Contractor access control is the practice of checking, automatically at the gate, that every subcontractor worker is who they claim to be, holds valid safety training and paperwork, and can reach only the areas their job requires. For safety compliance, the most reliable method is a time-limited, zone-restricted card or QR code that stops working the moment a document expires.
That way the answer to "who is on site, from which firm, and where?" lives in a system rather than a paper logbook. This article applies to any sector: factories, industrial estates, warehouses or hospitals using maintenance contractors. Below we cover what uncontrolled entry costs, a six-step framework and how it works with SmartPass; related guides are in our access control and attendance hub. For contract handling crews in warehouses, we give examples of dock and stock floor permissions in warehouse access control.
What actually happens on a busy site
On any given day a factory may host a maintenance contractor, an electrical subcontractor, a cleaning crew, scaffolders and a few specialist fitters who are only there for the week. The main employer's health and safety team collects paperwork from each firm: ID, social security registration, safety induction certificates, medical fitness reports and, where relevant, working-at-height or plant operator qualifications.
Collecting the paperwork is rarely the problem. The problem is that the paperwork and the gate are disconnected. The approved list sits in a spreadsheet; entry is recorded in a logbook in front of the security guard. A spreadsheet of expiry dates tracked by hand is one of the fastest ways of outgrowing spreadsheets.
A worker added on Monday arrives on Tuesday with a missing certificate and is waved in because "the firm sent him". Staff from a contractor whose job finished weeks ago keep using their old cards. When an incident happens, the first questions — was this person on site that day, were they trained, were they authorised for that area? — take hours of record-digging to answer.
If you operate in Türkiye, this matters legally as well as practically.
Under the Turkish Labour Act No. 4857, the principal employer is jointly liable with the subcontractor for obligations arising from the Act and from employment contracts towards the subcontractor's workers. Occupational Health and Safety Law No. 6331 additionally requires employers sharing the same workplace to cooperate and coordinate on safety measures. In short, a contractor's worker on your site is within your sphere of responsibility.
The cost of uncontrolled entry
Work accident figures show why "who goes where" is not a minor security detail:
According to Türkiye's Social Security Institution (SGK), 766,039 workers insured under Article 4-1/a had a work accident in 2025, and 1,931 workers died as a result of work accidents that year. (SGK Statistical Yearbook 2025, Section 3-1)
The sectors that rely most heavily on subcontractors carry a disproportionate share. Of those 1,931 deaths, 586 — about 30% — were in construction, which also recorded 81,977 work accidents; manufacturing accounted for roughly 314,000 accidents, around 41% of the total (SGK Statistical Yearbook 2025). Globally, the ILO estimates that nearly 3 million workers die every year from work-related accidents and diseases, 330,000 of them from accidents (ILO, "A Call for Safer and Healthier Working Environments").
In practical terms, uncontrolled contractor entry leads to:
- Untrained workers in hazardous areas. Roofs, plant rooms and chemical stores are exactly where an unqualified person causes an accident. Camera-based AI PPE detection can check behaviour inside those zones.
- Weak evidence after an incident. Proving that someone was on site, and which zones they entered at what time, becomes difficult just when it matters most.
- Finished contractors keep coming in. When cards are not collected, the gate still opens after the job has ended; access that is not tied to the contract period is a security gap. On building sites timesheets and progress payments add another layer, which we cover in construction site access and attendance.
- Unknown headcount in an emergency. During an evacuation, contractors are usually the weakest link in the roll call (emergency muster report).
How to set up contractor access control: a six-step safety compliance framework
The same logic works in a factory, a warehouse, and in sensitive facilities such as hospitals or data centres. For how cards, readers and controllers work together, see what a card access control system is.
- Keep firm and worker records in one place. Each contractor company is one record, and each of its workers sits beneath it with ID, social security registration, safety induction date and expiry, medical report and any special qualifications.
- No credential without complete paperwork. Cards and QR codes should be the output of the document check, not a gatehouse decision. If an exception is genuinely needed, record who approved it.
- Limit access by time and by zone. The electrical contractor's team can enter only during the contract period, only during working hours and only the relevant zones. For a fitter who is on site for three days, use a QR code that expires on its own rather than a permanent card. We explain zone logic in detail in zone-based access in factories.
- Let access lapse automatically when documents expire. When a safety certificate or medical report passes its expiry date, access should disappear without anyone remembering to remove it, with advance reminders to your safety team and the contractor. In food plants, we show how medical reports and hygiene training are tied to door permissions in food factory hygiene access control.
- Log every passage with the firm's name. A report should not say "14 people today", but "6 from Contractor A and 8 from Contractor B, at these times, in these zones". This record underpins both post-incident investigations and checks on how long each firm actually spent on site.
- Close everything when the contract ends. Revoke all of a firm's workers in a single action, so unreturned cards become worthless.
Card, QR code or biometrics?
| Method | Best suited for | Watch out for |
|---|---|---|
| RFID card (13.56 MHz) | Jobs lasting weeks or months, regular maintenance firms | Return tracking; time and zone limits must be set |
| Time-limited QR code | Short installations, deliveries, one-off jobs | Must expire automatically |
| Fingerprint / face | Critical areas where card sharing is a serious risk | Special-category data under KVKK (Türkiye's data protection law); needs a written legal assessment and must not be used for attendance tracking |
Biometric options deserve a separate data protection assessment; we compare them in fingerprint vs card vs face recognition.
Subcontractor documents and entry records are easier to audit when they sit in the same record as the programme and valuations; see construction project management software.
How we approach contractor access at Digital Bridge
Contractor access control is a process design exercise, not a hardware purchase. We therefore start on site:
- Site and process analysis. We walk the gatehouse, vehicle entrances, site gates and internal zones with you, and map which contractor needs which zone together with your safety team. On construction and contracting projects, temporary gates and shifting site boundaries are a key part of this analysis.
- Hardware and installation. We select turnstiles, door readers and barriers to suit the site; card access control and vehicle entry via barrier and parking systems follow the same permission logic. Because software and hardware come from the same team, we can adapt to site conditions.
- Document and HR integration. If you already track safety paperwork in an HR or contractor management system, we connect document expiry dates to access rights through system integrations. If you don't, we design the HR and personnel management side with you.
- The documents themselves. Scanned training certificates, medical reports and competence certificates can be kept in contractor and worker folders with SmartFiles document management. A checklist applied to a folder in SmartFiles shows which documents are complete and which are missing for each worker's folder, and a missing document can be requested straight from the contractor through an upload link; access is granted per person and per department.
- Data protection. Contractors' personal data is your responsibility too. We address privacy notices, access rights and when records are deleted after the job under your data retention and disposal policy through our data protection compliance service.
A contractor's day with SmartPass
Our own product, SmartPass, combines access control, time and attendance, and canteen meal counting in a single system. In a contractor scenario, a day looks like this:
At 07:45 an electrician from the subcontractor presents a 13.56 MHz card at the gatehouse terminal. One read opens the gate, records attendance and, where the worker is entitled to a meal, counts it. A minute later, a fitter who is on site for two days presents the card issued to him for the job at the same terminal; his record carries a validity period that ends with the job, and his card follows exactly the same permission rules as permanent cards. Because the fitting crew's only authorised zone is "Production – Line 3", he is refused at the warehouse door, and the refusal is logged as well.
The SmartPass features that matter here:
- Rules in plain language. For example, "The electrical contractor may enter Production and the Plant Room during working hours." If two rules conflict, the system states clearly which one applies, and a rule simulator shows in advance whether a given person can pass a given door.
- Zone hierarchy. Gatehouse, production, warehouse and office zones are nested, so contractor access can be granted to the narrowest zone required.
- Live monitoring and an "who is inside now" list. Everyone currently on site, contractors included, is visible by zone on one screen.
- No separate attendance device. The same read creates the attendance record, and an entry-exit report by firm is one click away.
- Privacy by design. Card numbers are never stored in plain text; records past their retention period are anonymised; every change is written to an audit trail with old and new values. A read-only auditor role can be given to your safety officer.
When comparing proposals, our guide to what drives access control system cost lists the items to check.
Next step
Put on one page how many contractor firms work on your site today, which zones must be restricted, and where safety paperwork is currently kept. With that in hand, get in touch and we will map your entry points together and show how SmartPass would run with your rules.