Cloud-managed or on-premise?
Cloud platforms give you one console for every site, automatic updates, remote unlock and instant credential revocation, for a per-door subscription. On-premise servers avoid subscriptions and keep everything inside your network, but you own patching, backups and remote access.
Multi-site portfolios and organisations without IT staff generally land on cloud. Single sites with strict data-residency or air-gap requirements often stay on-premise.
Credentials: what to avoid and what to use
The credential decides how secure the door really is.
- Avoid legacy 125 kHz proximity fobs — they can be copied at a kiosk for a few dollars.
- Use encrypted smart credentials (for example DESFire EV2/EV3) or mobile credentials over Bluetooth/NFC.
- Mobile credentials cut issuing and collection costs and are revoked instantly when someone leaves.
- Use OSDP rather than Wiegand between reader and controller, so the reader link itself is encrypted and supervised.
- Add multi-factor (credential plus PIN or biometric) only where the risk justifies the friction.
The door is half the project
The software is the visible part; the opening is where the money goes. Each controlled door needs the right lock type for its fire and code requirements, request-to-exit hardware, position monitoring, power, and often an electrician and a door-hardware specialist.
Life safety wins every argument: free egress must work when power is lost, and fire-rated doors cannot be modified without regard to their rating. Get the authority having jurisdiction involved early on any change to an exit route.
Administration is the recurring cost nobody quotes
Ask how a new hire, a departing employee, a lost credential and a contractor with three-week access are handled. If the answer involves someone walking to a PC in a back office, the system will drift out of date — and stale credentials are the most common audit failure in access control.
Look for scheduled access rules, temporary visitor credentials, HR or directory sync, and an exportable audit trail.