Access control software manages identities, credentials, permissions, schedules, doors, alarms, events, reports, integrations, and administrator activity. This reference compares cloud-managed, on-premises, appliance, and hybrid approaches without treating any hosting model as universally best.
Return to the complete system-parts reference.
Cloud-managed systems
Cloud-managed platforms place substantial administration and service infrastructure in a provider-operated environment. They can simplify remote multi-site administration, software updates, and browser or mobile access. Owners should still examine subscriptions, account ownership, identity-provider dependencies, data location, export, retention, incident response, internet requirements, and controller behavior during service interruptions.
On-premises systems
On-premises platforms use customer-controlled servers, appliances, databases, or virtual infrastructure. They may suit organizations with internal IT standards, isolated networks, specialized integrations, or local data-control requirements. They also require planned backups, patching, certificates, database care, operating-system support, remote access, disaster recovery, and upgrade testing.
Hybrid and appliance models
Hybrid systems divide functions between local and hosted services. Appliances can package software and hardware into a supported unit. These models can reduce some administration while retaining local control, but exact dependencies vary. Diagram which functions occur in the reader, controller, site gateway, local server, provider cloud, and identity system.
Core management functions
- Cardholder, credential, visitor, and contractor records
- Access levels, schedules, holidays, temporary permissions, and exceptions
- Door commands, lockdowns, alarms, acknowledgments, and response notes
- Event search, reporting, retention, export, and audit trails
- Maps, dashboards, health monitoring, and maintenance alerts
- Video, intrusion, intercom, elevator, gate, HR, and identity integrations
- Mobile administration and mobile credential provisioning
- Backup, restore, migration, API, and lifecycle tools
Ownership and administration
The end user should know who owns the tenant or server, primary administrator, data, licenses, integrations, domains, certificates, encryption keys, mobile-credential account, backups, and support relationship. Use named accounts, least privilege, multifactor authentication where supported, documented emergency access, and periodic administrator review.
Continuity questions
- Which door decisions continue without internet, cloud, server, or WAN?
- How long can controllers store events and configuration?
- What functions are unavailable during each outage?
- How are queued changes and events reconciled after restoration?
- Is there a tested configuration and database backup?
- Can an authorized owner export identities, events, and configuration?
- What happens when a subscription, certificate, domain, or support agreement expires?
Cybersecurity baseline
Inventory every server, controller, gateway, reader, workstation, mobile app, integration account, and service endpoint. Track supported versions and end-of-life dates. Require unique credentials, protected remote access, encrypted communications, logging, backups, change control, vulnerability response, and a clear division of responsibility between owner, IT staff, integrator, and provider.
Integration design
Identify the system of record for people, doors, video, visitors, alarms, and reports. Document data fields, synchronization direction, update frequency, authentication, permissions, failure handling, privacy, rate limits, version dependencies, and support ownership. An integration should solve a defined operational need rather than merely connect products.
Evaluation workshop
Use representative administrators, operators, IT staff, security staff, facility managers, and compliance stakeholders to walk through onboarding, access changes, lost credentials, emergency response, investigations, visitor arrival, contractor expiration, multi-site reporting, outages, and offboarding. Score the actual workflow, not only feature names.
Turnover record
Document platform and version, hosting location, tenant or server owner, support contacts, administrator roles, MFA status, licenses and renewal dates, controllers, integrations, data retention, backup and restore process, disaster recovery, remote-access path, patch responsibility, and approved change procedure.
Continue with system architecture, controllers and I/O, and the manufacturer and platform reference.
Information only. Confirm current platform capabilities, licensing, data practices, and cybersecurity documentation before selection or upgrade.
Publisher’s related applied reference: commercial access-control project applications.