Vendor Site Access: Keys, Cards and Alarm Codes

Vendor site access is the part of contractor management that quietly decides how much risk you are carrying. Every key handed over, every fob programmed, every alarm code texted to a supervisor is a small transfer of control — and most buildings cannot say who holds what.

That is not a failure of effort. It is the normal result of years of one-off arrivals: a new crew, a lost fob, a cleaner who needs the roof door for a quarterly task. The fix is a register and a routine.

Key takeaways

Choose the lowest-privilege credential that lets the vendor do the work: time-limited fobs or codes before physical keys.
Record every issue in a single register with the holder's name, the credential, the date and the purpose.
Never let one credential serve a whole crew — individual credentials, individual accountability.
Treat alarm codes as credentials, change them when a holder leaves, and avoid shared codes.
Recover and disable within 24 hours of a worker leaving the contract, and confirm the disablement in writing.
Audit the register quarterly and after any change of vendor, and walk the doors yourself.

Why is vendor site access a health and safety issue as well as a security one?

Access control is usually filed under security, and in a commercial building it belongs there. But it is also a safety control, and managers who only think about theft miss half the picture.

Consider what access enables. A contractor with an unsupervised master key can enter a plant room and be alone with equipment they were never inducted on. A crew that arms the alarm incorrectly can leave the building unsecured overnight. A subcontracted cleaner whose credential was never disabled can still walk the corridors at 2am two months after the contract ended.

Access also enables the reporting that makes a contract work. When a cleaner finds a leak at midnight, the question is who they can reach and whether they can exit safely. The mechanics are covered in our note on lone working safety for cleaners, which is worth reading alongside your access rules.

There is a due diligence dimension too. If an incident involves someone who should not have had a key, the first document anyone asks for is the key register. If it does not exist, the conversation is not about the contractor.

Choose the credential with the least privilege

The mistake is treating "access" as one decision. It is a ladder, and you should always be on the lowest rung that lets the vendor finish the job.

Credential	Best used for	Control strength	Recovery cost
Escorted access only	Occasional visitors, one-off tasks, unfamiliar crews	Highest	None
Time-limited fob or card	Recurring nightly service, shift-based entry	High	Low — deactivate in software
Keypad or alarm code	Small sites without card readers	Medium	Low — change the code
Physical key, non-master	Locked cupboards, one door, one task	Medium	Medium — rekey that lock
Physical master key	Rarely justified for cleaning contracts	Lowest	High — rekey the building
Shared crew credential	Should be avoided	Very low	High — no individual accountability

Two rules follow. Escort anyone whose attendance is unpredictable — if a vendor turns up twice a year to service equipment, someone walks them in. And if a physical key is unavoidable, keep it off the master ring, so recovery does not mean rekeying the building.

Card-based systems are worth the modest setup effort for exactly this reason: credentials can be issued, suspended and audited with a date stamp, which is what makes a register provable.

Keep one access register

A register is a list, and its value is that it is a single list. If issue records live in three inboxes and a site folder, you do not have key control.

Record, as a minimum:

Credential identifier — fob number, key stamp, or code reference
Holder's full name, not the company name alone
The vendor and the site the credential applies to
Date issued and who issued it
The doors it opens, so privilege is visible
Date returned, disabled or rekeyed, and by whom
Any loss or damage, with the date reported

Then add a second column set for the person, not the object: induction date, record check where required, any restriction noted. Access without induction is the combination that causes incidents, and the two records belong side by side. The sequence for getting both in place is in our vendor induction and site rules guide.

Handover and return: making the record true

The register only helps if the events in it actually happened, which means handover and return need the same discipline as issue.

At issue:

Confirm the named individual has been inducted and, where required, checked — critical
Show them the doors the credential opens, and say which doors it does not
Record the issue in the register and give them a copy of what they signed for
For codes, avoid sending them by text message to a personal phone — critical

At return:

Set a return date at issue, always before the contract's end date
Collect the physical credential, or disable the digital one, the day the worker's last shift ends
Confirm disablement in writing to the vendor, with the date — critical
Update the register with the return date, the person who received it and the storage location

The hardest case is a worker who leaves the vendor's employment without anyone telling you. That is why the contract should require notice of any worker removal within 24 hours, and why quarterly audits exist: they catch the removals nobody mentioned.

Alarm codes and after-hours access

Codes feel less risky than keys because they cannot be physically lost. In practice they are worse, because they are shared freely and changed rarely.- Give codes to named individuals where the panel supports it, and delete the user when they leave.

Never use a single code across a crew, because a code used by nine people identifies nobody.
Change the code when any holder leaves, when the vendor changes, and on a fixed review date each year.
Keep codes out of unsecured documents, including the site folder in a cupboard a cleaner opens with a key.
Log after-hours entries where the system allows it, and review the log monthly.
Pair the code with the arming procedure — who arms, at what time, what to do if a tenant is still inside.

If your building uses a central station, tell the monitoring company which vendor companies are authorised on site and during which hours. A contractor who triggers an alarm at 1am and cannot identify themselves creates a police response you will have to explain.

Access failure is a contract issue, not a favour

Write access into the contract rather than treating it as an operational courtesy. Five clauses carry most of the weight:

Credential issue is conditional on induction, current insurance and any required record check.
No duplication of credentials. The vendor may not copy keys or share codes.
Immediate notification of any lost credential, any worker removal, any change of crew.
Cost recovery for rekeying caused by a loss the vendor failed to report promptly.
Return obligation with a defined period, and a stated consequence for non-return.

The insurance condition is not a formality. Access and insurance interact directly, and the sequence is worked through in vendor insurance verification.

Scope note: Lock hardware changes, electronic access system programming, alarm panel servicing and locksmith work are normally outside a property manager's hands-on remit and outside a cleaning contractor's scope entirely. Commission the work through your access control provider, and confirm in writing what the vendor is permitted to operate.

Quarterly audit: the fifteen-minute check that keeps the register honest

Once a quarter, take the register and the building and reconcile them. This is the step that turns a document into a control.

Compare the register to the access system's user list and delete anyone who appears in one and not the other.
Test a sample of returned credentials — a key marked returned that opens a door was not returned.
Check door hardware on any door the vendor uses, and log damage.
Confirm the alarm code change date and whether any holder has left since.
Review after-hours entry logs for entries outside the contracted service window.
Reconcile against the vendor's worker list, the only way to catch an undocumented subcontractor.

That last point matters more than it used to. A vendor that quietly subcontracted a shift has introduced people you never inducted, which sits alongside the wider question of who is responsible when a vendor subcontracts.

What to do when a credential goes missing

Treat a lost credential as an incident, not an inconvenience, and run a fixed sequence.

Restrict exposure first. If a master key is missing, rekey or reprogram before you finish the investigation.
Record the loss with the date it happened, the date it was reported, and who reported it.
Notify the owner or the building's security contact the same day.
Change any code the person knew, regardless of whether the credential itself was a code.
Review entry logs for the period between loss and report.
Put the response cost where the contract says it belongs, and apply it consistently.

How fast a vendor reports a loss tells you more about the vendor than the loss itself. A crew that reports a missing fob the same morning will report a spill the same shift.

Not regulatory advice. Privacy obligations around access records, record checks and monitoring vary by province and are enforced by privacy commissioners and provincial regulators. Confirm what you may collect, retain and disclose with your own advisor and follow the building owner's policies.

Frequently asked questions

Are alarm codes or physical keys safer for vendor site access?

Named-user alarm codes on a modern panel are generally safer than physical keys, because they can be changed instantly, they identify who entered, and losing them costs nothing to replace. Physical keys win only when the panel cannot support individual users. In both cases the risk is whether the credential is issued to a named person and removed when they leave.

How many keys should a cleaning vendor hold?

As few as the work requires, and preferably none. Where a key is unavoidable, issue one non-master key per shift to a named supervisor rather than a set to the crew. If your contract requires an on-site key set, the register should name the holder and the secure location.

How quickly should access be removed when a cleaner leaves?

Within 24 hours of the worker's last shift, and the same day where the credential is a master key or an alarm code. Confirm the removal in writing to the vendor with the date, so both files agree. Quarterly audits catch the cases where nobody told you.

Should the vendor be allowed to copy keys?

No, and the contract should say so explicitly, with a cost-recovery clause for any loss caused by unauthorised duplication. Unrecorded copies are how a building ends up with keys it cannot account for. A vendor needing more access should get a programming change or an extra issued credential.

What records should I keep for vendor access?

Keep one register showing the credential, the named holder, the vendor, the site, the doors it opens, the issue date and the return or disablement date. Keep induction and record-check dates next to it, and retain the records for the life of the contract plus your own retention period.

Take control of the register this quarter

Vendor site access does not need to be complicated, but it does need to be written down and reconciled. Pick the lowest privilege that works, issue to named individuals, record every issue and return, and walk the doors once a quarter. Then "who has a key to this building?" takes two minutes instead of two weeks.

Where this fits in the vendor management process

This is one part of a wider discipline. It sits alongside the vendor management lifecycle, which sets out how to select, onboard, monitor and renew the contractors a building depends on.

NeatScore gives you the site-specific checklist and dated report side of building oversight, so the condition of the building and the access walk are recorded in the same place, on the same day. Try it free for 14 days, or see pricing.