The only one that also makes the door.

dormakaba comes from joining two businesses that had each spent a century at the door: the ironmongery —door closers, automatic doors, turnstiles— and the locking —keys, cylinders, master key suites—. The access control came later, and that explains almost everything that follows.

exos is the platform for large installations: its own server, a database, administration clients and an organisational structure that looks like a real company —sites, departments, tenants of a building, contractors— and not a flat list of users. MATRIX sits one step below, for anyone who does not need all that machinery.

The problem it solves is not opening doors. It is running a building with employees, visitors, suppliers, lockers, parking and a schedule per group, where the day to day is handled by personnel or facilities and not by a security department working shifts. It turns up in corporate head offices, buildings with several tenants, universities, hospitals and airports.

Underneath there are controllers in a cabinet keeping their copy of who can open and on what schedule. If the network or the server goes down, the doors go on deciding on their own and note what happens to report it when the connection comes back. Better to check that at handover than to believe it.

It grows by sites: they are added to the same server with the organisation kept separate inside, so that whoever administers Barcelona does not touch Lisbon. That is where it earns its keep, and that is where it shows if nobody drew that structure before the first person was registered: reorganising it afterwards is expensive.

With the video and with the intruder detection it talks through interfaces, and that is looked at closely project by project. It does well at the reasonable things: a denied access that brings up the camera on that door, an alarm that does not go off because somebody came in with a valid credential. Do not expect the single desktop of a control room with three hundred cameras in front of it; that is not its fight, and expecting it means paying twice for the same thing.

For the credential it works with encrypted cards from the usual families and with the phone, and it has its own line of cylinders and door furniture for the doors that are not cabled. What gets decided on day one is the management of the card keys: that is not changed later without reissuing them all.

Hardly anybody switches from key to card in one go. It is done zone by zone, over years, and meanwhile the two live side by side: doors with a reader, doors with a wireless electronic cylinder and doors with the same old key inside the same master key suite. Managing that coexistence is the real work, and it comes out much better when the key, the cylinder and the reader all fit in the same locking plan.

The other half is the ironmongery. A turnstile or a control lane is not a reader with a door behind it: they have to decide what to do with somebody following close behind the person in front, with a wheelchair and with the fire alarm when it goes off. If the turnstile and the access control come from the same firm, that arrives already solved. If not, it is an integration, and the ones at the physical door eat up the most site visits.

And a point from the trade: this family carries a lot of inheritance from time and attendance and clocking in. Useful if you need it; a trap if you do not, because it turns a security project into one involving personnel, the works council and a conversation about workers' data that nobody had planned for.

The day to day is run by the client, and it is designed for that: registering and removing a person, changing a schedule profile, a permission by zone, issuing a card, logging a visit and the list of who went in where. People from personnel, reception or facilities do that without us, with an administrator limited to their own patch.

What is not the client's: adding a door or a controller, creating a schedule profile from scratch, changing the organisational structure, touching the readers and anything that goes near the card keys. It is not forbidden: it is that the damage from doing it badly is not seen the same day and afterwards nobody knows where it came from.

For them to really be able to, three things are needed, and we leave them. Training with the people who are going to use it —not with their boss— on their own system, with their doors and their names. A short manual with the five procedures of each week, written for the job. And a procedure for joiners and leavers agreed with personnel: who gives notice, within what time and who reviews it each quarter.

What we do not leave is the administrator passwords in our drawer. Anyone who wants to change supplier has to be able to do it without asking our permission.

The usual thing is to arrive from a mechanical key, or from an old system from the same firm that no longer has support. In both cases the order is the same: first you survey what is there —doors, readers, credentials in circulation, who has what—, and that inventory on its own turns up half a dozen active cards belonging to people who do not work here.

The old card, if it is one of the low-security ones, is not reused. You can live for a few months with readers that read both the old and the new, but that is the route and not the destination: a card that can be cloned still can be even if a modern system reads it.

If what is there is another platform with its own hardware, the cabinet is changed. That is said with the quotation in front of you and not halfway through the work, and it is one more reason to know which controller you have before deciding anything.