SMSMC Blog
Data & Architecture GovernanceOctober 2026 · 6 min read

Door access that survives staff turnover: UniFi Access readers, hubs and credentials

Metal keys and shared door codes can't be taken back when someone leaves. How a UniFi Access design ties every door to a named person you can switch off the same day.

By Jim Venuto

The key that walked out the door

Illustration, not a real event: an office manager in Kingston counts the keys to the back door and gets a number nobody can explain. Two former employees never returned theirs. The alarm code hasn’t changed in four years because changing it means telling twelve people. Rekeying the locks is quoted, scheduled and postponed. Meanwhile, anyone who ever worked there can probably still get in.

None of that is negligence. It is what keys and shared codes do: they can be copied and shared, and they can’t be taken back remotely. Every departure leaves a little more uncertainty about who can open the door.

Why it happens

  • A key or code isn’t tied to a person. You can’t tell who used it, and you can’t turn off one person’s copy.
  • Offboarding is an IT checklist. Email and laptop get handled; the building doesn’t, because nobody owns it.
  • Rekeying is expensive and disruptive, so it waits for a crisis.

The design: every door opens for a named person, on a schedule

SMC’s preferred platform for small-business door access is UniFi Access. Ubiquiti describes it as license-free, running on a UniFi console with hubs and readers, most of them powered over the network cable (PoE) (Getting Started with UniFi Access). Where a business already has an access system that meets its needs, SMC designs around it.

The parts

  • A console that runs Access. Ubiquiti lists, among others, the Cloud Gateway Max (UCG-Max), Dream Machine Pro (UDM-Pro), Network Video Recorder (UNVR) and Network Video Recorder Pro (UNVR-Pro), and CloudKey+ (Consoles with UniFi Access Support). If your gateway doesn’t run Access, an NVR or CloudKey+ can be added.
  • A hub at each door that switches the lock and reads the door sensors. Options include the single-door Door Hub, Door Hub Mini and Access Ultra, the two-door Retrofit Hub, which works with existing Wiegand or OSDP readers so older wiring can stay, and the Enterprise Access Hub for eight doors (Choosing a UniFi Access Control Hub).
  • A reader people interact with. Models range from the G3 Reader to readers with cameras and doorbells, such as the G3 Reader Pro and G3 Intercom (Choosing a UniFi Access Reader).
  • A compatible electric lock, wired fail-safe or fail-secure as the door requires.

Ubiquiti states that all UniFi Access hubs and readers are certified to UL 294 (the access-control equipment standard) by Eurofins MET Labs, and that its own NFC cards and key fobs use AES-128 and ECDSA to resist duplication (UL 294-Compliant Door Access Control).

Credentials that belong to one person

Each person gets their own credential: an NFC card, the phone app, a PIN on readers with keypads, or a combination. Ubiquiti’s NFC cards are registered to a person in Access (Configuring NFC Cards). Shared cards and shared PINs defeat the purpose and shouldn’t be issued.

Some readers support facial recognition. SMC’s designs leave face recognition off by default; it is a business decision that needs a privacy review first, not an installer’s default.

Policies and schedules instead of “everyone, always”

Access assigns doors to people through access policies and schedules (Getting Started with UniFi Access). A typical small office has three or four:

GroupDoorsWhen
StaffFront, staff entranceBusiness hours plus an hour either side
ManagersAll doors, including server and records roomsAny time
Cleaning contractorFront, back hallTwo evenings a week
VisitorsFrontScheduled visit window only

Offboarding the building

The point of all this is the last day of employment. With Access, the departing person’s credentials are removed in the console the same afternoon, on the same checklist as their email. Nothing needs to be rekeyed. Then check: Access keeps a system log of unlocks, so you can confirm the card hasn’t been used since.

Write it into the offboarding checklist, name who does it, and have a second person confirm.

Video at the door

Readers with built-in cameras (such as the Intercom, G3 Reader Pro and G2 Reader Pro) can record a short clip whenever the door unlocks, with retention you set from seven days to three years, provided the console has a drive installed (Configuring Unlock Event Recording). Pairing a door with a Protect camera does the same with better coverage.

Power and emergencies

  • Power differs by hub. Ubiquiti lists the Door Hub, Door Hub Mini, Gate Hub and Elevator Hub on PoE++, Access Ultra on PoE+, the Retrofit Hub on a 12/24V DC supply, and the Enterprise Access Hub on AC power with a 36V DC input (Choosing a UniFi Access Control Hub). Plan backup power for each: for PoE-powered hubs, a battery-backed switch, such as Ubiquiti’s Mission Critical switch (UL 294-Compliant Door Access Control); for DC- or AC-powered hubs, a backed-up power supply sized by the installer.
  • Alarm Manager in Access includes Evacuate (unlock all doors at the site) and Lockdown (lock all doors) actions (UniFi Alarm Manager). Decide in advance who may trigger each.
  • Whether a lock should fail safe or fail secure, and how people get out, is a life-safety and code question. The local building department and fire marshal decide it, and the lock design must satisfy them before anything goes on the wall.

Checklist

  • Every door and every existing key, fob and code listed
  • Console that runs Access chosen; hub and reader chosen per door
  • One credential per person; no shared cards or PINs
  • Access policies and schedules for each group, written down
  • Building access removed on the employee’s last day, confirmed in the unlock log
  • Face recognition off unless a documented decision says otherwise
  • Backup power planned for each hub’s power type; Evacuate and Lockdown owners named
  • Lock hardware and egress approved by the local code officials

When to get help

SMC assesses the doors, designs the Access system and writes the specification. A licensed installer you contract with installs the hardware, and SMC reviews the bid and checks the finished doors against the specification. SMC doesn’t sell equipment or take commissions. UniFi is our preferred platform; if your existing access system fits, we work with that.

Start with the free security assessment at https://www.securitymedic.com/assessment. Physical security questions are covered there and on a free 30-minute call. You get a gap report to keep and a free results review.

Sources

Tags#physical-security#smb#ubiquiti#guide