That model is changing. In a 2024 survey of 1,518 US IT and physical security leaders, run by The Harris Poll on behalf of Verkada, 26% described their physical security infrastructure as fully cloud-managed and 61% as a hybrid of on-premises and cloud. Of the respondents not yet fully in the cloud, 86% said they were considering a move (Verkada State of Cloud Security report). Keep in mind that this is a vendor-commissioned survey, and it covers physical security systems as a whole, not only access control.
Cloud-based access control centralizes permissions, supports remote administration and keeps audit records without an on-site server. But hardware selection, network connectivity and installation quality still decide how well any system performs at the door. This guide compares five platforms we see on the market and walks through how we evaluate security, integrations, offline behavior, scale and total cost of ownership.
Key Takeaways
- Cloud platforms host software, permissions and event logs off site. Controllers and readers still live at the door.
- Match the platform to your doors, sites, users and compliance needs, not to the brand.
- Check cybersecurity, credentials, offline behavior, integrations and support before you sign.
- An integrator can tie access control into video, fire and communications, and handle the door hardware that software demos skip.
Overview of Cloud-Based Access Control in the US Market
Cloud-managed physical access control governs entry through doors, gates, elevators and restricted areas using readers, credentials, controllers and cloud-hosted software. That is different from "cloud access control" in IT security, which governs who can log in to applications and data, not who can walk through a door.
This model tends to suit:
- Multi-site businesses managing many locations from one office
- Healthcare networks controlling pharmacies, labs and patient units
- School districts and campuses that need consistent lockdown procedures
- Government and municipal facilities that need documented entry records
- Banks and other regulated branches controlling vaults and back-office areas
- Plants and manufacturing sites restricting production zones
- Data rooms that require strict physical security controls
What You Actually Gain
Cloud access control changes how you run doors day to day. Organizations typically gain:
- Central administration across every building from one console
- Faster credential changes when someone is hired, transferred or terminated
- Remote troubleshooting without a truck roll for every issue
- Activity records ready for compliance reviews
- Vendor-managed software updates instead of a server patch schedule you have to own
- Portfolio-wide visibility for directors managing multiple sites
A caution from the field: "automatic updates" usually covers the cloud software. Controller and reader firmware may still need a plan. In most organizations firmware has no owner and no written policy, so it rarely gets updated even once a year. Name an owner, and confirm each device still works after every update.
Cloud vs. On-Premises: The Real Trade-offs
| Factor | Cloud-Based | On-Premises |
|---|---|---|
| Server ownership | Provider-hosted | Customer-owned |
| Software updates | Handled by the provider | Scheduled by your team or integrator |
| Remote access | Built in | Requires VPN or extra setup |
| Cost structure | Recurring subscription | Higher upfront capital cost, plus support agreements |
| Hardware dependency | Still requires local controllers | Local controllers plus server |
| Continuity during outage | Depends on the controller's local caching | Local, unaffected by an internet outage |
How we frame the decision for clients: if you have one or two buildings, a strong IT team and an existing on-prem system that still meets your needs, there may be no reason to move yet. If you have many small sites, no one to patch a server, and badge changes that take days, cloud is usually the better fit. Also check your IT policies early. Some organizations require security review of any cloud service before controllers can talk outbound through the firewall, and that review can take longer than the install.
Treat every platform below as an example to evaluate, not a default pick. Confirm current features, pricing and availability with each vendor before you commit. None of these five is listed here as an IPS technology alliance.
Top Cloud-Based Access Control Systems in the US
This shortlist includes platforms with established cloud management, documented physical access control capabilities and commercial integrations.
Each one fits at least one major customer segment: enterprise, distributed retail, healthcare, or technology-focused offices.
Brivo
Brivo introduced its cloud (SaaS) access control platform in 2002. In December 2025, Brivo and Eagle Eye Networks announced a merger, with the combined company operating under the Brivo name and bringing access control, video, visitor management and intrusion together as the Brivo Security Suite (Brivo). The platform centralizes doors, users and policies across a portfolio.
Credential options include mobile or wallet passes, cards and fobs, PINs, license plates, and biometrics for higher-security areas. Brivo's Identity Connector syncs users with Microsoft Entra ID and Okta, and Brivo cites more than 400 technology partners.
Comparison snapshot:
- Best for: Enterprise organizations managing large, distributed portfolios
- Offline behavior: Panels store credentials and rules locally; optional cellular modules add a backup communication path
- Considerations: The product line is in the middle of a merger, so confirm the roadmap and licensing for the modules you need
- Pricing approach: Subscription plus hardware; confirm with the vendor or your integrator
Kisi
Kisi's One Security Platform manages access control, visitor management, video surveillance, analytics and intrusion detection from one interface. It is popular with offices, coworking spaces and fitness facilities that want a simple user experience.
Kisi supports card credentials, mobile credentials and Apple Wallet. For identity, it supports SSO with Microsoft Entra ID, Google, JumpCloud, Okta and OneLogin, plus SCIM provisioning.
Comparison snapshot:
- Best for: Offices and multi-location businesses that want fast deployment and a modern app experience
- Offline behavior: Kisi describes its offline support as fully encrypted and authenticated, so access continues during internet outages
- Considerations: Hardware (controllers, readers) is separate from the software subscription
- Pricing approach: Kisi lists the One Security Platform starting at $99 per month, with add-ons and hardware on top
Avigilon Alta (formerly Openpath)
Motorola Solutions acquired Openpath in 2021 and rebranded the platform as Avigilon Alta. It keeps the mobile-first, touchless entry Openpath was known for, including Wave to Unlock entry at the reader with a mobile credential, plus key cards and intercom options, with video integration when paired with Avigilon cameras.
Multi-site organizations can manage users and permissions across locations from one console, which makes Alta a fit for companies that want mobile entry combined with video.
Comparison snapshot:
- Best for: Organizations prioritizing mobile-first entry and video and access together
- Offline behavior: Controllers cache access policies locally and keep granting or denying access during an internet outage; power-outage behavior depends on backup power and how each door is wired (fail-safe or fail-secure)
- Considerations: Smartphone reliance and legacy hardware compatibility are worth confirming during a site assessment
- Pricing approach: Subscription plus hardware; total cost varies by reader and controller count
Salto KS
Salto KS is a cloud platform built around wireless and electronic locking hardware rather than traditional wired controllers.
An IQ gateway connects to the cloud over Wi-Fi, Ethernet/PoE or cellular, then communicates wirelessly with the locks. Salto lists up to 16 doors per IQ. That setup fits buildings where running cable to every door is not practical.
The hardware range includes electronic locks, cylinders, padlocks, locker locks and wall readers. Credentials include tags, digital keys and PINs.
Comparison snapshot:
- Best for: Distributed facilities or older buildings where wireless locking reduces installation work
- Offline behavior: Offline access is enabled automatically for PINs; for digital keys and tags it must be enabled manually, and locks then fall back on stored data if they cannot reach the IQ (Salto)
- Considerations: The IQ must reconnect to push rights changes to the locks, and battery replacement becomes a maintenance task
- Pricing approach: Subscription plus locks and gateways; installation scope depends on existing door hardware
Verkada Access Control
Verkada's access controllers are managed in the same Command platform as its cameras, sensors and alarms. Doors can be linked to camera views, which gives investigators video next to each access event.
Credentials include mobile NFC in Apple Wallet, Bluetooth, keycards and license plate recognition. Verkada supports Wiegand readers, and OSDP through Verkada and third-party readers, so existing readers do not always need replacing. Controllers such as the AC42 cache events, settings and lock schedules on the device and keep working during an internet outage. Verkada completes annual SOC 2 Type 2 examinations, and its Command platform is certified to ISO 27001:2022, which is worth reviewing in regulated industries.
Comparison snapshot:
- Best for: Organizations that want video and access control in one interface
- Offline behavior: On-device caching; confirm behavior for the specific controller model you are quoted
- Considerations: Licensing adds up on larger portfolios; for example, mobile NFC requires one license per 20 users
- Pricing approach: Hardware plus subscription licensing, with separate mobile NFC licenses
How We Chose the Best Cloud-Based Access Control Systems
Treat this list as a research-based shortlist, not a ranking. The most common buying mistake we see is comparing software demos side by side without checking the hardware quote, migration plan or credential lifecycle behind each one.
Here is what actually separates a good fit from a bad one:
- Security and administration. Evaluate encryption, role-based permissions, revocation speed and protection of the audit trail. NIST SP 800-53 access enforcement and audit protection controls are a useful benchmark for vendor claims.
- Reliability during outages. Confirm how controllers behave without internet. Do doors keep working from cached data? What about mobile credentials? What happens on power loss?
- Integrations. Check compatibility with existing readers, video, intercoms, fire alarm release and HR or identity platforms before you assume a rip-and-replace.
- Total cost of ownership. Add hardware, licensing, installation, training and replacement credentials, not just the advertised subscription. Compare over five years, not one. In Mastering Modern Security, IPS's Rob Jackson notes that a subscription shifts spending from capital to operating budgets, much as many IT teams already lease hardware on five-year refresh cycles. Bring finance in early on tax and depreciation, and include warranty and maintenance costs on both sides so the comparison is fair.
- Vendor and implementation support. Review support hours, documentation and experience in regulated environments such as healthcare or government.
What Goes Wrong in Cloud Access Control Projects
The software is rarely the problem. These are the issues we see most often:
- No door hardware survey. Frames, strikes, maglocks and door closers that were fine for keys fail under electrified hardware. Survey every opening before you price the job.
- Fail-safe vs. fail-secure mistakes. An egress door wired the wrong way can trap people or leave a building open during a power loss. Confirm each door's behavior with the AHJ, and coordinate fire alarm release.
- Network assumptions. Controllers need a place on the network, a PoE budget on the switch and outbound firewall rules. Get IT involved at design, not the week of install, and keep them involved after go-live: a new firewall or threat-detection rule can quietly cut controllers off from the cloud.
- Reader reuse without a plan. Older Wiegand readers can often stay, but the reader link is unencrypted. If you are opening walls anyway, consider OSDP readers.
- No credential owner. Someone has to remove departed users, review access levels and audit admin accounts after go-live. Cloud does not do that for you.
- Big-bang cutovers. Switching every site in one weekend leaves no room for surprises. We usually recommend a pilot building, then a phased rollout.
Conclusion
The best cloud-based access control system is the one that fits your risk profile, building types, existing infrastructure and growth plans.
Before you pick a platform, ask for:
- A site assessment that includes door hardware
- A migration plan, including how old and new systems run side by side
- Security documentation from the vendor
- A full cost model from hardware through year-three support
Since 1998, IPS has helped businesses and public-sector organizations protect their people, property and critical assets. We design and install access control alongside video, fire and communication systems for healthcare, education, manufacturing and government clients.
We do not manufacture products. We assess your facilities, design the system, integrate the right cloud or on-premises platform, and support it after go-live, including device-health monitoring through our Network Operations Center and hosted and managed services.
If you are weighing these options for a multi-site rollout, contact us at salesteam@ipsystems.tech or (330) 963-0064 to Schedule an Access Control Assessment.
Frequently Asked Questions
What is a cloud-based access control system?
It is a physical security system where the management software, credentials, permissions and event logs are hosted in the cloud, while local controllers and readers still control the doors. Always confirm how the system behaves offline and what controls protect the cloud side.
What is access control in cloud computing?
It means managing who can reach cloud-hosted applications and data, using identities, permissions and authentication, rather than physical doors. It is related to cloud-managed door hardware but separate, even though both rely on audit logs and role permissions.
What is ACL vs RBAC?
An access control list (ACL) assigns permissions directly to specific users or resources. Role-based access control (RBAC) assigns permissions by job role, which is usually easier to manage across large access control deployments.
What is an example of DAC?
Discretionary access control (DAC) lets an owner or administrator decide who gets access. A simple example: a facilities manager gives one contractor a temporary badge to a mechanical room for the length of a repair job.
Are there different types of cloud security I should know about?
Yes. The main categories include identity and access management, data protection, network security, endpoint security, monitoring and physical security. They depend on each other; weak identity controls, for example, can undermine the rest.
Is NAC a firewall?
No. Network access control (NAC) decides whether a device or user should be allowed onto a network, while a firewall filters traffic according to security rules. Neither refers to physical door access control.
