Technology

How it works, underneath.

The short version: the intelligence lives in the credential, not in the building. This page is where the long version goes.

Security

Built by people who do this for a living.

The technology came out of Nokia Research Center and Finland's access control industry, and it's patented. Keys are encrypted on the phone, the lock checks them itself, and every opening is logged. The service is GDPR compliant and audited regularly.

Access rights

How access is granted.

Access is granted by connecting people to doors. Either side can be an individual or a group, which is what keeps it simple at ten people and still simple at ten thousand.

What it replaces

Everything a wired system needs at the door.

And most of what it needs around it. Row by row, what a conventional installation has to provide and what the platform does instead.

 Conventional wired access controlBitwards Mobile Access
Cabling to each doorPower and data cabling to a central panelNone required
Network at the doorContinuous connection neededNot needed — works offline
Central hardwareControllers, hubs, serversCloud service, included
A mechanical door with no electricityPower and cabling run to it, and a network hub to reach itNo hub and no power — a battery lock and a phone
Retrofitting old doorsDisruptive and expensiveAdapter or smart lock, no builder
A key or card goes missingRe-keying the cylinder, or a card reissued and the old one chasedThe right is withdrawn — nothing to re-key or collect
Credential logisticsCards printed, posted, collected backSent to the phone in seconds
Changing someone's accessA visit to the door, or to the panelGranted, changed and revoked from anywhere
Adding a propertyOften a second, separate systemAnother location in the same account

Fewer moving parts at the door means roughly half the installation cost of a conventional card system — and an installation measured in days, not weeks. From the Mobile Access solution brochure, version 8/2026.

The platform

Four parts, and what secures each.

A credential is created in the cloud, held on a phone, carried by an app and checked by the lock. Each step is protected on its own terms, so no single one has to be trusted with the whole system.

1 · Cloud

Secure cloud access control

A full SaaS access control dashboard, one account per customer, covering every site you own from a single screen. Access rights can start and end at a given time, follow a weekly schedule, or stay open ended, and each access point can be managed on its own or in groups. Adding a location takes minutes; sites are mapped geographically so the right keys surface automatically in the app.

  • TLS 1.2 between phone and cloud
  • Stored encrypted with service-specific KMS keys, held on separated servers and backed up
  • GDPR compliant, audited regularly for data security
2 · Credential

Secure credentials and provisioning

The platform is token-based: a credential is a cryptographically protected data object issued to the phone, not a question asked of a server at the door. Bitwards' patented SecureCode two-way tokens carry permissions and lock parameters outbound, and bring lock status and maintenance data back on the return leg.

  • Tokens held in the device's own trusted hardware security
  • Advanced encryption and authentication on everything stored on the phone
  • Exchange hardened against sniffing and replay attacks
3 · Apps

iOS and Android applications

One app and one sign-in holds mobile keys and mobile IDs from every building owner a person deals with, so a resident, a student and an employee are the same app. Keys are location aware — the app offers the ones for where you are standing, and every access point is on a map. Opening a lock needs no network connection, so it works in cellars, lifts and anywhere else with no signal.

  • Users identified by unique email address; registration by invitation link
  • Access codes for pin pads and RFID cards supported alongside
  • Available white-labelled, or embedded in your own app through the SDK
4 · Lock

Firmware libraries in the locks

The Bitwards library runs in the lock or reader firmware itself. It decrypts the token, makes the access decision on the spot, applies whatever configuration the token carried, and returns maintenance data — logs, battery level — the next time a phone passes. That is why the hardware needs no cable, no gateway and no network of its own.

  • Bluetooth and NFC secured with AES and HMAC-SHA1
  • Embeds into hardware from any manufacturer
  • REST APIs connect Mobile Access and Mobile ID to third-party systems
In progress

The rest of this page.

The four parts above and the security summary are in place. Still to be written:

Need more information?

Whether you manage buildings, install access for a living, or make hardware that should be smarter — we'll point you to the right answer, or to the right partner near you.

Download documents

Download documents

Choose what you'd like and we'll send it over. Nothing is sent to you beyond what you ask for here unless you tick the last box.

Documents
Phone optional

Request more information

Tell us a little about your doors and we'll come back to you — or put you in touch with the Bitwards partner nearest you.

Phone optional

Join as a partner

Bitwards is sold, installed and supported by partners in each local market. Tell us what you do and we'll come back with how the platform fits it.

Phone optional