Who can open the server room right now?
Every site keeps its own list in its own access system. Putting 1 answer together usually takes days.
Physical identity and access management
Most people who open your doors don't work for you
Contractors, cleaners, engineers and visitors come and go every day. We give each of them 1 record, access for as long as they need it, and a trail your auditor can follow.
One Identity. One Credential. Total Control.
Sound familiar?
3 questions most sites can't answer quickly
If you hesitate on 2 of them, it's worth a call.
Did last month's contractor hand back their badge?
Contractors and agency staff often outnumber your own people. Their access tends to live in mailboxes and spreadsheets.
Could someone copy your badges?
Several card types still in daily use were cracked years ago. Replacing them feels like a project nobody wants to own.
How it works
We sit on top of the systems you already have
Your readers, doors and access control stay where they are. We add 1 layer that decides who gets in, records why, and tells each system what to do.
Delivered
Already running, without anybody at a desk
6,000badges swapped
A European financial institution
6,000 badges swapped at the machine in a few weeks.
The old badge collected, the new one printed, personalised and encoded to MIFARE DESFire EV3, without anybody at a desk.
4,000badges re-coded
A European institution
4,000 badges printed and coded to a new DESFire key while the site moved from one system to another.
Handheld scanners stayed in sync, and a badge could be checked anywhere during the change.
1,000+contractors a month
A chemical plant
More than 1,000 contractors a month.
Identity read, the site's own policy checked, badge issued, all of it at the terminal on arrival.
Named references are shared under a non-disclosure agreement.
People and badges
The person and their badge, in 1 place
Most suppliers look after either identities or cards. We look after both. You deal with 1 contract and 1 team.
The person
Who they are, why they're here, and when that ends.
- 1 record per person, across all your sites and systems
- Contractors and visitors checked before they arrive, just like your own staff
- Access that ends on its own date, with the approval on file
- A straight answer to who can open which door
The badge
A card, a phone or a wallet: whatever they carry.
- Issued, replaced and handed back against that same record
- Your whole card base moved to newer technology, without a re-badging day
- A self-service terminal for visitors, contractors and forgotten badges
- Your encryption keys stay under your control
Auditors rarely ask whether you have a policy. They ask you to show it worked last Tuesday.
Evidence first
Regulation
What NIS2, DORA, ISPS and food defence ask about access
None of them mention badges. All of them want to know who had access, who approved it and when you last checked.
| The regime | What it asks of physical access | What you show the auditor |
|---|---|---|
| NIS2Essential & important entities | Physical access to the facilities that house your network and information systems is part of the required risk-management measures. Management is personally accountable for them. | Who held access to the server rooms and OT zones, who approved it, and the date it was last reviewed. |
| DORAFinancial entities & their ICT suppliers | Physical and environmental protection of ICT assets, extended to the third parties who work on them. | Contractor access to data halls, time-bound, approved by a named owner and closed on exit. |
| ISPSPort facilities & terminals | Restricted areas defined, identity verified for everyone entering, and records kept per the facility security plan. | Who entered which restricted zone, on which credential, and that the credential was valid at that moment. |
| Food defenceIFS · BRCGS · FSMA IA | Areas restricted to authorised persons, with contractors and visitors controlled at the identified vulnerable points. | Zone-level restriction per person, and contractors pre-qualified before they ever reach the floor. |
Sectors
Built for sites full of people you don't employ
Ports, plants, hospitals, data centres. Pick yours and walk through a typical day on site.
Ports & Terminals
Every call, every crew, accounted for
Chemical & Process
Only trained people, inside the unit
Data Centres
Provable access, rack by rack
Airports & Aviation
A pass that cannot outlive its reason
Government & Defence
One identity, every base
Food Manufacturing
Authorised persons only, and provably
Retail & Distribution
Hundreds of sites, one way in
Banking & Finance
Supplier access, on the record
Hospitals & Healthcare
A whole cohort moves, and access follows
Public Transport
A network with nobody standing by
Utilities & Critical Infrastructure
Unmanned sites, provable entry
Who we are
A Belgian team you can sit down with
Access data is personal data about your workforce. You should know who holds it, and where.
- A Belgian company. No parent or shareholder outside the EU; your contract is with a Belgian entity, governed by Belgian law.
- Developed in-house in Europe. The people who build the platform are the people you talk to.
- European Union hosting. Hosted in European Union data centres.
- As little of your data as possible. We read people data where it already lives. We don't copy your workforce into a second database.
10 yrsrunning in live production environments
7working integrations with access control systems
11sectors, each with a worked example
The first step
Start with 1 site and 1 population.
You judge something that runs on your own site. Your access systems and readers stay where they are. If it earns its place, we extend it site by site.
One siteOne populationYour readers stay
Questions
Questions we are asked before the first meeting
What is physical identity and access management (PIAM)?
PIAM is the governance layer above physical access control. Instead of administering doors and groups in each access control system, you hold one identity record per person. It says who they are, why they are on site, and when that reason ends. And the access systems receive the resulting decisions. The approval, the reason and the record move one layer up.
Do we have to replace our access control systems?
No. Nothing is replaced. Axxession is added above the systems you already run, across installations of more than one manufacturer. 7 access control systems are integrated today, as working integrations, not certified ones. Each system keeps operating as it does today and receives decisions from the governing layer.
How long does an implementation take?
We start with 1 site and 1 population. A local integrator partner delivers it, with our engineering behind them. You judge something that runs on your own site before anything is extended.
Where is our data stored, and who can access it?
Hosted in European Union data centres. No parent or shareholder outside the EU; your contract is with a Belgian entity, governed by Belgian law. People data is read at source rather than copied into a second workforce database. Most of your workforce data is never held by us at all.
Which regulations does this help us evidence?
Most commonly NIS2, DORA, the ISPS Code and food defence standards such as IFS and BRCGS, alongside customer contracts, ISO 27001 and SOC 2. None of these regimes mention a badge; all of them end up asking who held access, who approved it, and when it was last reviewed. The platform produces those records, ready when an auditor asks. Compliance itself also depends on your own policies and controls.
Can Axxession also handle our badges and card migration?
Yes, and that is unusual in this market. The same record that grants the access issues the credential, card, mobile or wallet. A whole card base can then move onto newer technology on a dual-technology card. There is no re-badging campaign, and every legacy badge is accounted for.