Industries · Government

Physical access governance for government

Town halls and civic offices, but also archives, depots, pumping stations and traffic installations. Key2XS connects the IAM you already run to the keys already on those doors, accountable to the standards you answer to.

1 estatefrom town hall to pumping station
< 2 hrsstandard integration, live
99.99%platform availability
NIS2 + CERaudit-ready evidence
The problem

Many hands, public accountability

Civil servants, consultants, outsourced services, event crews and field teams all need keys. Every arrival and departure is a change the key administration must catch, and it rarely catches all of them.

Outsourced rotation

Facility and cleaning staff rotate without a leaver process you ever see.

Consultants who stay

A six-month contract lives on in the key registry for years.

Internal mobility

People move between departments; the old access quietly remains.

The one-person registry

A spreadsheet one person understands, until they retire.

When something happens in an archive or a pumping station, one question is asked publicly: who could enter here, and on whose authority?

How it works

Access that follows the identity

Middleware between your IAM and the locks already on your buildings and installations. Follow one facilities contract through four events.

Event access active
Civic buildings Field estate

Audit trail
09:02:14GRANTcityhall-wing-brole programme-member
09:02:14GRANTcivic-office-noordrole programme-member
09:02:15GRANTmeeting-centre-104role programme-member
12:15:30REVOKEdepot-westdepartment change, auto
12:15:30LOGold rights closedsame movement
17:00:02REVOKEall sites (12)contract end date
17:00:02LOGevidence sealedaudit chain
chain intact · tamper-evident
NIS2 and CER

Answers a public body can give

NIS2 brings public administration entities into scope, including appropriate policies for access to premises. Municipalities running critical infrastructure can face CER. Both ask for the same thing: governed, current, demonstrable.

Who could enter this archive, on whose authority?Live, per identity, role and approval.
Did the consultant's access end with the contract?Automatically, on the end date, logged.
Show every change for this depot this year.One tamper-evident trail. Minutes, not days.
Mechanics

Governance that survives being offline

A pumping station or a traffic cabinet sees a key long before it sees a network. Rights travel with the key, and a withdrawal is enforced at the next key update.

How rights travel

Control planethe decision
The keycarries the rights
The lockno power, no network

The next time the key is used or updated it picks up its new rights. Revocation propagates the same way.

What happens on withdrawal

Right withdrawnin the control plane
revocation window
Enforced at the keynext update or check
Closed by the key system's own offline logic
Validity expiryBlacklist checkOnline update

Near real time, not instantaneous. Each key system closes the window with its own mechanism; Key2XS makes the decision centrally and logs the change.

Works with what you run

Identity decides. Policy governs.
Technology executes.

Middleware through standard interfaces. Locks, keys and the locking plan stay as they are.

Identity side
Microsoft Entra ID SailPointCertified partner Okta One Identity Manager OpenText Identity Manager
Key2XS

Identity decisions become access rights, with evidence.

Locking side
iLOQ ASSA ABLOY CLIQeCLIQ · PROTEC², certified ASSA ABLOY AccessASSA ACCESS · ASSA CUMULUS · ASSA PULSE ASSA ABLOY Traka
FAQ

Government, answered

How does this help public organizations under NIS2?

NIS2 brings public administration entities into scope and requires appropriate policies for access to premises. Key2XS enforces physical access through identity and policy and produces the audit trail that demonstrates it.

Can access for external consultants end automatically?

Yes. Access follows the assignments and end dates in your IAM system. When a contract ends, the corresponding access rights are withdrawn automatically and the change is logged.

We span very different locations, from offices to pumping stations. Is that one solution?

Yes. Key2XS governs access rights centrally regardless of location type. Civic buildings, archives, depots and outdoor installations are all mapped to roles in the same flow.

Do we have to replace our locks or keys?

No. Key2XS is middleware. It orchestrates access rights through the standard interfaces of your existing key systems: iLOQ, ASSA ABLOY CLIQ, ASSA ABLOY Access or Traka. Locks, keys and the locking plan stay as they are.

How long does implementation take?

A standard integration is live in under two hours, through pre-built connectors, with no custom development required from your team.

See it on your estate

A guided walkthrough of how identity, policy and physical keys come together across a public estate.