends |
|---|---|---|---|
| Staff | Front door and office area | Weekdays, 6 AM to 8 PM | Their last day |
| Managers | All doors, including the IT closet | Any time | When their role changes |
| Cleaning crew | Back door and common areas, but not the IT closet or records room | Monday to Friday, 9 PM to 2 AM | When the cleaning contract changes |
| Contractor | One entry door and the room they work in | Only the days of the job | An end date set in the app |
| Deliveries | None | Reception or the intercom lets them in | Not needed |
Schedules
How do you schedule access for cleaners and night shifts?
There are two kinds of schedules, and they're easy to mix up. A door schedule unlocks the door for everyone, say 8 AM to 5 PM for walk-in clients. A person's schedule says when their own fob works. The cleaning crew needs a person's schedule. Leaving the front door unlocked all night for them is no plan at all.
Overnight shifts need care. A crew that works 10 PM to 3 AM is on a schedule that crosses midnight. Some systems take that as one window; others need two (10 PM to midnight, then midnight to 3 AM the next morning). Set the right time zone, then have someone test a fob on the first night. A schedule that ends at midnight by mistake locks the crew out when they step out to the dumpster, and a crew that gets locked out once starts propping the back door open.
Holidays move schedules too. Add an exception for the day instead of editing the main schedule, so things go back to normal on their own. In Kisi, schedules sit on groups, so you set the cleaner hours once and every cleaner in that group follows them.
One more thing for night work: unlocking a door usually does not turn off the alarm. If the building has an intrusion alarm, the cleaners need their own alarm codes from whoever runs the alarm.
Temporary access
Make temporary access end on its own
Contractors, temps, interns and a weekend moving crew all need access for a while and then none at all. Set the end date when you give the access. Kisi, for example, lets you set an expiration date on a person's door access, so it turns off without anyone having to remember.
Don't keep one "contractor code" that every vendor shares for years. Each company, and ideally each person, gets their own credential. If the job runs long, extend it on purpose so someone looks at it again.
Phone credentials help here. You can send access to a contractor's phone before they arrive, and it ends on the date you set, so there is no fob to chase down afterward.
Offboarding
Name the person who removes access when someone leaves
Access gets removed when it is one person's job. Name an owner, usually the office manager, and a backup. Tie it to the last day: when HR or payroll knows someone is leaving, the access owner knows too.
- Remove the person in the access app. On a cloud system like Kisi, this takes seconds.
- Collect their fob or card. Once they're removed it won't open anything, and you can reissue it.
- Collect every key. If a key doesn't come back, rekey the doors it opens.
- Change any shared code still in use, such as an old keypad or the alarm code.
- Take them off the intercom answering list if they were on it.
- Once a month, compare the user list in the app with your staff list and remove anyone who shouldn't be there.
- When the cleaning company changes, remove the whole cleaner group and issue new credentials to the new crew.
Timing and cost
How long does it take to switch from keys to fobs?
Plan on 2–4 weeks from approval to installation, or faster with an expedite fee. If you know a staff change is coming, such as someone leaving on bad terms or a new cleaning company starting, tell us the date at the site walk so we can plan around it.
If someone leaves before the system is in, don't wait. Rekey the doors they had keys to and change any shared code now. A rekey is a much smaller job than an access system and can usually happen sooner.
Access control runs $3,000–$7,000 per door for a new install, or $1,500–$3,500 per door to retrofit a door that already has it. A front door and a back door would come to about $6,000–$14,000 as a new install. Software is a subscription that depends on the platform and is quoted per job.
Elwin is based in Santa Clara and does site walks across San Jose and the rest of the Bay Area. Bring your current key list, where any shared codes are used (we don't need the codes themselves), and your staff and vendor list.
See access control cost per door for what moves the price up or down, or commercial locksmith services if you need a rekey now.
Questions before the site walk
Common questions about replacing keys and codes
Do old keys stop working when we switch to fobs?
No. Old keys keep opening any cylinder still on the door until it is rekeyed, and a shared keypad code works until you change it. Plan the rekey for the same week your fobs go live.
Can the cleaning company share one fob or code?
Usually it's better not to. A shared credential can't tell you which cleaner came in, and you have to change it for everyone when one person leaves. Give each cleaner their own fob or phone credential on a cleaner schedule.
How fast can we remove someone who leaves?
In seconds on a cloud system. In Kisi you remove the person in the app, and Kisi says their access is revoked immediately. Any keys they kept still work until you rekey those doors.
Can contractor access expire on its own?
Yes, on most cloud systems. You set an end date when you give the access, and it shuts off on that date. Kisi supports an expiration date on door access, so no one has to remember to remove it.
How long does it take to replace keys with fobs?
Two to four weeks from approval is typical, faster with an expedite fee. If someone is leaving before then, rekey the doors they had keys to right away instead of waiting for the installation.
Sources and further reading
These references support the general technical guidance. The right answer for a specific opening still depends on the property and the authorities responsible for the project.