Multi-site access control manages the doors, turnstiles and barriers of several factories, warehouses, branches or construction sites through one permission model and one reporting layer, while keeping each site's records separate. Set up well, head office sees consolidated attendance, access and canteen data for the whole group, and each site manager runs only their own site.
In a well-designed set-up, a problem at one location does not spill into the others, and doors keep working on local decisions when the link to head office drops (access control offline mode). The key decision is striking the right balance between "everything in one database" and "every site on its own island" from day one. This article covers the architecture options, seven set-up steps and how to split responsibilities between head office and sites; related guides are in our access control and attendance hub.
How multi-site companies usually end up
Access control in a growing company tends to grow organically. The head-office factory got a system ten years ago. When a second plant was acquired, its old system stayed. For logistics firms running several warehouses, the zoning inside each site is covered in our warehouse access control guide.
The new warehouse got whatever brand fitted that year's budget. Construction sites still run on paper lists (construction site access and attendance explains how to close that gap).
The result is familiar:
- Every site has its own software, card format and reports. HR merges four different files at the end of each month to produce attendance timesheets.
- People who move between sites carry several cards. Regional managers, quality teams and maintenance engineers are set up separately at each site, and some of those set-ups are forgotten when they leave.
- The same rule is applied differently everywhere. "Visitors may not enter production unescorted" is enforced in software at one site and only in the guard's memory at another.
- Group-level questions go unanswered. "Which site had the most overtime last month?" or "Has the leaver's access been closed at every site?" cannot be answered on the spot.
What fragmentation costs
Access control is now a standard part of site security. MarketsandMarkets' Access Control Market report forecasts the global access control market to grow from USD 10.62 billion in 2025 to USD 15.80 billion by 2030, a CAGR of 8.3%. Connected devices are also moving to the centre of site security:
Eurostat reports that in 2021, 72% of EU enterprises using Internet of Things devices used them to secure their premises. (Eurostat, Use of Internet of Things in enterprises)
The investment is being made either way. The question is whether it builds a set of islands or a system that works together. The cost of fragmentation tends to hide in less visible places:
- HR and finance effort. Merging attendance records from different formats by hand every month produces errors and disputes.
- Access that never gets closed. When someone set up in several systems leaves, one of those systems is often missed.
- Inconsistent audits. In a data protection or customer audit, each site shows different retention periods, log formats and permission structures.
- Scattered suppliers and maintenance. Every system needs its own maintenance contract, spare parts and expertise.
The architecture choice: one database or one island per site?
There are two extremes in multi-site design, and both have well-known weaknesses.
| Model | Strength | Risk |
|---|---|---|
| One central database for all sites | Easy reporting, single administration | A site manager may see other sites' data by mistake; a permissions error affects the whole group |
| Fully independent system at each site | Each site runs on its own; strong isolation | Consolidated reports are built by hand; no shared rules or identities |
| Separate data per site + central consolidated reporting | Site isolation is preserved and head office sees the whole group | Requires a sound permission model and disciplined set-up |
For holding companies and multi-branch organisations we recommend the third model: each site (or each company) lives in its own data, sites cannot see each other's records, and head office receives consolidated reports within the limits of its role. For municipalities with a main service building, annexes and field units, we show how this model applies in municipal building access control.
How to set up multi-site access control in seven steps
- Build a site and zone inventory. List, in one table, every site's entry points, zones (gatehouse, production, warehouse, office, server room) and door types (turnstile, door, barrier).
- Agree common zone names. "Warehouse" should mean the same thing everywhere; a shared vocabulary lets rules travel between sites. For the underlying zone logic, see zone-based access in factories.
- Define roles on three levels. Group (sees consolidated reports), site manager (runs only their own site) and auditor (read-only). Role and zone scope should be enforced in the core of the software, not merely by hiding a menu in the interface.
- Standardise on one card technology. Use the same card technology for new sites and for doors being replaced; we explain the differences in 125 kHz vs 13.56 MHz cards.
- Manage travelling staff with one identity. A regional manager should reach every site they are authorised for with one credential, with access opened and closed site by site.
- Define consolidated reports up front. Decide before installation which reports are visible at group level and which stay at site level: attendance, overtime, meal counts, refused entries.
- Pilot, then roll out in waves. Bring one site fully live, validate the reports, then add the others from the same template. Archive the old systems' records separately during the transition. When budgeting site by site, what drives access control system cost is a useful checklist.
Who does what: head office or site?
Multi-site projects most often stumble not on technology but on organisation, because nobody is sure who decides what. This split works well in most organisations:
| Area | Head office (group) | Site |
|---|---|---|
| Shared rules and zone names | Sets and updates them | Applies them, requests exceptions |
| Staff and card set-up | Sets the standard | Registers its own employees |
| Visitor and contractor entry | Sets the policy | Daily approval and follow-up |
| Reports | Consolidated attendance, overtime, canteen | Daily lists, refused entries |
| Audit and data protection | Retention periods, auditor roles | Privacy notices, local record-keeping |
Visitors and contractors deserve particular attention, because that is where differences between sites show most. The steps in our article on QR code visitor access can be applied identically at every location.
The need for central control with local separation applies to email as much as to doors. Running a group's domains and mailboxes from one panel while keeping each company's data apart is covered in email management for multiple companies.
How we run multi-site projects at Digital Bridge
We serve every province in Türkiye both remotely and on site, so facilities in different cities can be handled in a single project plan. A typical project includes:
- Needs analysis and a written proposal. We build the entry-point inventory for each site with you and set out scope, phases and cost in a written proposal. We don't sell off-the-shelf packages; the plan follows your sites and doors.
- Hardware selection and installation. Turnstiles, doors and readers are specified under card access control, with fingerprint access where appropriate and licence plate recognition for vehicle gates.
- Integration. We feed consolidated attendance data into your payroll and ERP systems through system integrations, and can combine group-level management views with BI dashboard work. We explain how to move site spreadsheets onto a single dashboard in from Excel reports to BI.
- Monitoring alongside building management. At head offices and office towers, we can link the system to a smart building management system (BMS) so access events are monitored centrally together with lighting, HVAC and fire scenarios.
- Data protection and permissions. We design cross-site data flows, retention periods and role structures alongside our data protection compliance service, covering KVKK, Türkiye's personal data protection law.
How SmartPass handles multiple sites
Our own product, SmartPass, works like this in multi-site organisations:
- Each site as a separate SmartPass organisation. A factory in Adana and a warehouse in Gebze can be opened as separate organisations; each organisation's data sits in its own separate database, and different organisations' records never share a table.
- One identity across sites. Authorised users switch between sites from the "My organisations" list without re-entering a password; the panel is reached with SmartID, the single identity of the Smart360 product family, so there is no separate SmartPass password.
- One read, three jobs. At every site a single card read opens the door, records attendance and, where earned, deducts a meal; no separate attendance device is needed. Timesheets follow the shift plan and can be exported to payroll.
- The same permission model at every site. People belong to access groups, and each group is linked to one or more zones with an optional weekly time profile. A rule changed in the panel applies at every door of that organisation straight away.
- Dashboard and emergencies. At each site the dashboard shows how many staff, contractors and visitors are inside right now; an access point switched to emergency mode frees exits and closes entries.
- Data protection at the core. Card numbers are not stored but turned into a one-way hash as they are read; records past their retention period lose the fields that identify a person; the audit log keeps previous and new values; and 43 separate panel permissions keep access narrow.
A concrete example: a group's factory in Adana and its warehouse in Mersin are set up in SmartPass as two separate organisations. The Mersin warehouse manager sees only that site's access, attendance and canteen records, and a permissions mistake in Adana cannot affect Mersin. Group HR, meanwhile, receives each site's ERP export at month end in the same format, produced from the locked month: employee number, department, cost centre and durations in minutes. How staff who travel between sites are set up is something we decide with you before installation, based on your structure.
Next step
Put your sites, the number of entry points at each and the systems you use today into one table. Then get in touch: we'll choose a pilot site together and show how SmartPass would fit your group structure. For the fundamentals, see our card access control system guide.