If your security system makes you change how you work just to keep it happy, that’s backwards. A lot of UK businesses end up there with off-the-shelf access control: the software has opinions about doors, shifts and approvals, and you’re the one who has to bend.
ByteGears builds custom access control software for British businesses. Instead of a SaaS product with a per-door monthly bill and a fixed feature set, you get something built around how your premises, staff, shifts and security routines actually work. We’re a UK development consultancy that works with small and mid-sized companies, and the software we build is yours to keep, with no licensing fees and support from people in your timezone.
When access control starts to matter
Below about 50 people on a single site, a mix of keys and a spreadsheet often does the job, and a packaged cloud product is usually enough if your needs are simple. Things change when one of these turns up:
- You’ve outgrown spreadsheets and lost keys, and access changes are slow to push through
- You’ve failed an audit, or can’t prove who was in a secure area when something went wrong
- You’ve added a second or third site and managing keys across them has become untenable
- Leavers keep their access for too long because deprovisioning is manual
- You need access tied to HR, shift patterns, training certification or project assignment, not just a flat list
If you recognise two or three of those, you’ve reached the point where the system needs to fit the business rather than the other way round.
Where off-the-shelf access control runs out of road
Generic systems tend to cause the same handful of headaches as a company grows:
- Per-door and per-user pricing scales badly. Cloud platforms typically bill around £20-50 per door per month, or per credentialed user. Add visitor management, video integration and advanced reporting as separate modules and the quote you signed bears little resemblance to the invoice three years in. Contractor and visitor counts quietly inflate per-user plans.
- No graceful offline fallback. Cloud-only systems depend on connectivity. When the link drops, so can your doors, and the emergency procedure for that often hasn’t been thought through.
- Rigid workflows. One-size-fits-all approval flows rarely match shift-based access, supervisor exceptions, or access that should depend on a training certificate or project. So people work around the policy, which defeats the point.
- Integrations are bolted on, not built in. Connecting legacy door hardware, your HR system, CCTV or ticketing often means third-party connectors that add cost, latency and another thing to break. Dropped webhooks leave access drifting out of sync with who actually works for you.
- Vendor lock-in. Proprietary APIs, data formats and credential encoding make switching expensive, so you stay put even when the fit is poor.
The result: you patch around it, security gets a bit weaker, and you spend time babysitting a tool that was supposed to save you time.
What we do differently
We build access control systems that work the way your business already does:
We start by mapping your current security routines - your doors, zones, shift patterns, joiner and leaver process and audit obligations - then build software that supports them rather than replacing them with something generic.
You own the system outright. No per-door fees, no per-user creep. The marginal cost of another door, site or contractor is close to nothing once it’s built.
We build API-first, so the software connects natively to your door controllers and readers, HR system, directory, CCTV and alarm kit - without Zapier in the middle and without monthly integration charges.
We design for resilience. Access decisions can run locally at the controller, so an internet or server outage doesn’t lock people out, and events sync back once the connection returns. Emergency egress always works.
UK GDPR, fire safety rules and immutable audit logging are part of the architecture from the start, not bolted on later. You choose hosting: UK cloud, on-premise, or hybrid.
The architecture is modular, so adding locations, credential types or new integrations later is an extension, not a rebuild.
What’s typically in the build
Every system is shaped around your requirements. Underneath, most manage the same core data - users, credentials, doors, access groups, access rules, events and visitors - and most include:
- A central dashboard showing every access point in real time, with configurable alerts for things like a door held open or repeated denied attempts.
- User and credential management covering RFID cards, mobile credentials and, where needed, biometrics or PIN - with issue, expiry, replacement and revocation handled cleanly.
- Access groups and role-based permissions, so you control who gets into which areas, with time-of-day rules where they make sense.
- Multi-location control from one interface, with rules that vary by site.
- Visitor and contractor management: temporary credentials with an expiry date, area limits and a host on record, plus check-in and check-out.
- HR and directory integration so joiners are provisioned and leavers are revoked automatically, instead of chasing a card back after someone’s last day.
- Connectors for common door hardware, CCTV and alarm monitoring, with access events correlated to video for incident review.
- Immutable audit logs of every access attempt - granted, denied, override - with reporting you can run in the format your compliance paperwork needs.
- Emergency overrides for instant lockdown or evacuation, triggered by authorised staff, alongside fire-compliant manual egress.
- Room to add doors, sites, integrations and new technology without replacing the system.
How the project runs
Most projects run three to six months end to end, depending on complexity and how much they need to integrate with. We phase it so you see something working early.
Discovery and planning takes two to four weeks. We document your current processes, security requirements, door and zone layout, and integration needs through workshops and a look around your sites. This is where we untangle access groups before they become unmaintainable - a common failure point when scope is rushed.
Core development runs roughly eight to twelve weeks. Our UK developers build the first usable release: access logic and door control, user provisioning, the admin dashboard, mobile credentials, emergency override and audit logging. Regular check-ins mean you see progress, not a black box.
Integration and testing adds the connections that matter to you - HR-driven provisioning, visitor management, video correlation, time-based rules - followed by QA, a pilot on a small number of doors, and staff training before go-live. Phasing this way contains the usual risks: incomplete user imports, HR sync gaps and credential issuance backlogs.
Training and support continues afterwards: documentation written for your setup, plus direct support channels for your team during the first 12 months.
What it costs
Custom development costs more up front than a SaaS subscription. Over a few years, owning the software usually comes out ahead - particularly across multiple sites, where per-door fees compound fastest.
- No recurring per-door or per-user fees. Compared with paying SaaS costs indefinitely, ownership typically pulls ahead somewhere in the second or third year for multi-site operations.
- Fewer hidden costs. No surprise charges for the visitor module, video add-on, extra reporting, API tiers or long-term log storage - these are part of the build.
- The software is your asset, fully under your control, with no migration project forced on you later when you outgrow a packaged product.
- Less time on security admin and fewer workflow disruptions, because the system follows your process.
What it actually costs depends on scope - the number of doors and sites, which integrations you need, and whether biometrics or video correlation are involved. The free consultation gives you a clear, scoped price rather than a guess.
Where it’s used
Custom access control earns its keep where the workflows are specific to a sector:
- Office buildings and shared workspaces managing staff and visitor access across floors, with hot-desking, escorted access to sensitive areas, and room booking tied to access.
- Manufacturing and warehousing restricting production floors and hazardous zones, with entry tied to current training or equipment certification and supervisory approval for overtime access.
- Healthcare restricting pharmaceutical stores, records and surgical suites while keeping emergency clinician access open, with audit trails fit for clinical governance and access that lapses when a registration expires.
- Schools, colleges and universities running timetable-based and term-time access, with hierarchy-based rights across labs, libraries and campus buildings.
- Retail and hospitality controlling stockrooms, cash-handling areas and after-hours access, with permissions tied to scheduled shifts and CCTV correlation for loss prevention.
- Financial services enforcing segregation of duties, elevated-access approval workflows and audit-ready immutable logs for the regulator.
- Data centres controlling rack and equipment access around maintenance windows, with physical access correlated to ITSM tickets and configuration changes.
- Government and high-security sites running offline-capable, air-gapped systems with multi-factor entry and cryptographic audit logs.
We build the system around the compliance and operational realities of your sector, and we’ll tell you honestly when a packaged product would serve you better.
Common Questions About Custom Access Control Software
How does a custom build compare on cost with per-door SaaS?
Cloud access control is usually billed per door or per credentialed user, often somewhere around £20-50 per door per month, plus setup, visitor and reporting add-ons. That looks cheap on a small site and stings once you have dozens of doors across several locations. A custom build is a larger upfront investment, but you own it and the marginal cost of another door or user is close to nothing. For multi-site operations the cumulative SaaS bill usually overtakes a custom build within two to three years.
What's the typical development timeline?
A focused first release - door control, user provisioning, audit logging, an admin dashboard and mobile credentials - usually takes around 8 to 12 weeks. Adding visitor management, HR-driven provisioning, time-based rules or video correlation pushes a full project to roughly four to six months. Highly regulated or biometric-heavy builds can run longer. We phase the work so something useful goes live early rather than waiting for the whole system.
How do you handle updates and changes?
The first 12 months of support and fixes are included, with optional maintenance after that. The system is built in modules, so adding doors, sites, integrations or new credential types later is an extension rather than a rebuild. Because the code and data are yours, you are never waiting on a vendor roadmap for a change you need.
Can you integrate with our existing door hardware and HR systems?
Usually, yes. We design API-first and can work with common controllers and readers from the likes of HID and Assa Abloy, plus Active Directory or LDAP, HR platforms, CCTV and visitor sign-in. HR integration is where most of the value sits: when someone leaves, their access can be revoked automatically instead of waiting for a manual card collection.
What happens if the internet or the server goes down?
We design for it. Door logic can run locally at the controller so people still get in and out during an outage, with events syncing back once the connection returns. Emergency egress is never blocked - doors stay compliant with fire safety rules, with manual override and battery backup. This offline resilience is a common reason businesses move away from cloud-only systems.
What about data security and UK GDPR compliance?
Access control counts as a security measure under UK GDPR, and access logs are themselves personal data. We build immutable audit logs, configurable retention (commonly 12 to 24 months), encryption in transit and at rest, and role-restricted access to the logs. If you use biometrics, that is special category data - it needs explicit consent and a DPIA, and we will design the data handling around that. You also choose where it is hosted: UK cloud, on-premise or hybrid.
Do you provide training for our team?
Yes. Administrators get hands-on training for provisioning and reporting, security and facilities staff are walked through incident review and emergency override, and HR onboarding gets a clear joiner and leaver checklist. End users typically need only a short session to start using a card or mobile credential. Documentation is written for your specific setup, not a generic manual.