Face recognition access and attendance
Face verification for residents and staff at doors and gates, with anti-spoofing, explicit consent, and controls over who can see face data and for how long it is kept.
Face recognition gives residents and staff touchless entry at gates and doors, and records staff attendance without a card or a fingerprint. Liveness checks reject photographs and video replays, enrolment requires explicit consent, and face data is encrypted with access to it logged and reviewable.
Access that recognizes people, not cards
Every card-based access system in a residential property degrades the same way. Cards are lost, lent to a relative, kept by a tenant who has moved out, and shared among staff who work several shifts. Within a year the list of active cards is larger than the list of people entitled to enter, and nobody can say by how much.
Fingerprint readers solved part of that and created their own problems: they fail on worn hands, they are slow at shift change when forty staff arrive in ten minutes, and since 2020 many properties have been unwilling to run a shared-touch device at all.
Face verification removes the credential entirely. The person is the credential, which means it cannot be lent, lost or left behind when someone stops working here. That is a genuine improvement in access control — and it is also biometric data about residents and staff, which puts obligations on the society that a card never did. A leaked card list is embarrassing; a leaked face database is not recoverable. So this page starts with the obligations.
Consent and privacy controls come before the first door
Residents enrol from the app; staff enrol at a device with a supervisor present. Consent is captured as part of enrolment, with the purpose stated in plain language, and the record says who consented, when, and to what use. A resident or staff member can withdraw it, at which point their template is deleted.
Face templates are stored encrypted as mathematical representations rather than as retrievable photographs, and access to face data is itself logged, so a committee can see who looked at what. Logs are visible to the roles permitted to see them and to nobody else.
The committee sets retention. Access logs and attendance records normally need to be kept for a period; the biometric templates behind them do not need to outlive the person’s relationship with the property, and by default they do not.
Residents are opt-in throughout. A society deploying face entry still runs its normal access method alongside it, because a resident who declines biometric enrolment must not thereby lose access to their own home. Any deployment that fails this test is one we will tell you not to run.
Touchless resident and staff entry, zone by zone
Touchless resident and staff entry
A device at a gate, tower door or lift lobby verifies a face against the enrolled set for that zone and releases the door, on-device where the hardware supports it. Verification takes well under a second and needs no contact, which is what makes it viable at shift change and at the evening peak.
Zone-wise access permissions
Permissions are set per zone and per role rather than globally. A housekeeping supervisor may open service areas and tower doors but not the terrace or the transformer yard; a resident opens their own tower and shared amenities; an agency technician gets access to the pump room for the duration of a work order and not afterwards.
Because permissions derive from the unit record and the staff roster, they expire on their own. A tenant who has moved out loses access when the tenancy record closes, without a separate act of housekeeping.
Face-based staff attendance
For staff, the same verification records attendance. A punch is a verified face at a known device at a known time, which removes buddy punching — the single largest source of dispute in agency-staffed properties — without a supervisor standing at the door.
Attendance and access are one event rather than two systems. The guard who enters at the start of a shift has both been admitted and marked present, and the agency invoice at the end of the month reconciles against verified presence rather than a signed sheet.
Anti-spoofing: what liveness checks stop, and what they do not
A recognition system with no liveness check can be defeated with a photograph on a phone screen, which makes it worse than a card because it produces false confidence. Devices perform liveness detection — depth, micro-movement and texture cues depending on the hardware — and reject a static image or a replayed video.
No liveness check is perfect, and any vendor claiming otherwise is overselling. For high-consequence doors the sound design is face plus a second factor, not face alone.
Visitor face capture at the gate: photographed, never enrolled
Visitors are photographed rather than enrolled. The distinction matters: a photograph attached to an entry record is evidence about one visit, while enrolment would mean building a face database of everyone who has ever visited the property. We do not do the second thing, and no society should ask a vendor to.
Visitor photographs follow the retention schedule the committee sets and are purged on that schedule automatically.