The retail & multi-site access control playbook

This playbook is for operators with somewhere between three and forty locations: boutique chains, restaurant and QSR franchisees, independent pharmacies, dental and medical groups, gyms, auto service shops, and cannabis retailers. The businesses look different on the sales floor, but behind the counter they have the same problem. A lot of people need to get into a lot of buildings, the people change constantly, and the owner is usually not in any of those buildings when something goes wrong.

We have "Loss Prevention" in our legal name, so retail doors are a subject we have opinions about. What follows is how we plan a multi-site rollout when an operations director or franchise owner calls us, written so you can use it whether or not you hire us.

Why keys break down at multi-site scale

A single store with a good manager can get by on keys. The trouble compounds with every location you add, for a few plain reasons.

• Turnover. Retail and restaurant staff turn over faster than almost any other workforce. Every departing key holder is either a rekey or a quiet decision to hope for the best, and most stores quietly hope.
• District managers carry key rings. One person with keys to eight stores is one lost lanyard away from eight rekeys. When that person leaves the company, the math gets worse.
• Rekeys are per store, every time. A locksmith visit, a new set of keys, and redistribution to everyone who still needs one. Multiply that by your store count and your annual turnover and it becomes a real line item that buys you nothing new.
• No record. A key cannot tell you who opened the rear door at 5:40 a.m. on a Sunday. When inventory goes missing, "who had a key" is the first question and nobody can answer it.
• Vendors and cleaners. Merchandisers, pest control, and cleaning crews end up with keys or door codes that outlive their contracts by years.

The shrink side matters too, though we are careful with numbers here. The National Retail Federation's last National Retail Security Survey put average retail shrink at 1.6% of sales for fiscal 2022, and it tracks employee theft as one of the main sources. NRF has since stopped publishing that survey in favor of a report on theft and violence, so treat any newer shrink figure you see quoted with some suspicion. Access control will not do much about shoplifting on the sales floor. It puts a name and a timestamp on every entry through the doors customers never use, and those doors are where internal loss and after-hours problems tend to show up.

The door-by-door plan for a typical store

Most retail and service locations have the same five or six doors worth thinking about. Not all of them need a reader. Here is how we usually treat each one.

The rear door deserves the most attention. It is where deliveries come in, where trash goes out, where employees take breaks, and where product leaves without passing a register. A held-open alert on that door, set to something like two or three minutes outside of scheduled receiving windows, tells you more about how a store actually runs than almost anything else you can install. Put a camera on it, inside and out, so the badge event and the video line up.

The storefront is the tricky install. Narrow-stile aluminum doors cannot take a standard lock, and the door is usually the store's main required exit, so whatever we do has to let people out without a key or special knowledge. That usually means an electrified exit device or a narrow-stile solution sized for the frame, and it is why these doors sit in the higher cost band. Our cost guide covers the hardware differences in more detail.

A few formats add their own doors. Pharmacies have the pharmacy area itself, where federal and state controlled-substance rules already dictate how drugs are stored and secured, and access logs support that paperwork rather than replacing it. Auto service shops have parts rooms and key drops. Gyms have a member entrance that may run 24 hours on its own credential rules. Cannabis retailers in California are the most regulated of the group: the Department of Cannabis Control's rules require commercial-grade, nonresidential locks on all points of entry and exit and on limited-access areas, and continuous camera recording covering entrances, exits, and limited-access areas with 90 days of retention. Those rules change, so read the current regulations and check local permit conditions before you design a dispensary. Medical and dental groups should also look at our notes on HIPAA and access control.

Opening and closing: first in, last out

Openings and closings are where most multi-site operators feel the difference first. With keys, the district manager finds out a store opened late when a customer complains. With access control, the store's first badge event of the day is a data point, and the system can compare it to the schedule.

A clean setup looks like this. The rear or front door accepts the opener's credential inside an opening window, say 45 minutes before open. The storefront unlocks on schedule at open time, but only after a manager has badged in that day (a "first person in" rule, which some platforms support), so a store nobody showed up to does not unlock itself for the public. At close, the storefront relocks on schedule, and the last manager out badges on the way out.

Tie the alarm into this and you remove the two classic failures: an alarm left disarmed overnight, and an alarm code shared with half the staff. Depending on the alarm panel and the access platform, the integration may be software-to-software or a simple wiring connection between the panel and a controller input. Either way the goals are the same: only certain roles can disarm, disarming is tied to a person, and a store that is still disarmed an hour after close generates an alert. If your policy has conditions tied to the alarm being armed, that last part matters more than you might think; we cover that in insurance and access control.

Some operators want a two-person rule for openings and cash-office entry, for safety and for cash accountability. Some platforms can enforce two credentials at a door; others can only report on it. Ask before you assume.

Central management: roles, not people

The mistake with a new portal is managing it one person at a time. At twenty stores that collapses within a month. Build a small set of role templates, each with a door list and a schedule, and assign people to roles and stores. When a new assistant manager starts, you pick the role and the store, and you are done.

Vendor credentials should expire. Give the merchandiser a mobile credential that works on Tuesdays from 6 to 10 a.m. at the rear door, and ends when the contract does. Delivery drivers generally should not get credentials at all; route them to a rear doorbell or intercom and have staff open the door.

Terminations should be one click. Revoking a person in the portal removes them from every store at once. That alone is the reason many operators switch. If your company uses a directory like Entra ID, or an HR system that feeds one, some platforms can sync users so that a termination in HR disables door access automatically. How well that works depends on the platform and on how your HR and identity systems are set up, and directory syncs run on an interval, so keep a manual revoke step for urgent cases. Our guide for IT directors goes deeper on directory sync and the security questions your IT team will ask.

The store standard: make every location a copy

The single most useful document in a multi-site rollout is a one or two page store standard. It says, for a typical store, which doors get what hardware, which readers and credentials you use, where the controller and network gear go, which role templates apply, and what the default schedules are. Every new store and every remodel gets a copy of it.

• One platform, one reader model, one credential type. Mixing platforms across stores gives you two portals and two sets of training. We install ProdataKey most often, and also Brivo and Verkada; our platform comparison covers how to choose.
• Mobile credentials by default. Staff already carry phones, and nobody has to mail badges to a new store. Keep a small stock of cards for people who will not use a phone.
• Naming conventions. Name every store and door the same way, such as "042 Tustin / Rear Receiving." When you have thirty rear doors in one portal, you will be glad you did.
• A defined exceptions list. Some stores will not fit the standard because of the building. Write down the deviation instead of letting each one drift.

Reporting that actually gets read

Access systems produce a lot of events. District managers will read about four reports, so pick those four carefully.

• Rear door held open, outside receiving windows, per store, per week. The stores at the top of this list are usually the stores with a shrink problem.
• After-hours entries. Anyone badging in when the store is closed, with a camera clip attached where the platform allows it.
• Opened late / closed early. First and last badge events compared to scheduled hours.
• Denied attempts and controller offline. Former employees trying old credentials, and stores whose doors are running on their last synced database.

Pairing access events with video is where investigations get short. If a case of product goes missing between Thursday's delivery and Saturday's count, you can list every rear door entry in that window and pull the camera clip for each one, instead of scrubbing two days of footage. That works best when the cameras and doors are planned together, which is why we quote video surveillance and access control as one layout for retail. For organized retail crime, which usually hits the sales floor, access control plays a smaller role; its job is keeping the back of the store controlled while staff deal with the front.

Network realities at the store level

Store internet is not office internet. Strip-center connections go down, ISPs vary by location, and the POS usually has first claim on whatever network exists. Plan for it.

• Offline operation. On the platforms we install, the controller keeps a local copy of credentials and schedules, so doors keep working during an outage and events sync afterward. Verify this for any platform you consider.
• Revocations wait for the connection. A credential you revoke while a store is offline will not reach that store until it reconnects. That is the main argument for the next item.
• Cellular backup. Access control uses very little bandwidth, so a small LTE backup on the controller's network keeps management alive through most ISP outages.
• Separate the traffic. Put door controllers on their own VLAN or network segment, away from the POS and guest Wi-Fi. Your payment compliance people will want that anyway.

Landlords, malls, and permits

Most retailers do not own their buildings, and that shapes the install more than people expect. Read the lease before scheduling anything.

• Landlord approval. Most leases require approval for alterations, and drilling a storefront frame or running conduit usually counts. Mall and shopping center landlords often have their own tenant criteria, approved-contractor or insurance-certificate requirements, and rules on when noisy work can happen.
• After-hours work. Enclosed malls commonly push installs to before or after trading hours. Plan the schedule, and the labor cost, around that.
• Shared doors. Rear doors onto a mall service corridor sometimes belong partly to the landlord's security plan. Confirm what you are allowed to change.
• Egress and permits. Anything electrified on a door that is part of the exit path falls under the California Building and Fire Code egress rules, and most jurisdictions require a permit and fire-marshal inspection for that work. The storefront is almost always in that category. A licensed contractor pulls the permits as part of the job; a quote that skips them is a warning sign.

Budgeting per store

Per-door pricing follows our cost guide: roughly $3,000 to $4,000 per door installed for a standard cloud-managed door, and $3,500 to $6,000 and up for aluminum storefront doors and doors that need electrified exit devices. Software runs about $10 to $30 per door per month. Here is how that tends to shake out by format. Door counts are typical, not rules.

As a worked example, a three-door store with an aluminum storefront, a rear door, and a cash office comes to roughly $9,500 to $14,000 installed and $30 to $90 a month in software. Twenty of those stores is roughly $190,000 to $280,000 in install cost, which is exactly why almost nobody does it all at once. Phase it. The software cost over five years matters as much as the install, and our total cost of ownership guide walks through that math.

Rollout: pilot first, then waves

On geography: our crews work Orange County and the surrounding Southern California area. If some of your stores are farther away, those sites may end up installed by another contractor. A cloud platform makes that workable, because the doors still land in your one portal as long as the other installer follows the same standard. Sort out early how a second installer gets access to your account, since platforms and dealer arrangements differ.

Mistakes we see on multi-site projects

• Letting each store pick its own system. Franchisees especially. Three platforms across fifteen stores means nobody has the full picture.
• Shared credentials. One "opening badge" on a hook, or one keypad code for the whole staff, destroys the audit trail that justified the project.
• Skipping the rear door to save money. It is the door that pays for the system.
• Mag locks on the storefront. Cheap to install, frequently unpermitted, and a real egress problem. We are hired to remove them regularly.
• No one owns the portal. Decide who adds and removes people, at the store and at head office, before the first store goes live.

If you are planning a rollout for Orange County or Southern California locations, we are glad to survey a pilot store and write the scope. Bring your door list, your lease, and your least favorite rear door.