Access control: card, PIN or phone?

For a stable team, an individually assigned card or key fob usually offers the best balance between speed and control. A PIN is useful for temporary access when it belongs to one person and expires automatically. Phone credentials suit organisations that already manage users digitally and can support the required devices.

There is no universal winner. The right choice depends on who needs access, for how long, through which doors, and what must happen during a power, network or internet failure.

Cards are predictable and easy to revoke

RFID cards and key fobs work well for people who enter the same building every day. Each credential can be assigned to one user, limited to specific areas and disabled without replacing a lock or recovering physical keys.

Their weakness is straightforward: they can be lost, lent or left at home. The operating process matters as much as the reader. Staff need a quick way to report a loss, administrators need authority to block it, and replacements need to be available. Permissions should also be reviewed when someone changes role or leaves.

Cards are a practical fit for employees, residents and hotel guests when issuing and collecting them already fits the operation. The confirmed scope at The Felix 10, for example, includes centrally managed RFID credentials for guests and staff.

PINs work best when they expire

A keypad removes the need to hand over an object. It is useful for a contractor attending one morning, a supplier with a defined delivery window or a visitor arriving outside reception hours.

The common failure is one shared code that remains active for months. Once it spreads, the organisation cannot tell who used it and cannot revoke one person's access without disrupting everyone else. Individual PINs restricted by door and schedule are easier to control.

A PIN need not serve every entrance. Repeated entry slows people down at busy doors. A more sensitive area may justify combining it with another credential, provided the added friction matches the actual risk.

Phones reduce handovers but add dependencies

A mobile credential can be issued and revoked remotely. That can simplify access for distributed teams, shared workspaces and regular visitors, while avoiding a trip simply to exchange a card.

Test the whole journey before committing. Which phones are supported? Must the user install an app? Will the door open without connectivity or when the battery is low? What is the fallback for someone with an incompatible device? Who helps when activation fails at the entrance?

Mobile access removes some physical administration but creates account, enrolment and support work. It is a sensible trade when those processes already exist. Otherwise, a card may be less novel and far more predictable.

Define permissions before choosing hardware

Start with an access matrix. For each group, decide:

• Which doors and areas they may enter.
• The permitted days and times.
• Who approves, changes and revokes access.
• How long visitor and contractor access remains active.
• How entry and exit work during a failure.

This prevents two bad outcomes: everyone can enter everywhere, or every small change depends on one person. In a business, onboarding and offboarding should include access permissions as a routine step rather than an occasional clean-up.

Keep only the logs you need

An event linking a person, a door and a time is personal data. Before retaining every event indefinitely, define its purpose, who may inspect it and when it is deleted. Article 5 of the GDPR requires data minimisation, storage limitation and appropriate security.

Biometrics require a separate decision. They involve sensitive data and should not be added merely to eliminate cards. Portugal's data protection authority outlines the applicable conditions, including workplace access control. Necessity, legal basis and alternatives need consideration before hardware is selected.

Choose for the difficult day

Compare each option against four realistic events: a lost credential, urgent out-of-hours entry, an internet outage and an employee leaving. Then check whether the door, power supply, controller and remote management behave coherently in every case.

The answer may be mixed: cards for staff, temporary PINs for contractors and phone access for managers. Different credentials can work together when a single permissions and revocation policy sits behind them.

See how we approach access control and electronic security. To assess your site, tell us which doors, user groups and schedules need to be managed.