[et_pb_section fb_built=”1″ _builder_version=”4.27.5″ _module_preset=”default” global_colors_info=”{}”][et_pb_row _builder_version=”4.27.5″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.5″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.5″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n
An electronic access control system<\/a> with logging is what makes this provable. It creates a searchable, time-stamped audit trail showing who used which credential, at which door, and when, something a mechanical key system simply cannot produce. Whether the system\u00a0actually delivers\u00a0this in practice depends on how\u00a0it’s\u00a0configured and how long the data is kept.<\/span>\u00a0<\/span><\/p>\n It’s\u00a0the question that comes up after the fact, not before. A contractor’s badge goes missing. An item disappears from a stockroom. An insurer asks for evidence following a claim. Someone, somewhere, needs a straight answer to “who was in that area, and when,” and reaching for a paper sign-in sheet or a vague memory of who had keys that week\u00a0isn’t\u00a0going to satisfy anyone asking the question formally. One UK university found out the hard way what happens without an answer: a lost master key to a scientific research\u00a0centre\u00a0meant the entire system had to be rekeyed, at a cost of \u00a350,000. In\u00a0SimonsVoss’s\u00a0own survey of facilities and security professionals,\u00a039% said they\u00a0couldn’t\u00a0produce an audit trail showing who accessed specific areas and when.\u00a0That’s\u00a0not a small gap.\u00a0It’s\u00a0the difference between answering a question and rekeying a building.<\/span>\u00a0<\/span><\/p>\n A mechanical key system can tell you almost nothing after\u00a0the\u00a0fact. A key either\u00a0works\u00a0or it\u00a0doesn’t, and once\u00a0it’s\u00a0been cut,\u00a0copied\u00a0or handed to a contractor,\u00a0there’s\u00a0no record of who used it, where, or when. If a key goes missing, the only real fix is rekeying the\u00a0whole system, which is expensive and disruptive.<\/span>\u00a0<\/span><\/p>\n The speed difference\u00a0shows up\u00a0the moment something goes wrong. On a properly configured online access control system, blocking a lost card and issuing a replacement typically takes about three clicks. On an offline system covering a larger estate, the same job can mean physically visiting every lock, which on an 80-door site can take around two hours. With a mechanical master key, there’s often no equivalent\u00a0short version\u00a0at all, only a full rekey.<\/span>\u00a0<\/span><\/p>\n An electronic access control system replaces that with a structured log. Done properly, it captures:<\/span>\u00a0<\/span><\/p>\n This is the baseline. Without it, “prove who accessed the building”\u00a0isn’t\u00a0really answerable, no matter how good your locks are.<\/span>\u00a0<\/span><\/p>\n Capturing the data is only half the job. The other half is keeping it long enough to be useful, and this is where\u00a0SimonsVoss’s\u00a0survey found a bigger gap:\u00a046% of facilities and security professionals said they cannot search or\u00a0retain\u00a0access data for a meaningful period.<\/span>\u00a0<\/span><\/p>\n There’s\u00a0no single fixed retention period set out in UK law for access control logs. What does apply is UK GDPR’s storage limitation principle, which requires\u00a0organisations\u00a0to keep personal data only as long as necessary for the purpose it was collected for, and to be able to justify that period if asked. In practice, that means the right retention window depends on what the data is for: a short window might cover routine building management, but investigations, insurance claims and safeguarding reviews often surface weeks or months after the event in question. If the data’s already been overwritten by then, it\u00a0doesn’t\u00a0matter how good the system was on day one.<\/span>\u00a0<\/span><\/p>\n A searchable archive that only goes\u00a0back\u00a0a few days\u00a0isn’t\u00a0really an audit trail.\u00a0It’s\u00a0a temporary log that happens to be useful if\u00a0you’re\u00a0lucky with timing. The storage limitation\u00a0principle\u00a0cuts both ways too: once data has served its purpose and the retention period has passed, it should be securely\u00a0deleted\u00a0rather than left to accumulate indefinitely. A system that\u00a0can’t\u00a0do either, keep data long enough or dispose of it properly, creates risk at both ends.<\/span>\u00a0<\/span><\/p>\n This\u00a0isn’t\u00a0a hypothetical compliance exercise. It shows up in ordinary situations that most estates and facilities teams deal with at some point:<\/span>\u00a0<\/span><\/p>\n Security incidents.<\/strong>\u00a0Theft,\u00a0vandalism\u00a0or\u00a0unauthorised\u00a0entry all raise the same first question: who had access to that area, and when. Without a searchable log, the answer starts with a shrug.<\/span>\u00a0<\/span><\/p>\n Contractor and visitor access.<\/strong>\u00a0Contractors,\u00a0cleaners\u00a0and temporary staff often need short-term access to specific areas. When something goes wrong during that window, being able to pull an exact record of who was where matters far more than remembering who was booked in.<\/span>\u00a0<\/span><\/p>\n Staff turnover.<\/strong>\u00a0People leave, change roles, or lose credentials. A clear log shows exactly when access was revoked and whether it was used after that point, which protects the\u00a0organisation\u00a0as much as it protects the departing employee.<\/span>\u00a0<\/span><\/p>\n Insurance claims.<\/strong>\u00a0Insurers increasingly ask for evidence of access control and monitoring after a claim, not just confirmation that a system exists. A documented, searchable audit trail is what turns “we had security measures in place” into something an insurer can\u00a0actually verify.<\/span>\u00a0<\/span><\/p>\n Martyn’s Law readiness.<\/strong>\u00a0For\u00a0organisations\u00a0already reviewing their access control approach ahead of Martyn’s Law, an audit trail is one of the clearest, most concrete things to get right. Under the Act’s Enhanced Tier, premises expecting 800 or more people are expected to carry out formal risk assessments and put in place reasonably\u00a0practicable\u00a0physical security measures. A searchable, time-stamped record of who accessed what is direct, demonstrable evidence that those measures\u00a0actually work, not just that they exist on paper.<\/span>\u00a0<\/span><\/p>\n Board and governance reporting.<\/strong>\u00a0This is often the version of the question that actually gets budget released.\u00a0Facilities managers are\u00a0frequently\u00a0the influencers rather than the final decision-makers, and getting sign-off from senior leadership depends on being able to answer a different, harder set of questions: can you\u00a0demonstrate\u00a0that permissions align with defined roles? Can you evidence that access is revoked\u00a0immediately\u00a0when it should be? Can you produce a searchable audit trail on demand, in front of a board, a regulator or an auditor? An access control system that only answers “did the door open”\u00a0doesn’t\u00a0help here. One that produces a clear, searchable\u00a0record does.<\/span>\u00a0<\/span><\/p>\n IT and infrastructure oversight.<\/strong>\u00a0For IT managers increasingly involved in access control decisions, the audit trail itself is data that needs to be handled properly: stored securely, access to the logs restricted and recorded, and the system able to sit alongside existing infrastructure rather than as an isolated island. An audit trail that\u00a0isn’t\u00a0itself secure and well-governed undermines the case\u00a0it’s\u00a0meant to support.<\/span>\u00a0<\/span><\/p>\n This is exactly what\u00a0SimonsVoss’s\u00a0software platforms are built to provide. Access events are logged centrally against named credentials, giving estates and facilities teams a searchable record rather than a scattered set of assumptions. Permissions can be set,\u00a0changed\u00a0or revoked instantly when someone\u00a0leaves\u00a0or a credential is lost, and that change is itself recorded. Retention settings can be configured to match what the\u00a0organisation\u00a0actually needs, rather than defaulting to whatever the system happens to store by default.<\/span>\u00a0<\/span><\/p>\n The result is a system that answers “who accessed this building, and when” as a straightforward search, not a project.<\/span>\u00a0<\/span><\/p>\n How long should access data be\u00a0retained?\u00a0<\/strong><\/p>\n There’s\u00a0no single legal minimum or maximum. UK GDPR requires you to keep data only as long as necessary for a documented, justifiable purpose, which for most\u00a0organisations\u00a0means balancing routine storage costs against the realistic time it takes for an incident,\u00a0claim\u00a0or investigation to surface. Many\u00a0organisations\u00a0retain\u00a0access logs for several months to a year, but the right period depends on your sector, risk profile and any specific compliance requirements that apply to you.<\/span>\u00a0<\/span><\/p>\n Can this data be used as evidence?\u00a0<\/strong><\/p>\n Access control logs can support an investigation or claim, but their evidential weight depends on the integrity of the system:\u00a0accurate\u00a0timestamps, credentials tied to named individuals, and a clear record of who can access and edit the logs themselves. A system that’s well configured and consistently used is far more useful as evidence than one bolted on as an afterthought.<\/span>\u00a0<\/span><\/p>\n What’s\u00a0the difference between logging and monitoring?\u00a0<\/strong><\/p>\n Logging is the record itself, the who, where and when of every access event, stored for later review. Monitoring is watching that activity in real\u00a0time, or\u00a0setting up alerts for unusual patterns as they happen. A good access control system does both, but logging is the non-negotiable foundation. You\u00a0can’t\u00a0monitor\u00a0effectively, or\u00a0investigate after\u00a0the fact, without a complete log to work from.<\/span>\u00a0<\/span><\/p>\n \u00a0<\/span><\/p>\n If\u00a0you’d\u00a0like a wider view of how this fits into a broader access control strategy, our\u00a0<\/span>digital locking systems for compliance-ready buildings<\/span><\/a>\u00a0page covers the core capabilities, audit trails included, that estates and facilities teams should expect as standard. And if\u00a0you’re\u00a0specifically weighing this up against Martyn’s Law, our piece on\u00a0<\/span>whether wireless locking complies with Martyn’s Law<\/span><\/a>\u00a0covers the tiered requirements and where the common compliance gaps sit.<\/span>\u00a0<\/span><\/p>\n Not ready to talk to a person yet? Get the\u00a0<\/span>Access Control Readiness Checklist<\/span><\/a>\u00a0first.\u00a0It’s\u00a0a practical, non-technical walkthrough covering access control, monitoring, staff training and audit-trail readiness, built to help you see exactly where your current setup stands before you make any changes.<\/span>\u00a0<\/span><\/p>\n Ready to see where your current setup stands?<\/span><\/b>\u00a0Speak to our UK team about audit-trail capability and what “meaningful retention” should look like for your estate.<\/a><\/span>\u00a0<\/span><\/a><\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.5″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.5″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.5″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n An electronic access control system with logging is what makes this provable. It creates a searchable, time-stamped audit trail showing who used which credential, at which door, and when, something a mechanical key system simply cannot produce. Whether the system\u00a0actually delivers\u00a0this in practice depends on how\u00a0it’s\u00a0configured and how long the data is kept.<\/span>\u00a0<\/span><\/p>\n It’s\u00a0the question that comes up after the fact, not before. A contractor’s badge goes missing. An item disappears from a stockroom. An insurer asks for evidence following a claim. Someone, somewhere, needs a straight answer to “who was in that area, and when,” and reaching for a paper sign-in sheet or a vague memory of who had keys that week\u00a0isn’t\u00a0going to satisfy anyone asking the question formally. One UK university found out the hard way what happens without an answer: a lost master key to a scientific research\u00a0centre\u00a0meant the entire system had to be rekeyed, at a cost of \u00a350,000. In\u00a0SimonsVoss’s\u00a0own survey of facilities and security professionals,\u00a039% said they\u00a0couldn’t\u00a0produce an audit trail showing who accessed specific areas and when.\u00a0That’s\u00a0not a small gap.\u00a0It’s\u00a0the difference between answering a question and rekeying a building.<\/span>\u00a0<\/span><\/p>\n A mechanical key system can tell you almost nothing after\u00a0the\u00a0fact. A key either\u00a0works\u00a0or it\u00a0doesn’t, and once\u00a0it’s\u00a0been cut,\u00a0copied\u00a0or handed to a contractor,\u00a0there’s\u00a0no record of who used it, where, or when. If a key goes missing, the only real fix is rekeying the\u00a0whole system, which is expensive and disruptive.<\/span>\u00a0<\/span><\/p>\n The speed difference\u00a0shows up\u00a0the moment something goes wrong. On a properly configured online access control system, blocking a lost card and issuing a replacement typically takes about three clicks. On an offline system covering a larger estate, the same job can mean physically visiting every lock, which on an 80-door site can take around two hours. With a mechanical master key, there’s often no equivalent\u00a0short version\u00a0at all, only a full rekey.<\/span>\u00a0<\/span><\/p>\n An electronic access control system replaces that with a structured log. Done properly, it captures:<\/span>\u00a0<\/span><\/p>\n This is the baseline. Without it, “prove who accessed the building”\u00a0isn’t\u00a0really answerable, no matter how good your locks are.<\/span>\u00a0<\/span><\/p>\n Capturing the data is only half the job. The other half is keeping it long enough to be useful, and this is where\u00a0SimonsVoss’s\u00a0survey found a bigger gap:\u00a046% of facilities and security professionals said they cannot search or\u00a0retain\u00a0access data for a meaningful period.<\/span>\u00a0<\/span><\/p>\n There’s\u00a0no single fixed retention period set out in UK law for access control logs. What does apply is UK GDPR’s storage limitation principle, which requires\u00a0organisations\u00a0to keep personal data only as long as necessary for the purpose it was collected for, and to be able to justify that period if asked. In practice, that means the right retention window depends on what the data is for: a short window might cover routine building management, but investigations, insurance claims and safeguarding reviews often surface weeks or months after the event in question. If the data’s already been overwritten by then, it\u00a0doesn’t\u00a0matter how good the system was on day one.<\/span>\u00a0<\/span><\/p>\n A searchable archive that only goes\u00a0back\u00a0a few days\u00a0isn’t\u00a0really an audit trail.\u00a0It’s\u00a0a temporary log that happens to be useful if\u00a0you’re\u00a0lucky with timing. The storage limitation\u00a0principle\u00a0cuts both ways too: once data has served its purpose and the retention period has passed, it should be securely\u00a0deleted\u00a0rather than left to accumulate indefinitely. A system that\u00a0can’t\u00a0do either, keep data long enough or dispose of it properly, creates risk at both ends.<\/span>\u00a0<\/span><\/p>\n This\u00a0isn’t\u00a0a hypothetical compliance exercise. It shows up in ordinary situations that most estates and facilities teams deal with at some point:<\/span>\u00a0<\/span><\/p>\n Security incidents.<\/strong>\u00a0Theft,\u00a0vandalism\u00a0or\u00a0unauthorised\u00a0entry all raise the same first question: who had access to that area, and when. Without a searchable log, the answer starts with a shrug.<\/span>\u00a0<\/span><\/p>\n Contractor and visitor access.<\/strong>\u00a0Contractors,\u00a0cleaners\u00a0and temporary staff often need short-term access to specific areas. When something goes wrong during that window, being able to pull an exact record of who was where matters far more than remembering who was booked in.<\/span>\u00a0<\/span><\/p>\n Staff turnover.<\/strong>\u00a0People leave, change roles, or lose credentials. A clear log shows exactly when access was revoked and whether it was used after that point, which protects the\u00a0organisation\u00a0as much as it protects the departing employee.<\/span>\u00a0<\/span><\/p>\n Insurance claims.<\/strong>\u00a0Insurers increasingly ask for evidence of access control and monitoring after a claim, not just confirmation that a system exists. A documented, searchable audit trail is what turns “we had security measures in place” into something an insurer can\u00a0actually verify.<\/span>\u00a0<\/span><\/p>\n Martyn’s Law readiness.<\/strong>\u00a0For\u00a0organisations\u00a0already reviewing their access control approach ahead of Martyn’s Law, an audit trail is one of the clearest, most concrete things to get right. Under the Act’s Enhanced Tier, premises expecting 800 or more people are expected to carry out formal risk assessments and put in place reasonably\u00a0practicable\u00a0physical security measures. A searchable, time-stamped record of who accessed what is direct, demonstrable evidence that those measures\u00a0actually work, not just that they exist on paper.<\/span>\u00a0<\/span><\/p>\n Board and governance reporting.<\/strong>\u00a0This is often the version of the question that actually gets budget released.\u00a0Facilities managers are\u00a0frequently\u00a0the influencers rather than the final decision-makers, and getting sign-off from senior leadership depends on being able to answer a different, harder set of questions: can you\u00a0demonstrate\u00a0that permissions align with defined roles? Can you evidence that access is revoked\u00a0immediately\u00a0when it should be? Can you produce a searchable audit trail on demand, in front of a board, a regulator or an auditor? An access control system that only answers “did the door open”\u00a0doesn’t\u00a0help here. One that produces a clear, searchable\u00a0record does.<\/span>\u00a0<\/span><\/p>\n IT and infrastructure oversight.<\/strong>\u00a0For IT managers increasingly involved in access control decisions, the audit trail itself is data that needs to be handled properly: stored securely, access to the logs restricted and recorded, and the system able to sit alongside existing infrastructure rather than as an isolated island. An audit trail that\u00a0isn’t\u00a0itself secure and well-governed undermines the case\u00a0it’s\u00a0meant to support.<\/span>\u00a0<\/span><\/p>\n This is exactly what\u00a0SimonsVoss’s\u00a0software platforms are built to provide. Access events are logged centrally against named credentials, giving estates and facilities teams a searchable record rather than a scattered set of assumptions. Permissions can be set,\u00a0changed\u00a0or revoked instantly when someone\u00a0leaves\u00a0or a credential is lost, and that change is itself recorded. Retention settings can be configured to match what the\u00a0organisation\u00a0actually needs, rather than defaulting to whatever the system happens to store by default.<\/span>\u00a0<\/span><\/p>\n The result is a system that answers “who accessed this building, and when” as a straightforward search, not a project.<\/span>\u00a0<\/span><\/p>\nWhat a Proper Audit Trail Actually Captures<\/span><\/b>\u00a0<\/span><\/h2>\n
\n
\n
\n
\n
Why Data Retention Is the Gap Nobody Plans For<\/span><\/b>\u00a0<\/span><\/h2>\n
Where This Actually Matters<\/span><\/b>\u00a0<\/span><\/h2>\n
How\u00a0SimonsVoss\u00a0Systems Support This<\/span><\/b>\u00a0<\/span><\/h2>\n
FAQ<\/span><\/b>\u00a0<\/span><\/h2>\n
What a Proper Audit Trail Actually Captures<\/span><\/b>\u00a0<\/span><\/h2>\n
\n
\n
\n
\n
Why Data Retention Is the Gap Nobody Plans For<\/span><\/b>\u00a0<\/span><\/h2>\n
Where This Actually Matters<\/span><\/b>\u00a0<\/span><\/h2>\n
How\u00a0SimonsVoss\u00a0Systems Support This<\/span><\/b>\u00a0<\/span><\/h2>\n
FAQ<\/span><\/b>