Giving a cleaning contractor keys and alarm codes to your office is a trust decision. This article explains how access management should work, what documentation you should have, and what questions to ask a vendor before handing over access.
What Access a Cleaning Crew Needs
A nightly cleaning crew typically needs: a key or key fob to the building entrance, a key or code to your suite if the building has shared-access floors, and the alarm code with specific entry and exit sequences. If your building has separate codes for different floors or areas, the crew needs codes only for areas they clean — not building-wide access.
Principle of least access applies here as it does anywhere: provide only what is required for the work, and document what has been provided.
What Good Access Documentation Looks Like
A professional cleaning company should maintain, at minimum:
- A written log of every key and fob in their possession, including copy number and date received
- A record of who on the crew holds access for each client
- An acknowledgment document signed when access is transferred (both directions — receipt and return)
- A procedure for what happens when crew composition changes
If a vendor cannot describe their key management procedure, that is a red flag. Access handling is an operational basic, not an advanced requirement.
Alarm Code Handling
Alarm codes should be held by the crew lead, not distributed broadly. Some alarm systems allow you to create temporary or restricted codes that log separately from your master code — this is worth doing if your system supports it, because it allows you to see entry and exit times for the cleaning crew independently.
Codes should be changed whenever crew composition changes for your account, whenever you terminate a cleaning relationship, or at least annually as a standard security practice. Ask your vendor to confirm they will notify you when the crew handling your account changes so you can make that decision.
What Happens When Something Goes Wrong
Lost keys, failed alarm resets, and damaged entry hardware are the three most common access-related incidents. Ask any vendor you consider how they handle each:
- Lost key — do they notify you immediately, and do they cover re-keying costs?
- Failed alarm reset — do they have a direct contact to reach in the event of a false alarm, and have they agreed a response procedure with your alarm company?
- Damaged hardware — are they bonded, and is the claim process documented?
These questions have correct answers, and a vendor who deflects or is vague is telling you something.
Revoking Access
You should be able to revoke access at any time. A professional vendor will acknowledge the revocation in writing, return all keys and fobs within one business day, and confirm that no copies were made. If a vendor resists this or makes it complicated, that is a significant concern.