Quick answerThere is no perfect credential. Cards and fobs are convenient and cheap (ideally using encrypted technology); PINs need nothing physical but are easily shared; fingerprint and face recognition identify the person but are specially protected data; mobile credentials suit regular users; and licence plate recognition speeds up vehicle access. Most sites combine them by door and risk level.
An access control system answers three questions: who can get in, through which door, and when. The credential — what a person presents at the door — is only one part, but it shapes convenience, security and legal obligations. This guide compares the most common options.
Credentials one by one
Proximity cards and fobs
Held up to a reader, which reads an identifier. Cheap, fast and familiar to everyone.
- Watch the technology: low-frequency cards without encryption are easy to clone. High-frequency cards with modern encryption are far more secure.
- Management: if one is lost, it’s disabled in the software and stops working.
PIN codes
Nothing to carry, but codes get shared, written down or observed. They’re mostly used together with another credential (card + PIN) for sensitive areas, or for temporary access.
Biometrics: fingerprint and face
Identifies the person, not an object that can be lent.
- Pros: can’t be forgotten or lent; useful for high-security areas.
- Cons: biometric data is a special category under the GDPR. Using it needs a solid legal basis, a risk assessment and, often, an alternative for people who opt out.
Mobile credentials
The phone acts as the credential via Bluetooth, NFC or an in-app code. Very convenient for regular users and for granting temporary access remotely (a technician, a guest).
Licence plate recognition (ANPR)
A camera reads the plate and opens the barrier or garage door if it’s authorised. It speeds up vehicle entry, but should be combined with another credential for unregistered vehicles — and remember a plate is personal data too.
Comparison
| Credential | Convenience | Security | Cost per user | Privacy |
|---|---|---|---|---|
| Unencrypted card/fob | High | Low | Low | No sensitive data |
| Encrypted card/fob | High | High | Low | No sensitive data |
| PIN | Medium | Low–medium | None | No sensitive data |
| Fingerprint or face | Very high | High | None | Specially protected data |
| Mobile | High | High | None | Requires app and account |
| Licence plate | Very high (vehicles) | Medium | None | Personal data |
Beyond the credential: what the system does
- Schedules and groups: cleaners only in the afternoon, suppliers only through the loading door.
- Anti-passback: stops one card being used twice to enter without exiting.
- Occupancy limits for specific areas.
- Event log: who opened which door and when, for audits or incidents.
- Integration with intercoms, alarms and CCTV.
These features are what separate a centralised system from a keypad lock. See our access control service.
Locks and life safety
The reader decides, but the lock or maglock opens the door. On emergency exit routes, Spain’s Technical Building Code requires doors to open from inside in an emergency, so systems that release the door on power failure or fire alarm are used. On other doors you may prefer them to stay locked.
Worked example: a 40-person company with a warehouse
- Main entrance: encrypted card and mobile for staff; video intercom for visitors.
- Warehouse: card + PIN with restricted hours.
- Server room: card + PIN, with every access logged.
- Vehicle entrance: plate recognition for the fleet, remote or card for everyone else.
- Visitors and contractors: temporary mobile credentials that expire automatically.
Everything is managed from central software where users are added or removed in seconds.
Common mistakes
- Choosing unencrypted low-frequency cards because they’re cheaper.
- Rolling out fingerprints everywhere without considering data-protection rules.
- One PIN shared by the whole workforce.
- Locks that block an emergency exit.
- Forgetting to revoke credentials when someone leaves.
Conclusion
The right credential depends on the door and the risk: encrypted cards or mobile for everyday use, combinations (card + PIN) for sensitive areas, plate recognition for vehicles and biometrics only where justified and properly assessed. The real value lies in the system behind it: schedules, logs and integration. For residential buildings, see access control for residential buildings.
Domolife installs centralised and IP access control systems. Get advice.
Frequently asked questions
Can proximity cards be cloned?
Older low-frequency cards without encryption are easy to copy. High-frequency cards with modern encryption offer far more protection. Ask which technology the system uses before installing it.
Can I use fingerprints for staff time-keeping?
Biometric data is a special category under the GDPR. Spain’s data-protection authority (AEPD) has set demanding criteria for using it in attendance control, so consider less intrusive alternatives and take advice first.
What happens in a power cut?
It depends on the system and the lock. Professional controllers have battery backup, and locks are chosen per door: emergency exits must release, while other doors may stay locked.
Is mobile access secure?
Professional systems use encrypted mobile credentials tied to the user that can be revoked instantly. Security also depends on the phone’s own screen lock.
Sources and technical documentation
- AEPD — Spanish Data Protection Agency
- Organic Law 3/2018 (LOPDGDD, Spanish)
- Spanish Technical Building Code (RD 314/2006), DB-SI evacuation
- Ubiquiti UniFi — UniFi Access documentation
Features depend on the exact model and firmware: always check the manufacturer’s datasheet before buying.