TL;DR
After-hours cleaning access works when three things are true: every credential is issued to a named individual, every credential is logged and revocable, and someone is reachable when an alarm goes off. Shared codes and unnamed keys are the most common weakness, and they are also the easiest to fix.
Why Access Is the Hard Part of Night Cleaning
An after-hours crew is in an empty building, unsupervised, with access to nearly every room. That is a reasonable arrangement and it is also a genuine security decision.
Most organizations handle it informally at first: one key, one code, one instruction to lock up. Informality works until the first personnel change, at which point nobody knows how many copies exist.
The failure is almost never dramatic. It is a code shared with a substitute, a key that was never returned, or an alarm that gets disarmed by someone nobody can name.
Access requirements also cost money, and they belong in the scope you issue to bidders. What a commercial agreement generally covers is in the guide to commercial cleaning scopes and vendors.
How Should a Cleaning Crew Be Given Building Access?
Individually and revocably. Issue a badge or credential to each named person rather than a shared code or a floating key, keep a written record of who holds what, and set an expiry or a periodic re-verification. Individual credentials produce an access log that shows who was in the building and when, which is what makes an incident investigable.
Shared credentials produce the opposite. When something goes wrong under a shared code, the honest answer to "who was here" is that nobody knows, and that answer is expensive.
Badges, Keys, and Codes
Electronic credentials are the strongest option where a building has them. They are individually assignable, instantly revocable, and they generate a log automatically.
Physical keys are harder to control. If they are the only option, keep a signed key register, use restricted keyways where possible so copies cannot be cut casually, and count keys back on every personnel change.
Lockboxes are convenient and weak. A lockbox code shared with a rotating crew is functionally a public code, and codes shared by text message spread further than anyone intends.
Alarm codes should be individual where the panel supports it. Most modern panels allow multiple user codes, and using that capability turns a disarm event into a record of who disarmed it.
Set an expiry on vendor credentials so they lapse by default. Credentials that lapse are safer than credentials that require someone to remember to remove them.
Alarm Procedures
Write the procedure down and give it to the crew before the first shift, not after the first false alarm.
Cover the disarm sequence, the entry delay, and which door to use. Crews entering through an unexpected door is a common cause of accidental trips.
Cover what happens when the alarm trips anyway: who the monitoring company calls, in what order, and what the crew should do while waiting.
Cover the passphrase. Monitoring companies verify by passphrase, and a crew that does not have one cannot cancel a dispatch.
Expect a false alarm in the first weeks of a new crew and treat it as orientation rather than as a failure. Many jurisdictions charge fees for repeated false alarms, so it is worth getting the procedure right early, and local rules on that vary -- check with your alarm provider and your municipality.
Escorts and Restricted Areas
Some spaces should not be in a general cleaning scope, and deciding that in advance is simpler than retrofitting it.
Server rooms, records storage, cash handling areas, laboratories, and anywhere with regulated material are common exclusions or escort-only areas.
Escort requirements are expensive and they should be priced. A crew that has to wait for an escort is a crew being paid to wait, and vendors will either charge for it or quietly skip the space.
Where a room is excluded, say who cleans it instead. Excluded rooms with no alternative owner simply do not get cleaned, sometimes for years.
Locked-away exclusions are more reliable than instructions. A door that is locked cannot be entered by mistake by a substitute who never read the notes.
Substitutes, Turnover, and the Weak Point
The most common access failure is not a bad actor. It is a substitute.
Require that the vendor notify you before an unfamiliar person works in the building, and require that substitutes are named. Otherwise your access record and the reality diverge.
Require that credentials are returned when someone leaves the vendor's employment, and ask how the vendor tracks that internally. A vendor with no answer has no process.
Ask about background screening practices as a normal part of vetting, alongside insurance certificates. What screening covers and how it is done varies, and it is a fair question to ask before granting after-hours access.
Re-verify the credential list quarterly. Lists drift, and a quarterly reconciliation catches drift while it is small.
Incident Reporting
Decide in advance what the crew reports and to whom.
Property damage found on arrival, a door found unsecured, an unfamiliar person in the building, an alarm event, or an injury are all reportable, and each one should have a defined recipient.
Give them one number and one address, and make sure it reaches a person outside business hours. A reporting path that only works at 9 a.m. is not a reporting path for a night crew.
Ask for a written note the same night rather than a verbal mention the next week. Details decay quickly.
Access During a Vendor Change
Every transition is an access event, and it deserves the same discipline as the day-to-day arrangement.
Collect every credential from the outgoing crew on the final night, reconcile against the register, and change alarm codes on the changeover date as routine practice.
Issue and test new credentials before the incoming crew's first shift, since a crew locked out at 7 p.m. loses the night entirely. The whole handover process is covered in running a cleaning vendor transition.
If the access burden is heavy enough, it is worth revisiting whether some work should move into business hours instead, which is the tradeoff in scheduling office cleaning around business hours.
Across a portfolio, use the same credential policy everywhere rather than letting each site invent one, which is the approach in getting consistent cleaning across multiple sites.
FAQ
How should cleaning crews access a building after hours?
Through individually issued, revocable credentials rather than a shared code or floating key. Keep a written register of who holds what, set an expiry so credentials lapse by default, and use individual alarm codes where the panel supports them.
Are shared door codes acceptable for a cleaning crew?
They are common and they are the weakest arrangement available. A shared code makes it impossible to say who was in the building, which is exactly the question that matters after an incident. Codes shared by message also spread further than intended.
What should a cleaning crew do if the alarm goes off?
Follow a written procedure given to them before their first shift. It should name the disarm sequence, the entry door, the monitoring company's call order, the verification passphrase, and what to do while waiting. Expect a false alarm early with any new crew.
Should cleaning crews have access to server rooms and records storage?
Usually not on a general scope. Server rooms, records storage, cash handling areas, and regulated spaces are commonly excluded or escort-only. If a room is excluded, name who cleans it instead, or it will simply go uncleaned.
How do I handle substitute cleaners I have not met?
Require advance notification and require that substitutes are named before they work in the building. Unnamed substitutes are the most common way an access register stops matching reality, and they undermine every other control you have in place.
What happens to access when we change cleaning vendors?
Collect every credential on the outgoing crew's final night and reconcile against the register, change alarm codes on the changeover date as routine practice, and issue and test new credentials before the incoming crew's first shift so nobody is locked out.
Getting It Right
Name every credential holder, log and expire every credential, write the alarm procedure down, decide the restricted spaces in advance, and reconcile the list quarterly.
Every building is different, so the real number depends on size, headcount, floor types, access requirements, and how often you want the work done. We are local, we price up front with no hidden fees, our crews are background checked, and booking happens online. See house cleaning services, then get a quote and we will walk you through it.