Access control maintenance and service agreements: what to expect

We have been installing and servicing security systems in Orange County commercial buildings since 1984. Most of what we install now is ProdataKey (PDK) cloud access control, with some Brivo and Verkada, plus the locksmith and door work that comes with any of them. That mix matters for this article, because a large share of the service calls we run on access control systems end up being door problems wearing an electronics costume.

What "maintenance" means on a cloud system

On a legacy on-premise system, a big part of maintenance was the server. Someone had to keep a Windows machine running in a closet, apply operating system patches, update the access control software, back up the database, and replace the whole box when it aged out. Firmware on the panels was often years behind, because updating it meant a site visit and a maintenance window. If you are still running one of those, our guide to replacing legacy access control walks through the signs it is time to move.

Cloud platforms move most of that off your plate. PDK, for example, pushes controller firmware and software updates from its cloud servers automatically, without a technician running the update on site. Brivo and Verkada work on the same general model. Hosting, backups, and the management software itself are the platform vendor's job, paid for through the subscription.

What is left is keeping the physical door and its power working, which needs a technician occasionally, and keeping the data clean (who has credentials, which schedules are current), which needs an admin with thirty minutes a quarter.

What actually fails in the real world

Roughly in order of how often they cross our service desk (our experience, not a study):

• Door hardware out of alignment. Buildings settle, hinges wear, and doors sag. An electric strike that lined up perfectly on install day starts binding against the latch a year later. The reader grants access, the strike fires, and the door still does not open, so the system gets blamed.
• Door closers. A closer that has lost its adjustment or is leaking fluid lets the door drift shut without latching, or slam hard enough to knock hardware loose. An unlatched door is an unlocked door no matter what the software says.
• Exit devices. Panic bars on busy doors take a beating. Electrified exit devices add a motor or solenoid and a power transfer hinge or loop, each of which wears.
• Power supplies and backup batteries. Controllers and locks run from power supplies with backup batteries. The batteries age quietly and nobody notices until the first long outage, when the locks drop in an hour instead of carrying through.
• Wiring. Pinched cables in door frames, loose terminations, and wires that pass through a door hinge and flex thousands of times a year. These failures tend to be intermittent, which makes them slow to diagnose.
• Readers. Exterior readers get hit by carts, pried at, sprayed, and occasionally cooked by afternoon sun on a west-facing wall. Vandal-resistant models help. They do not make the problem go away.
• Network and internet. A swapped router, a new firewall rule, a PoE switch someone unplugged to free a port, or an ISP outage. Cloud controllers generally keep making local decisions when the internet drops, but you lose remote management and live alerts until it comes back.
• Software. Rare, in our experience. When the platform has a problem, the vendor usually knows about it before you do, and it is fixed centrally.

In short, the door fails far more often than the electronics do. That is why who covers door hardware, which we get to below, is the most important line in a service agreement.

A preventive maintenance checklist and cadence

You do not need a technician on site every month. For a typical small or mid-size office, warehouse, or medical suite, this cadence covers most of the risk. Buildings with heavy traffic, exterior gates, or a lot of turnover should shorten the intervals.

Keep a simple log of each visit: date, what was checked, what was found, what was fixed. That log is what your insurer, your auditor, or a future buyer of the building will ask for, and it is the thing most buildings cannot produce. Our article on insurance and access control covers why service records matter at renewal time.

The three service models

The names vary between integrators, but most service offers fall into one of three shapes.

Break-fix means no contract: you call when something fails and pay the trip, labor, and parts. The catch is priority, since customers under contract usually get scheduled first when a technician's week is full. A preventive maintenance agreement adds scheduled inspections and usually a discounted repair rate for a fixed annual fee. Full coverage adds repair labor and covered parts on top, and its value depends almost entirely on the scope and exclusion language.

That last row is where confusion starts. The monthly subscription pays the platform vendor. It does not pay anyone to come fix a door. If you want to see how the recurring pieces add up over the life of a system, our total cost of ownership guide lays them out side by side.

SLA terms, in plain English

The service level section is where agreements differ most and where people read least carefully. These are the terms worth understanding before you sign.

• Response time. How quickly someone acknowledges and starts working on the problem. Read closely, because "response" can mean a phone call back, a remote login, or a technician on site. Those are very different promises.
• On-site arrival time. How quickly a technician is physically at the door, if a visit is needed. This is the number most people assume "response time" means.
• Restoration time. How quickly the door is back to a secure, usable state, even if the permanent fix comes later. For example, locking the door mechanically or swapping in a spare reader.
• Resolution time. How quickly the root cause is permanently fixed. Many agreements do not commit to this because it depends on parts availability, which is reasonable if restoration is committed.
• Coverage hours. Whether the clock runs 24/7 or only during business hours. A four-hour commitment during business hours means a Friday evening call may not start counting until Monday morning.
• Remote-first diagnosis. On cloud systems, a lot of problems can be diagnosed or fixed from the dashboard: a schedule error, a stuck unlock, a credential that was never assigned. A good agreement uses that first and dispatches a truck only when the problem is physical.
• Parts coverage. Which parts are included, whether they are new or refurbished, and whether manufacturer warranty replacements are handled for you or left to you.
• Labor coverage. Whether repair labor is included, discounted, or billed normally, and whether after-hours labor is billed at a premium.
• Exclusions. Nearly every agreement excludes damage from abuse, vandalism, accidents, and acts of nature, plus changes made by anyone other than the integrator. Many also exclude mechanical door hardware. Read this list first.

Realistic expectations on response

We are not going to quote you a universal response number, because there is not one. It depends on the tier you are paying for, the time of day, how far the technician is driving, and whether the part is on the truck. An office in Irvine or Costa Mesa is a different drive than a site at the edge of the county, and a call at 2 p.m. on a Tuesday is a different situation than one at 9 p.m. on a holiday.

What we would push you to do is ask for specifics in writing. What is the remote response commitment? What is the on-site commitment, and during which hours? What is the fallback if a part is backordered? Any integrator, us included, should be able to answer those questions on paper. If the answers only come up in the sales conversation, ask for them in the agreement.

It also helps to decide which doors are emergencies before you negotiate. A main entry stuck unlocked overnight is one. A storage closet reader is not. Paying for 24/7 response on the two or three doors that matter usually makes more sense than paying for it everywhere.

Who handles what

A controlled door involves several parties, and a lot of wasted time comes from calling the wrong one first. Here is how it usually divides.

One practical advantage of using an integrator that also does commercial locksmith and door work is that the line between electronic and mechanical stops mattering. One technician can look at a door where the strike, the closer, and the reader are all implicated, instead of three companies each pointing at the others.

The fire and life-safety piece

Many controlled doors, especially magnetic locks and some electrified exit devices on egress paths, are set to release automatically when the fire alarm goes off. That release is part of the building's life-safety system. Fire alarm testing standards (NFPA 72, which California adopts through its fire code) treat the interfaces that release doors as emergency control functions to be tested at acceptance and periodically after that, generally annually. California also expects fire alarm systems to receive regular inspection and testing by qualified contractors.

In practice the gap is coordination. The fire alarm contractor tests their panel, and the access control side is assumed to follow. Sometimes it does not: a relay was rewired during a remodel, a door was changed to a different lock, or a new door was added and never tied in. Ask your fire alarm contractor to include door release verification in the annual test, have your access control provider available or on site for it, and keep the record. Your local fire authority (in much of Orange County, the Orange County Fire Authority or a city fire department) has the final word on what applies to your building.

Budgeting for maintenance

Pricing varies too much between buildings for a precise number to be honest, but here is how it is commonly structured. Treat these as approximate, typical ranges from industry pricing guides, not a quote.

• Per door per year. Published guides put basic preventive service contracts somewhere around $100 to $300 per door per year, and fuller coverage higher. Complex doors (storefront glass, electrified exit devices, gates) cost more to maintain than a standard strike on an interior office door.
• Percentage of system cost. Some integrators price annual service as a percentage of the installed system value. Figures in the range of roughly 10 to 15 percent per year show up in industry guides for comprehensive maintenance. The percentage tends to fall as coverage shrinks.
• Batteries and wear parts. Batteries on a three to five year cycle, plus the occasional closer, strike, or reader. Even on break-fix, it is worth setting aside a small annual amount for these.
• Cloud subscription. Separate from all of the above. Our commercial access control cost guide covers typical per-door licensing ranges and install costs.

For a four-door office with newer hardware, break-fix with a disciplined admin doing the quarterly audit can be the right answer. For a building where a failed entry door stops the business, the math usually favors a contract.

Red flags in service contracts

• "Response time" with no definition. If the contract does not say whether response means a call, a remote session, or a technician on site, assume it means the least useful one.
• Account access tied to the agreement. If ending the service agreement means losing admin access to your own access control account, or being unable to move the system to another integrator, that is a lock-in clause. You should hold the owner or admin role on your own account.
• Auto-renewal with a long notice window, or annual price escalators with no cap. Both are easy to miss until the invoice arrives.
• An exclusion list that swallows the coverage. If door hardware, wiring, batteries, and "wear and tear" are all excluded, very little is left to cover.
• No written inspection reports. If you pay for preventive visits, you should receive a record of what was checked and found each time.

Several of these overlap with the points in our questions to ask an access control installer, which is worth reading before the original install, not only at renewal.

Questions to ask before you sign a service agreement

• What are the written commitments for remote response, on-site arrival, and restoration, and during which hours does each clock run?
• Which parts are covered, and is mechanical door hardware (closers, hinges, exit devices) in or out of scope?
• Is repair labor included, discounted, or billed normally? What is the after-hours rate?
• How many preventive visits per year, what gets checked on each, and do I get a written report?
• Are backup batteries tested under load, and are replacements included or billed?
• Will you coordinate with our fire alarm contractor on the annual door release test?
• Who holds the admin role on our cloud account, and what happens to it if we end the agreement?
• What is the renewal term, the cancellation notice window, and any annual price increase?
• What does the cloud subscription cover that this agreement does not, and the other way around?

If you are shopping for a new system and want service built in from the start, our access control installation page explains how we scope projects. Either way, the principle is the same: the software will mostly take care of itself, so spend your maintenance attention and budget on the doors, the power, and a contract that says in writing what happens when one of them fails.