Buying Guide · Key Card Access · Commercial
Key Card Entry System Guide for Businesses.
For business owners, office managers, and facility teams replacing mechanical keys with card access — what a commercial key card entry system is, how key card access actually works, the hardware it needs, how cards compare to fobs and mobile credentials, and what it costs to retrofit your doors. Written from the supplier side, in Canadian dollars, with no sales fog.
Procurement-Aware
Encrypted Credentials
Ottawa / E. Ontario
01 / What It Is
A key card entry system replaces keys with software.
A key card entry system is a commercial access control system that swaps mechanical keys for contactless cards. Instead of a metal key turning a cylinder, an employee taps a card at a reader; the reader passes the credential to a controller, and the controller decides — in software, in milliseconds — whether to release the lock. Because every door is governed by software rather than a physical key, you control who goes where, when, and you have a time-stamped record of every entry.
That single change solves the problems that make mechanical keys expensive for a business: keys get copied at any hardware store, a lost master key can force a full rekey, and a paper key log tells you nothing about who actually used a door. A commercial card access system fixes all three. The card is just one form factor of the credential — flat, printable, and easy to badge — but the system behind it is the same commercial platform that also issues fobs and mobile credentials. Five components make it work:
- The card (credential) — a flat contactless card each person carries. It holds an encrypted ID, not a door code, so it cannot be copied like a metal key, and it can be printed with a photo or company branding.
- The reader — mounted at the door, it reads the card and sends the ID to the controller. Modern readers use the encrypted OSDP protocol.
- The controller — the decision-maker. It holds the access rules (who, which door, what hours) and releases the lock when a valid card is presented.
- The locking hardware — an electric strike or magnetic lock that physically holds the door until the controller says to release it.
- The management software — where you add and remove cards, set schedules, and read the audit log. Cloud-hosted or on-premise.
A business system can start as small as one reader, one controller, one lock, and a batch of cards on a single door — the front entrance — and extend to the whole building on the same platform. The decision-layer overview of the wider system lives in the access control system buying guide; this guide focuses specifically on the key card model.
02 / How It Works
Tap, decide, unlock — and the technology behind it.
Every time someone uses an office key card, the same four-step cycle runs in well under a second: the card is presented, the reader captures its encrypted ID, the controller checks that ID against the access rules and schedule, and — if it passes — the controller releases the lock and writes the event to the log. Deny an expired or unknown card and that attempt is logged too. The intelligence lives in the controller, which is why a lost card can be cut off instantly without touching the door.
What separates a secure proximity card access system from a cloneable one is the credential technology inside the card. This is the single most important specification decision you will make, because the reader and the card must match, and the cheap option is also the insecure one.
| Technology | Security | Best for | Relative cost |
|---|---|---|---|
| 125 kHz proximity | Low — easily cloned | Legacy systems only; avoid for new installs | $ |
| 13.56 MHz smart (MIFARE) | Medium | General commercial use | $$ |
| DESFire EV3 (encrypted) | High — mutual authentication | Offices, sensitive areas, multi-site | $$$ |
| Mobile credential (phone) | High — adds phone biometrics | Modern offices, contractor access | $$ / user / yr |
03 / What’s Included
Key card system components, per door.
A key card system is priced and built one door at a time. Whether you are securing a single front entrance or planning a twenty-door building, each controlled opening carries the same set of parts. Knowing this list lets you read a quote critically and budget accurately.
| Component | Role at the door |
|---|---|
| Reader | Reads the card and sends the encrypted ID to the controller |
| Controller (shared) | Holds the rules and releases the lock; a 1/2/4-door panel is shared across doors |
| Electric lock or strike | Holds the door until the controller releases it — strike, maglock, or electrified mortise |
| Request-to-exit (REX) | Lets people leave freely and unlocks for egress — a fire-code requirement |
| Door contact | Tells the system whether the door is open, closed, or held |
| Power supply (shared) | UL-listed supply with battery backup, shared across doors |
| Cards / credentials | One per person, plus a small spare batch; optionally photo-printed |
The controller and power supply are shared, which is why cost per door drops as you add doors to one panel — a four-door controller is cheaper per opening than four single-door units. For the math behind sizing the shared power supply across doors and locks, see the power supply sizing guide, and for choosing the controller itself, the controller architecture guide.
04 / Card vs Fob vs Mobile
Key card vs key fob vs mobile credentials.
A common misconception is that a card, a fob, and a phone credential are different systems. They are not — they are three form factors of the same credential, read by the same reader and managed by the same software. You can mix them freely on one platform. The choice is about how people carry their credential and whether you need a printable badge, not about which one is more secure.
| Form factor | Strengths | Trade-offs | Best for |
|---|---|---|---|
| Key card | Printable photo ID / branding, flat for wallet or lanyard, lowest unit cost | Wears with daily flexing; easy to leave behind | Offices, visitor badges, sites needing visible photo ID |
| Key fob | Rugged, clips to a keyring, hard to lose | No printable surface; bulkier on a lanyard | Field staff, warehouses, keyring carriers |
| Mobile credential | Phone biometrics add a second factor; issue or revoke remotely | Per-user annual fee; depends on staff phones | Modern offices, contractors, remote provisioning |
For most businesses the practical answer is a blend: printed cards where photo identification or badge visibility matters (reception, visitor passes, regulated areas), fobs for staff who prefer a keyring token, and mobile credentials for contractors and remote provisioning. Because all three run on one system, you are never locked into a single choice.
If a keyring token suits more of your staff than a printed badge, the companion key fob system for business guide covers the same platform from the fob side. The underlying security tiers — proximity, smart, encrypted, mobile — are identical and are detailed in the credential selection guide.
05 / Where It’s Used
Where businesses use card access.
Most businesses move to key card entry after a specific trigger — a lost master key, a departed employee who never returned their keys, an insurance or compliance requirement, or simply outgrowing the ability to track who has access. Card access fits cleanly in environments where photo identification, schedules, and per-person accountability matter:
- Offices and professional suites. Front-door access during business hours, restricted server and records rooms, and printed photo badges for staff and visitors.
- Multi-tenant and commercial buildings. Per-tenant access zones, shared entrances, and after-hours scheduling on common doors.
- Clinics, labs, and regulated facilities. Audit trails and restricted-area control to satisfy privacy and compliance requirements.
- Schools, non-profits, and member facilities. Badge-visible identification and time-windowed access for staff, contractors, and members.
- Warehouses and light industrial. Controlled entry on dock and office doors, often blended with fobs for floor staff.
The common thread is the need to grant, schedule, and revoke access in software and to know — by name and timestamp — who used a door. Wherever that matters, a key card entry system replaces the guesswork of a metal-key ring.
06 / Retrofit
Retrofit and door hardware considerations.
Most businesses are not building new — they are adding card access to doors that already exist. The good news is that a key card system retrofits onto existing openings in the majority of cases: the door leaf and frame usually stay, and you add a reader, an electric lock or strike, a request-to-exit device, and a cable run back to the controller. The cost lives in the cabling and the door preparation, not in the cards.
The locking hardware is what varies most by door type, and getting it right is the difference between a clean retrofit and a callback:
| Door type | Typical locking hardware | Retrofit note |
|---|---|---|
| Interior wood / hollow-metal | Electric strike | Lowest-cost retrofit; frame prep required |
| Glass storefront / aluminium | Maglock or specialty strike | Needs the right bracket kit; verify frame depth |
| Fire-rated opening | Fail-secure strike or electrified mortise | Must hold latching; never defeat the fire rating |
| High-traffic / exterior | Maglock with REX + door position | Weather-rated reader; egress must be code-compliant |
Cabling back to the controller is the other variable — distance, conduit, and fishing cable through finished walls drive the labour. Plan reader and lock power against the same shared supply covered in the power supply sizing guide.
07 / What It Costs
Cost factors for commercial card access.
Cost tracks the per-door model. A standard commercial opening — reader, lock, REX, contact, the controller’s share, cabling, and labour — runs roughly CAD $1,500 to $4,000 fully installed. The cards themselves are the cheap part: $1 to $8 each depending on credential technology, with photo printing adding a small per-card cost. Software is either a cloud subscription (per door, per month) or a one-time on-premise license.
| Deployment | Profile | Budget envelope |
|---|---|---|
| Single door | One entrance, small office | $2,000–$5,000 |
| Small business | 2–4 doors, single site | $5,000–$15,000 |
| Mid-size facility | 8–16 doors, single site | $18,000–$55,000 |
The line items businesses most often underestimate are the cabling runs, the per-door locking hardware (glass and exterior doors cost more), and — on cloud platforms — the recurring per-door subscription. Card printing hardware is an optional add if you want photo badges in-house.
These are planning envelopes, not quotes. The full per-door breakdown, the upfront-versus-recurring math, the cloud-versus-on-premise crossover, and the items buyers forget are all in the commercial access control system cost guide.
08 / Choosing a System
Choosing compatible hardware.
The most expensive mistake in card access is buying parts that do not speak to each other — a card that the reader cannot decode, or a reader the controller cannot talk to. Compatibility runs along three links in the chain, and all three must match before you order.
- Card ↔ reader. The card’s credential technology (e.g. DESFire EV3) must be one the reader is configured to read. Mixing a smart card with a proximity-only reader simply will not work.
- Reader ↔ controller. Specify OSDP rather than legacy Wiegand. OSDP is encrypted, bidirectional, and supervised; Wiegand is unencrypted and being phased out. Choosing OSDP-capable readers now avoids a costly reader swap later.
- Controller ↔ software platform. The controller must be supported by your chosen management software, and the platform determines whether you are cloud or on-premise. This is the decision that locks in your ecosystem, so make it deliberately.
Two more decisions shape the spec: the credential tier (encrypted DESFire as a baseline, never default to 125 kHz proximity) and compliance — if you sell to government or federally funded entities, specify NDAA-compliant hardware at purchase, because retrofitting later is far more expensive. See the NDAA compliance checklist.
The full owner-and-procurement walkthrough — scope to install in six steps — is in the access control system buying guide. The procurement pattern most commercial buyers follow to assemble and approve the budget is documented in how businesses buy commercial security equipment.
09 / Recommended Categories
Recommended product categories.
When you turn a plan into an order, these are the proven commercial components that make up a key card system. Each scales cleanly from a single door to a multi-site deployment, and all are stocked for owner-supplied (free-issue) procurement.
Controllers
- Kantech KT-1 — 1-door IP, lowest entry point
- Kantech KT-2 — 2-door IP
- Kantech KT-400 — 4-door, best $/door at scale
Card readers
- HID iCLASS SE R10 — mullion / frame mount
- HID iCLASS SE R40 — wall mount
Cards & credentials
- HID DESFire EV3 — encrypted cards & fobs
- HID Origo mobile — phone credential, per-user/year
Locking hardware
- Securitron M62 — 1200lb maglock
- HES 1006 — universal electric strike
- Bosch DS150i — request-to-exit sensor
Power
- Altronix AL400ULB — 12VDC UL access supply
- Altronix Maximal3D — power distribution
Plan the spec
- Buying guide — how to choose
- Cost guide — what to budget
- Key fob guide — the fob form factor
Reader-to-controller protocol matters to both security and longevity — modern key card systems standardise on the encrypted, bidirectional OSDP standard rather than legacy Wiegand. Specifying OSDP-capable readers now avoids a costly reader swap later.
10 / Key Card FAQ
Business key card questions, answered.
What is a key card entry system?
A key card entry system is a commercial access control system that replaces mechanical keys with contactless cards. Each employee carries a card; a reader at the door reads the card and passes its encrypted ID to a controller, and the controller decides in milliseconds whether to release the lock. Because access lives in software, a lost card is deactivated instantly instead of forcing a lock rekey, and every entry is time-stamped and logged. A basic office key card entry setup is one reader, one controller, one electric lock, and a batch of cards on a single door; the same platform scales to dozens of doors across multiple sites.
How does a key card access system work?
When a card is presented, four steps run in under a second: the reader captures the card’s encrypted ID, the controller checks that ID against the access rules and schedule, the controller releases the lock if the card passes, and the event is written to the audit log. Denied attempts are logged too. The intelligence sits in the controller, not the door or the card, which is why a lost card can be cut off instantly across every door without any physical change to the hardware.
What is the difference between a key card and a key fob?
A key card and a key fob are the same technology in a different form factor — both are contactless credentials read by the same reader and managed by the same software. A card is flat, fits a wallet or lanyard, and can be printed with a photo ID or company branding; a fob is a rugged token that clips to a keyring. Most commercial systems issue both from one platform, choosing printed cards where photo identification or badge visibility matters and fobs for staff who prefer a keyring token. Mobile credentials add the phone as a third option on the same system.
How much does a commercial card access system cost?
Budget roughly CAD $1,500 to $4,000 per door fully installed for a standard commercial opening — reader, electric lock, request-to-exit, door contact, the controller share, cabling, and labour. The cards themselves are inexpensive, typically $1 to $8 each depending on credential technology, with encrypted smart cards costing more than basic proximity. A single-door system for a small business commonly lands between $2,000 and $5,000; cloud platforms add a per-door monthly subscription. See our commercial access control system cost guide for the full per-door breakdown.
Are key card systems secure, and can proximity cards be cloned?
Security depends on the credential technology, not the card itself. Legacy 125 kHz proximity cards can be cloned in seconds with cheap tools and should be avoided for new commercial installs. Modern 13.56 MHz encrypted smart cards such as DESFire EV3 use mutual authentication that resists cloning, and mobile credentials add the phone’s own biometric lock. Specify encrypted cards, pair them with OSDP readers, deactivate lost cards immediately, and review the audit log, and a key card system is materially more secure than mechanical keys that can be copied at any hardware store.
Can a key card system be added to existing doors?
In most cases, yes. A commercial card access system retrofits onto existing doors by adding a reader, an electric lock or strike, a request-to-exit device, and running cable back to a controller — the door leaf and frame usually stay. Glass storefront doors, fire-rated openings, and aluminium frames need the right locking hardware (electric strike, maglock, or electrified mortise) but are all solvable. The main retrofit costs are cabling runs and door preparation, not the card hardware itself.
What happens when an employee loses a key card?
You deactivate the lost card in the management software and issue a replacement — a two-minute task. The deactivated card stops working at every door immediately, with no impact on anyone else and no need to rekey locks or reissue credentials to other staff. This is the single biggest operational advantage of a key card system over mechanical keys, where one lost master key can mean rekeying an entire building.
Project Pricing
Putting card access on your doors?
Send us the door count, whether you want cloud or on-premise software, the credential tier, whether you need photo-printed badges, and any compliance requirement. We return a line-item bill of materials in Canadian dollars — cards, readers, controllers, locks, and power itemised so you can see exactly what to budget before you talk to an installer.
Talk to a real person at Secure Home Supplies.