Access control · Commercial
Cardlock — Commercial Security
Cards, fobs and codes instead of keys. Access you can grant in seconds, revoke in seconds, and audit afterwards — without recutting a single cylinder.
The core idea
A Key You Can Take Back Without Getting It Back
That single property is why access control exists.
A mechanical key has one incurable weakness: once it leaves your hand, you cannot un-issue it. An employee leaves on bad terms, a contractor finishes a job, a manager loses a keyring at a restaurant. The only way to restore control is to change the cylinder and reissue keys to everyone else — which is why so many businesses simply do not, and quietly accept that an unknown number of working keys exist.
A credential is different. Deleting a card from the system takes about ten seconds and the card becomes an inert piece of plastic. Nothing on any door changes. Nobody else is inconvenienced. The person holding it does not even need to be told.
The second property is time. A key works at three in the morning on a Sunday exactly as well as it does at nine on a Tuesday. A credential can be restricted to the hours that person should be in the building, which converts a lot of hypothetical problems into non-problems.
The third is the audit trail. Every presentation of every credential is logged. When something goes missing from a stock room, you are not guessing.
Components
What A Cardlock System Is Made Of
Understanding the parts makes it much easier to judge a quote.
Credentials
Cards, fobs, key tags, phone credentials or PIN codes. What matters most is the technology: older 125 kHz proximity cards can be cloned trivially with equipment sold openly, while modern encrypted smart credentials cannot.
Readers
The unit on the wall beside the door. Wiegand or OSDP wired back to a controller. OSDP is the modern choice because the line between reader and controller is encrypted and supervised.
Controllers
The brain that decides whether to unlock. It holds the permissions and it must keep working when the network or the internet goes down — a controller that fails open or fails locked because it lost its cloud connection is not acceptable.
Locking hardware
Electric strikes, electrified mortise locks, or magnetic locks. Each has different behaviour on power failure, and that behaviour has to match what the fire code requires for that door.
Request-to-exit and egress
The devices that let people out. On any door people leave through, free mechanical egress must always be available, regardless of what the electronics are doing.
Power and backup
Transformers, batteries and supervised supplies. A very large share of access-control failures are power failures, not software ones.
Management software
Where you add and remove people, set schedules and pull reports. You should hold the admin credentials for this, not the installer.
Door position and alarms
Contacts that tell you a door has been forced or propped. Without them, a system knows who was authorised but not what actually happened.
Mechanical override
A key that works when everything else does not. Every access-controlled door should have one, and somebody responsible should know where it lives.
Egress
Electronics Never Override The Fire Code
This is the single most important constraint in access control, and it is the one most often got wrong in installations we are called in to fix.
Ontario’s Fire Code and Building Code require that occupants be able to leave through an exit door in a single motion, without a key and without special knowledge. That requirement does not pause because a door has a card reader on it.
In practice that means every access-controlled door people exit through needs free mechanical egress. Magnetic locks in particular demand careful design: they must release on a fire alarm signal, on loss of power, and via a request-to-exit device and an emergency release button. A maglock that stays engaged during an alarm is not a security feature, it is a trap.
Delayed egress exists for genuine cases — stock rooms, care facilities — and it is permitted only under specific conditions with signage, alarms and a defined release time. It is not a way to make a fire exit harder to use because staff keep going out for a cigarette.
Non-negotiables on any access-controlled exit
✓ Free mechanical egress from the inside, always.
✓ Release on fire alarm, hard-wired, not software-dependent.
✓ Release on power failure where the door is an exit.
✓ A request-to-exit device that actually works.
✓ An emergency release button where required.
✓ A mechanical key override for the technicians.
If an installer proposes a door that cannot be opened from the inside without power, get a second opinion.
Credentials
Not All Cards Are Equal, And The Cheap Ones Are Not Secure
The most common access card technology still in service is a low-frequency proximity format designed decades ago with no encryption at all. The card broadcasts a fixed number and the reader accepts it. Devices that copy those cards in seconds are sold openly for very little money.
If your building runs on those, an ex-employee did not need to keep the card to keep access — they only needed to hold it near a cloner once. This is not theoretical; it is the most common real-world weakness in commercial access control.
Modern encrypted smart credentials work differently: the card and the reader perform a cryptographic exchange, and there is no fixed number to copy. Phone-based credentials go further again, since the secret lives in the phone’s secure element and is protected by whatever unlocks the phone.
Upgrading usually does not mean replacing everything. Multi-technology readers accept both the old and the new format, so a site can migrate department by department instead of in one disruptive weekend.
Running it well
Four Habits That Keep A System Honest
01
Delete on the last day
Not at the end of the month. A credential that outlives someone’s employment is the exact problem access control was bought to solve.
02
Audit the list quarterly
Print the active credentials and read the names. Every site we audit has cards belonging to people nobody can identify.
03
Use schedules properly
Most staff do not need access at three in the morning. Time restrictions cost nothing and remove a whole category of risk.
04
Test the fire release twice a year
Trigger the alarm and confirm every controlled exit door actually releases. This is the check that is never done until an inspection forces it.
You Do Not Have To Replace Your Locks To Get Access Control
The assumption that access control means ripping out every cylinder is what stops most small businesses even asking. It is not true.
A typical Whitby retail or office site needs electronic control on two or three doors — the main entrance, the staff entrance, and perhaps a stock room. Everything else stays mechanical, on a properly designed master key system, and the two systems coexist perfectly well.
That hybrid is usually the right answer commercially as well as technically: you get instant revocation and audit trails where they matter, without the cost and complexity of wiring every internal door in the building.
Questions
Frequently Asked Questions
What happens in a power cut?
It depends how each door is configured, and that configuration must match the fire code. Exit doors must allow free egress regardless. Controllers should hold their permissions and run on battery backup for a sensible period.
Can staff use their phones instead of cards?
Yes, on modern systems. Phone credentials are generally more secure than cards because the secret is held in the phone’s secure element and protected by the phone’s own unlock.
Can our old cards be cloned?
If they are older low-frequency proximity cards, yes, easily and cheaply. Tell us what format you run and we will tell you honestly where you stand.
Do we still need keys?
Yes. Every access-controlled door should have a mechanical override for power failures and technician access, and somebody responsible should know where those keys are kept.
Can we start with one door?
Absolutely, and most sites should. Put control on the doors that matter, keep the rest mechanical, and expand later if it earns its place.
Who holds the admin login?
You should. If an installer keeps sole administrative control of your access system, you do not control your own building. We hand over credentials as part of every installation.
Costing it
Where The Money Actually Goes
Access control quotes vary wildly for reasons that are rarely explained.
Doors, not users. The dominant cost is the number of controlled doors, because each one needs a reader, locking hardware, a request-to-exit device, cabling and a controller port. Adding fifty more staff to an existing system costs almost nothing; adding one more door costs real money. Design around that.
Cable runs. On a new fit-out, cabling is trivial. In an occupied building with finished walls, a concrete structure or a heritage frontage downtown, getting a cable from a door back to a controller can cost more than every piece of hardware on that door. It is the single biggest source of variation between quotes, and an honest installer will walk the routes before pricing.
Locking hardware choice. An electric strike into an existing frame is the cheapest option. An electrified mortise lock costs more but behaves better and looks like normal hardware. A magnetic lock is cheap to buy and expensive to do correctly, because doing it correctly means alarm interfacing, emergency release and power supervision.
Ongoing costs. Cloud-managed systems usually carry a subscription per door or per site. On-premise systems do not, but you own the maintenance and the backups. Neither is wrong; what is wrong is finding out about the subscription in year two.
The migration path. If you are replacing an old system, ask specifically whether existing credentials, cabling and door hardware can be reused. Multi-technology readers often let you keep the cards during a transition, and reusing sound cabling can halve the installation cost.
Service area
We Come To You
We are a mobile service — there is no shop counter to drive to. Whitby is our home base, and we cover Durham Region and the eastern GTA, day and night.
Not on the list? If you are anywhere in Durham Region, call and ask.
▸ Pringle Creek
▸ Lynde Creek
▸ Blue Grass Meadows
▸ Ashburn
▸ Myrtle Station
▸ Columbus
Locked Out? We Answer The Phone.
24/7 mobile locksmith service across Whitby, Brooklin and Durham Region. Real prices on the phone, a marked vehicle at your door, and a written invoice when we are done.