Access control as a service (ACaaS) is a model for electronic door access in which the software that manages badges, permissions, schedules and door events runs on a provider’s cloud platform, typically for a subscription per door. On-site hardware, such as card readers, door controllers and electronic locks, stays in the building, but administrators manage it from a browser or mobile app instead of an on-site server. It is a common way to run physical security across several offices from one place.
At a glance
- Readers, controllers and locks stay on site; the management software and event history live in the provider’s cloud.
- Administrators grant or remove access, set schedules and review door activity across all sites from one interface.
- Many platforms support mobile credentials on phones as well as physical cards and fobs.
- Pricing is typically per door or controller per month, plus upfront hardware and installation.
- Life-safety and building code requirements still apply and vary by jurisdiction.
What problem it solves
Traditional access control runs on a server in a closet at each site, often with software that is rarely updated and only one or two people who know how to use it. Adding a new hire or removing a departing employee can mean logging into several systems, and an ex-employee’s badge sometimes keeps working at a site nobody remembered to update. Reviewing who entered a door last Tuesday may mean a trip to the building.
ACaaS centralizes this. Changes apply across sites from one console, the provider maintains the software, and event history is searchable remotely. Many platforms can tie into identity systems such as identity and access management (IAM) or HR tools, so door access can follow the same joiner and leaver process as network accounts.
How it works
On-site hardware. Readers at each door read a card, fob or phone. A door controller decides whether to unlock, based on the permissions it holds, and drives the electric lock. Controllers connect to the network and are Internet of Things (IoT) devices, so they should be placed on a protected network segment as part of IoT security.
Cloud platform. The provider’s platform stores users, credentials, door groups and schedules, pushes them to controllers, and collects door events. Administrators work through a web or mobile app.
Offline operation. Controllers commonly keep a local copy of permissions, so doors continue to work if the internet connection drops, then sync events when it returns. Exact behavior varies by product.
Integrations. Many platforms connect with identity providers, HR systems, visitor management, intercoms and cameras. Pairing with video surveillance as a service (VSaaS) lets staff jump from a door event to the matching video.
When it matters for buyers
- When opening a new office. Starting cloud-managed avoids another on-site server and lets central IT or facilities manage access from day one.
- When an on-site system reaches end of life. Replacing a server or unsupported software is the usual trigger.
- When offboarding is unreliable. If badge removal depends on someone remembering to log into each site, centralizing access closes a real gap.
- When standardizing multiple sites. One platform and one credential type across locations simplifies administration.
- When auditors or customers ask about physical access. Centralized logs make it easier to show who can enter sensitive areas and who did.
Questions to ask vendors
- Which readers, controllers and locks does your platform support? Can we reuse any of our existing hardware?
- What happens at the door if the internet or the cloud platform is unavailable?
- Which credential types do you support, and how resistant are they to cloning?
- Does it integrate with our identity provider or HR system for automatic provisioning and removal?
- How are administrator accounts protected, and is there an audit log of permission changes?
- Who installs and maintains the hardware, and who is responsible for code compliance at the door?
- If we leave, what happens to the controllers and our event history?
How it differs from on-premises access control
On-premises access control runs its management software on a server you own and maintain at a site or data center, usually bought upfront with optional support. ACaaS keeps similar door hardware but moves management to a provider’s platform paid by subscription, with the provider handling software updates and hosting. On-premises systems avoid ongoing platform fees; ACaaS trades them for remote, multi-site management with less to maintain. See our door access controls overview for help comparing options.