Card-based access control: which card technology, which lock, which software?
An access control system manages the question "who can enter where and when." Unlike key distribution, a lost card can be revoked within minutes and every access is logged. However, the true security of the system lies not in the appearance of the card reader, but in the card technology used and the door's behavior during a fire — these are the two most frequently overlooked points.
Selection guide and FAQ
Card and identification technologies
Cards look similar from the outside; the security difference lies in the chip inside. In new installations, we do not recommend copiable technologies.
| Technology | Security | Note |
|---|---|---|
| 125 kHz proximity (EM/HID Prox) | Low | It is inexpensive and widespread but can be copied within seconds using simple devices obtained from the internet. Not recommended in new installations. |
| Mifare Classic (13.56 MHz) | Low–Medium | Its encryption was broken years ago; although still very common, it should not be preferred on security-critical doors. |
| Mifare DESFire EV2/EV3 | High | Current standard; uses mutual authentication and strong encryption. Default choice for new projects |
| Mobile credential (NFC/Bluetooth) | High | Phone instead of card; eliminates card printing and loss issues in personnel access control |
| Fingerprint / facial recognition | High | Card cannot be shared. However, biometric data is a special category of personal data — see warning below |
| PIN code | Low (standalone) | Shareable and visible over the shoulder. Meaningful when card + PIN are used together |
Lock selection and fire behavior
This table is one of the most critical decisions in the project: should the door remain open or closed during power loss?
| Lock type | Power failure | Where is it used |
|---|---|---|
| Electromagnetic lock (fail-safe) | OPENS | Doors on escape routes, fire evacuation doors — mandatory choice |
| Electric lock alternative (fail-secure) | REMAINS CLOSED | Interior doors without escape routes: storage, server room, archive |
| Motorized lock | Varies according to model | Main entrance, high-security door; selection is made according to project requirements |
| Turnstile / barrier | Transitions to free release mode | Personnel entry, lobby, parking; evacuation mode must be tested without fail. |
Decisive details in installation.
- Every door in the escape route must be electrically released when the fire alarm is triggered. This connection is taken from the relay output of the fire detection control panel and tested with an actual alarm during commissioning — merely drawing it in the design is not sufficient.
- An emergency exit button (green button or breakable glass) is installed next to the door; this guarantees exit from inside even if the entire system fails.
- If the door contact (door open?) and exit button are not connected, the system cannot generate "door forced" and "door left open" events. The real value of access control lies in these events.
- Separation of the reader and control panel is important from a security standpoint: when the reader on the outside of the door is removed, access to the cable that releases the lock must not be possible. The lock decision must always be made by the panel on the inside.
- Authorization is configured on a group and time zone basis, not per individual: for example, "cleaning crew, weekdays 18:00–21:00, office floor only." Per-individual definition becomes unmanageable as it grows.
- If personnel attendance tracking (PDKS) is required, it must be stated from the beginning: the same reader can be used but entry-exit direction distinction and transfer to payroll software must be configured separately.
- Uninterruptible power supply and battery are sized according to the current draw of the locks; electromagnetic locks draw continuous current and this load is underestimated in most projects.
Biometric data is classified as special category personal data under Law No. 6698, and its processing is subject to much stricter conditions than a standard card record. According to the established approach of the Personal Data Protection Authority, an employer cannot impose a biometric system on employees as the sole option; an equivalent alternative such as a card must be offered, explicit consent must be obtained without pressure, processing must be limited to its purpose, and it must comply with the proportionality principle. Additionally, transparency obligations and a separate data security arrangement are required. Our practical recommendation is: apply biometrics not to the entire building, but to a limited number of doors that genuinely require high security, and rely on strong card technology at other points.
Frequently asked questions
Can we use our existing cards in the new system?
Yes, if the readers support the card technology. However, if your existing cards are 125 kHz proximity or Mifare Classic, transitioning without card renewal keeps the system's security level at the legacy level. In most projects, we use devices that read both technologies together during the transition period and gradually renew the cards.
What happens if a card is lost?
The card is immediately revoked from the software; the lost card will not open any door thereafter and access attempts are logged. This is the biggest difference compared to keys — with a lost key, you need to change the lock cylinder.
Does the system work without internet?
Yes. The access list is maintained locally on the door control panels; even if the network or server is down, access continues to work and events accumulate in the panel's memory and are transferred when connection is restored. Internet is for remote management, live monitoring, and reporting.
Do doors remain locked in case of fire?
No, in a properly designed system. Doors on escape routes are installed with fail-safe locks and are released by a signal from the fire alarm panel; additionally, every door has an emergency exit button. This is the subject we focus on most because errors directly impact life safety.
Can elevators and parking lots also be included in the system?
Yes. In elevators, floor authorization (preventing access to certain floors without card reading), and in parking lots, barriers and license plate recognition can be integrated in the same software. This is a common configuration we install in residential complexes and office centers.