Access Control Buyer's Guide — ZKTeco, Ajax & Hikvision in SA

Design principles that outlast any brand

1. Every controlled door is one system. Reader, lock, exit button (or REX sensor), door contact, power supply, and controller port. Skipping any one of these creates a workaround that becomes the exploit.
2. Fail-safe vs fail-secure by zone. Life-safety egress paths must fail-safe (open when power dies). Asset zones (server rooms, stock) fail-secure. Mixing them up is a legal problem, not a preference.
3. Anti-passback and interlock for high-security zones — one person, one badge, one entry.
4. Time zones and holidays — the software should already know Freedom Day and Youth Day. If you're setting holidays manually every year, your software is too basic.
5. Audit trail retention — 12 months minimum for offices; longer for regulated environments.

The 3 brands South African businesses actually deploy

ZKTeco — SA's pragmatic default

• Broad range from single-door standalone to enterprise BioSecurity software.
• Excellent fingerprint algorithms; recent generations handle dusty environments well.
• Local distribution and spare parts across all major SA cities.
• Best for: 1–20 door offices, warehouses, schools, gyms.

Ajax — wireless-first, design-led

• Battery-powered wireless readers and locks that run 3+ years on a battery.
• Best-in-class app and dashboard; hybrid intruder + access in one platform.
• Higher price per door but dramatically lower installation cost — no wall chases, no cable runs.
• Best for: heritage buildings, tenant-fit offices where you can't chase walls, executive suites.

Hikvision — enterprise CCTV + access

• Deep integration between access control and video verification — every entry event tied to a video clip.
• Face recognition and licence plate recognition at enterprise grade.
• Larger controllers and better multi-site scaling.
• Best for: manufacturing, logistics, multi-site retail, residential estates.

Credentials — what to use where

• MIFARE / DESFire cards or fobs — the workhorse. Fast, cheap, reliable, easy to revoke. Prefer DESFire EV2/EV3 over legacy MIFARE Classic for security.
• Mobile credentials (BLE / NFC) — replace lost fobs, work with the phone people already carry. Best for higher-turnover offices.
• Fingerprint — high assurance, no lost credential, but slower and struggles in dusty/gloved contexts.
• PIN — always available as a backup, never as a primary. PINs get shared.
• Face recognition — excellent for high-security zones and hands-free access, but requires a POPIA data-processing basis and clear signage.

Installation, wiring & power

• Cabling: shielded 6-core for reader + lock + door contact runs; separate power run for the lock. Cat6 to every controller for PoE and management.
• Power: 12V regulated supplies with battery backup at every door. Size the battery for 4+ hours (load-shedding reality).
• Locks: electric strikes for internal doors, maglocks for glass doors, motorised deadbolts for exterior gates. Always specify the correct handedness and voltage.
• Egress: code-compliant request-to-exit sensors or push-to-exit buttons — free egress is a legal requirement.
• Environmental: outdoor readers must be IP65-rated and sunshade-mounted; direct sun and rain destroy the cheap ones in one summer.

Integration & POPIA

• HR & Active Directory sync — new starter added in HR is provisioned to the correct doors automatically; leaver is de-provisioned within minutes.
• Video verification — every reader event tied to a CCTV clip. Non-negotiable for any prosecution.
• Time & attendance — clock-in via the same reader; feeds payroll. Common in warehouses and manufacturing.
• POPIA: biometric data is "special personal information" — you need a lawful basis (usually consent or legal obligation), a documented purpose, a retention period, and clear signage at every biometric reader.
• PAIA manual — must describe your access-control data holdings and how requests are handled.

Frequently asked questions