TL;DR
Key control across a portfolio rests on three habits: one named custodian per key or code, an access log that records who entered and when, and a rotation rule that changes codes after every turnover. Portfolios that skip rotation accumulate former tenants, former crews, and former contractors who still hold working access.
The Quiet Problem in Most Portfolios
Very few portfolios can answer a simple question: who currently has working access to unit 4B. Codes get shared to solve an immediate problem, and nobody ever unwinds the sharing.
Over a few years a single unit can accumulate a former tenant, two former crew members, a painter, a flooring installer, and a locksmith, all with access that still works.
Nothing usually happens, which is why nothing usually gets fixed. But the exposure is real, it is cheap to close, and it becomes very expensive to explain after an incident.
What Is Key Control for a Cleaning Vendor?
Key control means every key and code has a named custodian, a recorded issue date, a recorded return or expiry, and a log of each use. Applied to cleaning crews, it means the vendor knows which individual holds access to which property at any moment, and you can ask and get an answer.
The standard applies to physical keys, lockbox codes, keypad codes, fobs, and app-based credentials equally. A code is a key, and treating it as less than one is the most common gap.
Ask the vendor how it does this before the first job. Companies that work portfolios have an answer; companies that do not will tell you honestly if you ask directly.
Source: key control and access management guidance published by building security and facility management associations
Physical Keys: Custody That Actually Holds
Number keys rather than labeling them with addresses. A tagged key found in a parking lot is a map to a specific door, and a numbered one is not.
Issue keys to a person, not to a company. "The cleaning company has a key" is not custody; "the key is issued to a named individual as of a date" is.
Require return on staff change, and act on it. The moment a crew member leaves a vendor is the moment your key inventory becomes wrong, so make notification of staff changes an explicit expectation. The individual-level habits are covered in key and door code handling for cleaners.
Codes and Smart Locks: Better, With New Failure Modes
Coded access solves the custody problem elegantly, because a code can be unique per vendor and revoked instantly without changing a lock. That is a genuine improvement over physical keys for portfolio work.
It introduces different failures. Codes get texted, screenshotted, and stored in group chats, and a shared code is exactly as leaky as a copied key. Batteries die, usually on the coldest morning of the year, and connectivity failures lock out app-based systems at the worst moment.
Issue a unique code per vendor, ideally per crew, and never a single portfolio-wide code. The comparison between approaches is worked through in lockbox versus smart lock for cleaning access.
Access Logs That Are Actually Kept
An access log answers who entered, which unit, and when. Electronic locks generate this automatically, which is the strongest argument for them in a portfolio of any size.
Where locks do not log, ask the vendor to. A simple arrival and departure message per unit takes seconds and produces a usable record, and most companies already do something like it internally.
Review the log occasionally rather than only after an incident. Reviewing it once a quarter catches stale credentials and unexpected entries while they are still small.
Rotate Codes After Every Turnover
Rotation is the single highest-value habit and the most commonly skipped. Change the code after every turnover, without exception, because a turnover is precisely the moment when the largest number of people have recently had access.
Rotate on vendor change as well. When a cleaning company, a contractor, or an agent stops working a property, their access should end that week rather than whenever someone remembers.
Keep the rotation record with the property file. The record of when a code changed is what lets you answer questions later about who could have been in a unit on a given day. Multi-unit buildings add a further layer, covered in apartment building access for cleaning crews.
What to Ask a Vendor Before Handing Over Access
Ask who at the company will hold the credential, whether it is issued to a person or shared, how it is stored, and what happens when that person leaves. Vague answers here are the most useful signal you will get in a vendor conversation.
Ask about screening for anyone who enters a unit, including temporary help, and ask how often it is repeated. Ask what the company's own policy says about sharing access details over text.
Then ask about insurance and bonding, since access risk and financial risk overlap. The full vetting sequence is in hiring a cleaning service, and managers arranging portfolio-wide house cleaning services should settle access handling before the first booking rather than after it.
FAQ
What is key control for a cleaning company?
It means every key and code has a named custodian, a recorded issue date, a recorded return or expiry, and a log of each use. Codes count as keys. A vendor with real key control can tell you which individual currently holds access to which property.
Should I give a cleaning crew a lockbox code or a smart lock code?
Unique per-vendor codes on an electronic lock are generally stronger, because they can be revoked instantly and they log entries automatically. Lockboxes are cheaper and work without power, but the code is easily shared and leaves no record of who used it.
How often should access codes be changed?
After every turnover without exception, and whenever a vendor, contractor, or agent stops working the property. Turnover is when the largest number of people have recently had access, which is exactly why it is the natural rotation point.
Should cleaning keys be labeled with the address?
No. Number them instead and keep the mapping separate. A labeled key found outside the property is a direct route to a specific door, while a numbered key on its own is close to useless to whoever finds it.
How do I know who entered a unit and when?
Electronic locks log entries automatically, which is the strongest reason to use them across a portfolio. Where locks do not log, ask the vendor for a short arrival and departure message per unit, and review the record quarterly rather than only after an incident.
What should happen when a crew member leaves the cleaning company?
Their access should end that week. Make notification of staff changes an explicit expectation with your vendor, require physical keys back, and revoke individual codes immediately. Key inventories go wrong at staff changes more than at any other moment.
Name a custodian, keep a log, and rotate after every turnover. Every property is different, so the real number depends on size, condition, and what you want covered. Get a quote and we will walk you through it.