What happens to your doors when the internet drops
The fear is reasonable: if the rules live in the cloud, what opens the door when the line is down? The answer is that the rules should not only live in the cloud.
It is the first objection in every meeting, and it deserves a straight answer rather than reassurance. If access decisions are made in a data centre, a broken connection sounds like a building full of people standing outside.
Where the decision is actually made
In a well-built system the cloud is where rules are written, not where they are enforced. The controller behind the door holds a current copy of who may pass and when, and it decides locally in a few milliseconds. The connection is used to change rules, to pull events out, and to raise alerts - none of which the door needs in the moment someone presents a credential.
So an outage means: the door keeps working with the rules it had, events queue on the controller, and everything syncs when the line returns. What you lose during the outage is the ability to make a change take effect immediately, and live visibility of who is arriving.
What you actually lose, and what to do about it
Two things are worth planning for. First, an urgent revocation during an outage will not reach the door until the connection is back; sites that need a hard guarantee here put the sensitive doors on a reader with a local keypad or biometric so a credential alone is not enough. Second, live occupancy for an evacuation is only as current as the last sync, so keep a printed muster procedure that does not depend on a screen.
Questions to ask before you buy
- How long can a controller run offline, and what happens when its event buffer fills?
- Does it keep enforcing schedules offline, or does it fall back to allowing everyone with a valid card?
- What is the failure mode of the lock itself - fail-safe or fail-secure - and does that match the fire strategy for that door?
- When the connection returns, are queued events preserved with their original timestamps?
That last one matters more than it sounds. If offline events come back stamped with the sync time rather than the tap time, every attendance record from the outage is wrong, and the audit trail cannot be used as evidence.
The honest summary
Cloud access control is not less resilient than an on-premise panel, because the panel is still there - what changed is where the rules are authored. Ask the four questions above, check the answers against a real outage rather than a datasheet, and the objection stops being an objection.