Access ControlFor Property Managers

Contractors, Vendors, and Cleaners: How to Give Access Without Losing Control

The cleaning crew has a code. The elevator guy has a fob. The HVAC company has a key from three years ago. Outside workers need to get in, but every shared code is a door you no longer control. Here is how to let them in on your terms.

PAX Security6 min readAugust 7, 2026

Quick Answer

Give every outside company or worker their own credential, never a shared code. Limit it to the doors and hours they actually need, set it to expire when the job ends, and check the door logs now and then. When the contract ends, turn the access off that day. Your access system can do most of this automatically once it is set up.

Key Takeaways

1Shared codes are the fastest way to lose track of who can open your doors
2Every vendor or worker should have their own credential so the log shows who came in
3Schedules limit access to the days and hours the work actually happens
4Set an end date when you create the credential, not when you remember later
5Ending access should be part of closing out every vendor contract

Make a list of every outside company that can get into your building right now. Cleaners. Elevator maintenance. The HVAC contractor. The exterminator. The fire alarm inspector. The plumber who did that emergency job last spring.

Now ask the harder question: how did each one get in, and can they still?

In a lot of buildings, the answer is a mix of shared door codes, a few fobs labeled "vendor" in a drawer, and keys nobody can account for. It works, right up until it does not.

Why shared codes are the problem

A shared code feels easy. You give the cleaning company 4-4-2-1 and you never think about it again. But think about where that code goes.

The company gives it to the crew. The crew changes. Someone who worked there two years ago still remembers it. Someone writes it on the inside of a supply closet door. And when something goes missing, your door log just says "code 4421" with no way to know who that was.

Shared codes and shared fobs also make it painful to cut anyone off. Changing the code means telling everyone else who uses it. So it does not get changed.

Give everyone their own credential

The single biggest improvement is simple: every outside worker gets their own fob, card, PIN, or phone credential. Not one per company. One per person, where you can.

This does two things. Your logs now show a name instead of a mystery code. And when one person leaves the cleaning company, you turn off that one credential without touching anyone else.

If a vendor sends different people every visit, give the company a small set of named credentials and ask them to tell you who holds each one. It is not perfect, but it is far better than one code for everyone.

Use schedules so access matches the work

Your cleaners come Monday through Friday from 7 p.m. to 11 p.m. So why can their fob open the door at 3 a.m. on a Sunday?

Most access systems let you attach a schedule to each credential. Set it to match the actual work:

Cleaners: their nights and hours, and only the doors they need
Elevator or HVAC maintenance: business hours, mechanical rooms and roof only
One-time contractors: the specific days of the job
Inspectors: a single day, with the super or a staff member present

If someone tries to use a credential outside its schedule, the door stays locked and the attempt shows up in the log. That alone tells you a lot.

Set the end date on day one

Here is the habit that fixes most of this problem: when you create a vendor credential, set it to expire. A three-week renovation gets a credential that ends in three weeks. A one-year cleaning contract gets one that ends when the contract does.

If the job runs long, you extend it. That takes a minute. What you avoid is the far more common situation where the job ended eight months ago and the credential is still active because nobody remembered.

Check the logs now and then

You do not need to watch the door log every day. But once a month, pull up vendor activity and skim it. You are looking for things that do not fit:

Visits on days the vendor was not scheduled
A credential that has not been used in months (probably should be turned off)
Repeated denied attempts outside the allowed hours
A one-time contractor whose credential is still being used

Most of the time you will find nothing. When you do find something, you will be glad you looked.

The logs also help when there is a dispute. A tenant says the cleaners never came. A contractor bills for six hours on site. A quick look at when their credential opened the door settles it without anyone arguing about it.

Ending access when the job ends

Make turning off access part of closing out every vendor. When you sign off on the final invoice, you also turn off the credentials, collect any physical keys or fobs, and change any codes they were told. Write it into your vendor checklist so it happens even when you are busy.

Keep a simple vendor sheet: company, contact, which credentials they hold, which doors, and the end date. Review it every quarter. It turns a messy drawer of fobs into something you can actually manage.

Keys are part of this too

Even in buildings with good access control, there is usually a ring of physical keys floating around. The boiler room. The roof. The meter closet. These get handed to vendors because it is faster than setting anything up.

Treat keys the same way you treat fobs. Sign them out with a name and a date. Get them back when the job is done. If a key to a sensitive room walks off and never comes back, change the lock instead of hoping for the best.

Where you can, move those rooms onto the access system. A reader on the roof door or the mechanical room means you get a log of every opening, and you never have to wonder who still has a copy.

Start with the doors that matter most: anywhere with building equipment, tenant storage, or a way onto the roof. Those are the rooms where an unknown key can cause the most trouble.

Outside workers are part of running a building. You do not need to make it hard for them to get in. You just need to know who they are, when they can come, and when it stops.

Every shared code is a door you no longer control.

Your Checklist

List every outside company with any way into your building
Replace shared vendor codes with individual credentials
Add a schedule to each vendor credential that matches their actual work hours
Set an expiration date on every new contractor credential
Skim vendor door activity once a month
Add "turn off access and collect keys" to your vendor close-out process

Common Mistakes to Avoid

Giving a whole company one shared code

You lose track of who it belongs to, it spreads to people you never met, and changing it disrupts everyone.

Giving 24/7 access to someone who works three nights a week

Access outside the work schedule is access nobody needs. Schedules take minutes to set up.

Planning to turn off access "when the job is done"

Jobs end quietly and the reminder never comes. Set the expiration date when you create the credential.

Frequently Asked Questions

What if a vendor sends a different worker every time?

Give the company a small set of named credentials and ask them to track who holds each one. Or use a system that lets you issue a temporary phone credential for that day. Both beat a shared code.

Do I need an access control system to do this?

Schedules, expiration dates, and logs require one. With only keys and a keypad, the best you can do is change codes often and keep a careful key log. If you have many vendors, a modern system pays for itself in time saved.

How do I handle emergency contractors at night?

Many cloud-managed systems let you unlock a door remotely or send a short-term credential from your phone. That way you are not handing out a permanent code at midnight.

Should vendors have access to tenant spaces?

Only where the work requires it and only for the time it takes. Keep building systems areas and tenant areas on separate access rules. For anything in your leases about entry rights, check with your attorney.