Face recognition access and attendance
Face verification for residents and staff at doors and gates, with anti-spoofing, explicit consent, and controls over who can see face data and for how long it is kept.
Face recognition gives residents and staff touchless entry at gates and doors, and records staff attendance without a card or a fingerprint. Liveness checks reject photographs and video replays, enrolment requires explicit consent, and face data is encrypted with access to it logged and reviewable.
Access that recognizes people, not cards
Every card-based access system in a residential property degrades the same way. Cards are lost, lent to a relative, kept by a tenant who has moved out, and shared among staff who work several shifts. Within a year the list of active cards is larger than the list of people entitled to enter, and nobody can say by how much.
Fingerprint readers solved part of that and created their own problems: they fail on worn hands, they are slow at shift change when forty staff arrive in ten minutes, and since 2020 many properties have been unwilling to run a shared-touch device at all.
Face verification removes the credential entirely. The person is the credential, which means it cannot be lent, lost or left behind when someone stops working here. That is a genuine improvement in access control — and it is also biometric data about residents and staff, which puts obligations on the society that a card never did. Both things are true, and this page treats them as equally important.
- Credentials leak. Cards get shared and outlive the tenancy that issued them; a face does not.
- Shift change is a throughput problem. Forty staff through one reader in ten minutes is where fingerprint systems fail.
- Biometrics raise the stakes. A leaked card list is embarrassing. A leaked face database is not recoverable.
Key capabilities
Three capabilities are about access, three are about not creating a liability while providing it.
Touchless resident and staff entry
A device at a gate, tower door or lift lobby verifies a face against the enrolled set for that zone and releases the door. Verification takes well under a second and needs no contact, which is what makes it viable at shift change and at the evening peak.
Residents are opt-in throughout. A society deploying face entry still runs its normal access method alongside it, because a resident who declines biometric enrolment must not thereby lose access to their own home. Any deployment that fails this test is one we will tell you not to run.
Face-based staff attendance
For staff, the same device records attendance. A punch is a verified face at a known device at a known time, which removes buddy punching — the single largest source of dispute in agency-staffed properties — without a supervisor standing at the door.
Attendance and access are one event rather than two systems. The guard who enters at the start of a shift has both been admitted and marked present, and the agency invoice at the end of the month reconciles against those records.
Visitor face capture at the gate
Visitors are photographed rather than enrolled. The distinction matters: a photograph attached to an entry record is evidence about one visit, while enrolment would mean building a face database of everyone who has ever visited the property. We do not do the second thing, and no society should ask a vendor to.
Visitor photographs follow the retention schedule the committee sets and are purged on that schedule automatically.
Anti-spoofing liveness checks
A recognition system with no liveness check can be defeated with a photograph on a phone screen, which makes it worse than a card because it produces false confidence. Devices perform liveness detection — depth, micro-movement and texture cues depending on the hardware — and reject a static image or a replayed video.
No liveness check is perfect, and any vendor claiming otherwise is overselling. For high-consequence doors the sound design is face plus a second factor, not face alone.
Zone-wise access permissions
Permissions are set per zone and per role rather than globally. A housekeeping supervisor may open service areas and tower doors but not the terrace or the transformer yard; a resident opens their own tower and shared amenities; an agency technician gets access to the pump room for the duration of a work order and not afterwards.
Because permissions derive from the unit record and the staff roster, they expire on their own. A tenant who has moved out loses access when the tenancy record closes, without a separate act of housekeeping.
Consent and privacy controls
Enrolment records an explicit consent — who consented, when, and to what use — and a resident or staff member can withdraw it, at which point their template is deleted. Face templates are stored encrypted as mathematical representations rather than as retrievable photographs, and access to face data is itself logged, so a committee can see who looked at what.
The committee sets retention. Access logs and attendance records normally need to be kept for a period; the biometric templates behind them do not need to outlive the person’s relationship with the property, and by default they do not.
How it works
Enrolment is the only step a person does consciously. Everything after it is a door opening.
Who it helps
Face access is the feature most likely to generate a resident objection, so the honest version of who it helps includes who will object.
Works with the rest of KeyMatrix
Face access is only worth deploying if permissions maintain themselves, and that requires the access system and the resident register to be the same system. They are. A flat that changes hands, a tenancy that ends, a staff member whose contract closes — each of those revokes access as a consequence of the record changing.
Attendance flows into the commercial relationship. Verified presence per staff member per shift is what an agency invoice is checked against, and the gap between hours invoiced and hours verified is usually the first thing a facility manager wants to see.
- Staff attendance. A verified face is the punch; there is no second system to reconcile.
- Unit management. Tenancy and ownership changes revoke access without a separate step.
- Vendor management. Technician access can be scoped to a work order and expire with it.
- Visitor management. Visitors are photographed against an entry, never enrolled into a database.