If the internet goes down, do your doors stop working? Cloud access control offline behavior depends on the equipment, configuration, power, and type of outage. In many systems, existing credentials and door rules continue at a local controller or intelligent lock. Live cloud functions may pause until the connection returns.
For an IT Director supporting multiple sites, “it works offline” is too vague. Ask which decisions remain local, which changes need a connection, how long events are stored, and what happens when connectivity returns. Test those answers at a real door before accepting the deployment.
How does cloud access control work offline?
In a common design, the cloud platform manages users and policies while a controller at the site makes door decisions using its last received configuration. A known credential can still be checked locally during a temporary WAN outage. Some wireless locks have different synchronization and offline behavior, so the architecture matters.
That does not promise every door will work indefinitely. The controller needs power, a functioning connection to the reader and lock, and locally available policy. A platform outage, a site network failure, and a power failure are different events. Ask your integrator to show the behavior for each one.
What keeps working when the connection is lost?
The answer varies by product and setup. A site controller may continue to handle:
- Previously synchronized credentials
- Stored access levels and door schedules
- Local lock and unlock rules
- Door position and request-to-exit inputs
- Local alarms and access event storage
“Previously synchronized” is the key qualification. If a credential and its permissions reached the controller before the outage, the last known rules may continue to apply. If the controller never received a new credential, it cannot make a decision from a change it does not know about. Confirm the controller’s database and storage limits for the specific site.
What stops or gets delayed during an internet outage?
Tasks that need live communication with the cloud may be unavailable or delayed. These can include a new badge or mobile credential reaching the site, a schedule or access-level change, a remote unlock command, current event visibility in the cloud dashboard, and integrations that send updates from HR or an identity provider.
The administrator may still be able to make a change in the central application. That does not mean an offline controller has received it. The interface and the door can temporarily show different states. Your operating procedure should say who checks that the change actually reached the site after recovery.
A new hire arrives during the outage
Suppose the site loses its WAN connection at 8:00 a.m. HR creates a new employee at 9:00 a.m. and an administrator issues access in the cloud. If the local controller cannot receive that update, the employee’s credential may not open the door until service returns. Plan an approved, supervised way to admit that person when the business cannot wait. The answer should never depend on an improvised shared code.
An employee is terminated while the site is offline
This is the more sensitive case. A credential that was valid locally before the outage may remain valid under the last synchronized rules even after someone revokes it in the cloud. The timing and any local override depend on the system. Ask: “If we terminate a user while this site is offline, when and how does that credential stop working at the door?”
For a higher-risk opening, define an immediate local escalation, an authorized on-site response, or redundant connectivity. Include verification after the controller reconnects. Do not treat a cloud-side confirmation as proof that every offline site has applied a revocation.
Are access events lost when cloud access control is offline?
Many controllers store events locally and forward them when connectivity returns. The storage limit and recovery behavior are product-specific. A quiet office and a busy distribution center may consume capacity at very different rates.
Ask how many events the controller can hold, what happens when storage fills, whether timestamps remain accurate, which event types are retained, and whether the cloud presents them in the right order after reconnection. If access events are tied to video, test how that association behaves during and after the outage. “Events are cached” is a starting claim, not a complete specification.
Do schedules and remote unlock commands still work?
A schedule already stored on the controller may keep running. A change made after the connection is lost may not arrive. Test normal hours, holiday rules, temporary unlock periods, controller timekeeping, and an extended outage. A site closure or special event can expose a gap in a plan that only tests the usual workday.
A command sent from a cloud dashboard generally needs a path to the site. If that path is down, remote lock or unlock may not reach the door. Local door operation and required egress are separate design questions. The locking arrangement, power-loss response, emergency release, and fire-alarm interaction must be reviewed for the opening and applicable local requirements. Remote administration is never a substitute for a compliant life-safety design.
What if the internet and power both go down?
Internet redundancy does not power a controller. Ask which controllers, readers, locks, network devices, and cellular equipment are on backup power, how long the backup is expected to last, and how batteries are tested and replaced. Confirm the actual lock behavior after power is exhausted and the required egress arrangement. A fail-safe or fail-secure label alone does not describe the whole door.
A useful acceptance test separates three conditions: loss of the WAN path, loss of the site’s network equipment, and loss of normal power. Each can affect different components. Document the result at representative doors, including a restart after power returns.
When does cellular or a second internet connection make sense?
A second path can reduce the time a site is disconnected from cloud management. Options include dual ISPs, wired service with cellular failover, or a dedicated cellular connection. The right choice depends on outage frequency, the need for live administration, termination risk, event visibility, carrier coverage, and the cost of downtime.
In Alen Security’s national retail deployment, a Brivo cellular module is part of the access control architecture, reducing dependence on the retailer’s store or corporate LAN. That is one design choice, not a universal prescription. Cellular still depends on coverage, equipment, power, provider service, and account management.
For a multi-site business, classify locations by operational need. A small office may tolerate delayed administration. A 24-hour distribution center or sensitive facility may need a second path and a more explicit local response. Let IT decide whether access control uses enterprise network redundancy or a dedicated connection.
How should IT test cloud access control offline?
Run a controlled outage during commissioning. Capture the platform’s stated behavior first, then test it at representative doors. Coordinate the test with Security, Facilities, the integrator, and anyone responsible for safe operation.
- Confirm the starting configuration, then disconnect the WAN path while keeping local equipment powered.
- Test an existing authorized credential, a denied credential, schedules, and local event capture.
- Try a remote command and test user change; record what reaches the door.
- Restore service and confirm event upload, queued changes, time accuracy, and health. Repeat the relevant checks on backup power or a second connection.
Record the controller model, firmware, credential type, test time, outage duration, observed door behavior, event counts, and any manual steps. A passing test at one door does not automatically prove every lock type and site configuration behaves the same way.
How long can cloud access control offline operation last?
There is no universal number. Known credentials may continue to work while administration becomes increasingly constrained. The practical limit depends on local database and event capacity, stored schedules, controller timekeeping, power and battery runtime, and the changes the business needs to make during the outage.
Ask two separate questions: “How long can the door make the expected local decisions?” and “How long can our team operate the site acceptably without central changes or live visibility?” A vendor answer to the first does not settle the second.
What should every site document before an outage?
Write a short response plan by site class. It should cover what continues, what pauses, who owns the incident, and how to verify recovery. These examples are prompts to fill with tested, platform-specific answers:
- Existing credentials: expected local decisions and site status monitoring.
- New hires and terminations: temporary admission, urgent revocation, and local escalation.
- Remote commands and events: authorized on-site alternative, local storage limit, and reconciliation.
- Power loss: battery runtime, door behavior, and life-safety response.
Identify who contacts the ISP or carrier, who supports the controller, who can authorize a local procedure, and who closes the incident after event and configuration synchronization. For multiple locations, a single escalation path and consistent site records make the response easier to repeat. Our multi-site access control standardization guide explains how to set those portfolio-wide rules.
Frequently asked questions
Will employees be locked out if cloud access control loses internet?
Not necessarily. Many systems make decisions for previously synchronized credentials locally. Verify the selected controller, lock, and configuration with an outage test.
Can I issue or revoke a badge while a site is offline?
You may be able to change the user in the cloud platform, but the offline site may not receive the update until connectivity returns. Test the propagation and define a local procedure for urgent changes.
Does cellular backup eliminate outages?
No. It supplies another communication path, but carrier service, signal, equipment, power, and the cloud platform can still fail. Confirm failover and recovery in a controlled test.
Will a cloud platform unlock doors when the power fails?
The door’s behavior depends on its hardware, power and backup design, and required egress arrangement. Internet loss and power loss must be evaluated separately.
Know the offline story before you deploy
Cloud access control offline operation can keep known users moving through doors while central administration waits for a connection. The useful question is exactly which functions continue at each site, for how long, and what your team does when an urgent change cannot reach a door.
Alen Security can help your IT and Security teams review controller behavior, test an outage, and set the right connectivity and response plan for each location. Talk with Alen Security about offline operation at your sites.