Cloud-Based vs. On-Premise Access Control: Which Is Right for Bangladesh Enterprises?

A multinational company's Bangladesh subsidiary deployed a cloud-based access control system specified by their global IT team. The system worked beautifully at global headquarters. In Dhaka, a fibre cut on a Tuesday morning left the office unable to open secured doors for 3 hours — 400 employees waited in lobbies and common areas while the global IT helpdesk worked with the local ISP to restore connectivity. The cloud platform had no offline mode.

This is the decisive Bangladesh-specific consideration for cloud access control: internet reliability cannot be assumed. Any cloud-dependent access control system that cannot function independently during an internet outage is a single point of failure for your entire facility's physical access.

This guide compares cloud and on-premise access control architectures with specific attention to Bangladesh's internet infrastructure realities, PDPO 2025's implications for biometric data stored in foreign cloud environments, and the hybrid approaches that deliver the best outcome.

On-Premise Access Control: Architecture and Strengths

In an on-premise (traditional) access control system, the access control server, database, and decision-making logic all reside at the facility. The access control controller at each door connects to the on-premise server via the local area network.

How On-Premise Works

1. A user presents their card or biometric at a reader
2. The reader sends the credential data to the access control controller (or directly to the on-premise server)
3. The controller checks the credential against its local decision database (a copy of the main database stored in the controller's firmware)
4. The controller makes the access decision and actuates the door lock
5. The event (access granted/denied) is logged to the on-premise server

Critically, Steps 2–4 happen in the controller — not in a cloud server. Even if the on-premise server is temporarily unavailable, the controllers retain their decision database locally and continue operating normally.

On-Premise Strengths

No internet dependency: The system operates entirely on your local network. Internet outages have no impact on access control functionality.

Full data control: Access logs, biometric templates, and user data never leave your physical premises. This is the most straightforward path to PDPO 2025 compliance.

Lower latency: Door response time is determined by the local network speed, not internet round-trip time. Response times of under 300 milliseconds are typical.

One-time hardware cost: No subscription fees. After the initial hardware and installation investment, ongoing costs are limited to software maintenance and support.

Multi-site from head office: On-premise servers can manage remote site controllers over a dedicated WAN link, providing centralised management without cloud dependency.

On-Premise Limitations

Higher upfront cost: Server hardware, software licences, and professional installation represent a significant initial capital expenditure.

IT management requirement: The on-premise server requires ongoing IT management — software updates, backup management, hardware maintenance. This requires either in-house IT capability or a managed service from your integrator.

Multi-site complexity: Managing controllers at many remote sites (a bank with 60 branches, a retail chain with 30 locations) requires either VPN connections to each site or cloud augmentation for centralised management.

Physical security of server: If the access control server is located at the facility and the facility is breached, the server and its data are at risk.

Cloud-Based Access Control: Architecture and Strengths

Cloud access control systems host the management platform, user database, and access rules on cloud servers operated by the software vendor. Controllers at each door connect to the cloud platform over the internet.

How Cloud Access Control Works

1. A user presents their card or biometric at a reader
2. The controller queries the cloud server for an access decision (online mode) OR makes a local decision based on cached rules (offline mode)
3. The cloud server returns an access decision
4. The controller actuates the door lock
5. Events are logged in real time to the cloud dashboard

Cloud Strengths

Zero server hardware: No on-site server required. Your IT team has nothing to manage locally. The vendor manages the platform, updates, backups, and redundancy.

Instant multi-site management: All sites appear in a single web or mobile dashboard. Adding a new site requires only an internet connection and a controller — no VPN configuration or server software deployment.

Remote credential management: Add, modify, or revoke access permissions instantly from anywhere. An employee's card is disabled the moment you click "revoke" in the dashboard — even if the employee is at a remote site.

Lower upfront cost: No server hardware purchase. Subscription cost spreads the investment over time, which is more compatible with operational expenditure budgets.

Automatic updates: Platform software updates happen automatically without IT intervention.

Cloud Challenges in Bangladesh

Internet reliability: Bangladesh's internet infrastructure is improving rapidly, but outages remain a regular occurrence in many areas. Industrial zones, suburban commercial areas, and any site relying on a single ISP connection experience periodic connectivity loss. A cloud access control system that requires internet for door decisions is fundamentally incompatible with this environment — unless robust offline mode capability is confirmed.

Offline mode is not universal: Not all cloud access control platforms have genuine offline mode capability. Some platforms cache only the most recent access rules for a short period; others cache full decision databases for weeks. Verify the specific offline behaviour of any platform before deployment. Ask specifically: "What happens at each door if the internet is down for 24 hours?"

Biometric data in the cloud: If your access control uses biometric authentication (fingerprint, face) and the biometric templates are stored on cloud servers, PDPO 2025 creates specific obligations regarding data residency. Templates stored on foreign servers require specific legal mechanisms to comply.

Subscription cost accumulates: Monthly or annual subscription costs, calculated over 5 years, often exceed the equivalent on-premise server hardware investment. Evaluate total cost of ownership carefully.

Latency for biometric matching: If the cloud platform performs biometric matching server-side, an internet round trip adds 50–200 milliseconds to each authentication. For most applications this is acceptable. For turnstile-based high-throughput applications (factory gates), this latency margin matters.

PDPO 2025: The Biometric Data Sovereignty Issue

The Hybrid Approach: Best of Both Worlds

Hybrid access control architectures place the decision-making intelligence at the site (on-premise controllers with local decision databases) while using cloud infrastructure for management, monitoring, and remote administration.

How Hybrid Works

• On-site controllers: Each door controller stores a complete local copy of the access decision database. All access decisions are made locally, regardless of internet connectivity.
• Cloud management layer: A cloud portal manages the user database, access permissions, and reporting. Changes made in the cloud portal are pushed to site controllers when connectivity is available.
• Offline resilience: If the internet is unavailable, doors continue operating based on the last-pushed ruleset. When connectivity restores, any new rules or events are synchronised automatically.
• Biometric option: Biometric templates are stored on-site in the controllers and optionally in the cloud. An on-premise-only biometric option (templates stored only in controllers, never in the cloud) satisfies PDPO 2025 most straightforwardly.

This architecture is offered by leading access control platforms including Gallagher, Bosch Access, Honeywell Pro-Watch, and ZKTeco BioAccess.net.

Failure Mode Analysis: What Happens When Things Go Wrong

The hybrid architecture has the most resilient failure mode profile: it maintains local access control functionality regardless of internet status, while the cloud layer provides remote management and backup.

Recommendation by Organisation Size and Type

Key Takeaways

• On-premise access control has no internet dependency — critical in Bangladesh where ISP reliability varies significantly by location and provider
• Cloud access control provides the easiest multi-site management and zero on-site server hardware — but requires confirmed offline mode capability for Bangladesh deployment
• Verify offline mode duration explicitly — ask for documented offline behaviour over 24 hours with no internet, not just "offline mode is supported"
• PDPO 2025 creates biometric data sovereignty obligations for cloud systems — verify data residency, execute a DPA, and consider on-premise biometric matching to eliminate cross-border transfer concerns
• Hybrid architecture delivers the best outcome: resilient local access decisions with cloud management convenience
• Monthly subscription costs accumulate — compare 5-year TCO against on-premise before selecting cloud based on lower upfront cost

Ready to Choose the Right Access Control Architecture?

SSAL designs on-premise, cloud, and hybrid access control architectures for Bangladesh enterprises at every scale. Our team assesses your internet reliability, PDPO 2025 obligations, multi-site requirements, and budget — then recommends the architecture that delivers the right balance of resilience, manageability, and compliance.

Contact SSAL for a free access control architecture consultation:

• Phone: +880 1799-986890
• Email: info@smartsafety.com.bd
• Web: www.smartsafety.com.bd
• Office: Youth Tower Level 2, 822/2 Rokeya Sarani, Dhaka-1216

Already have a cloud access control system that struggled during an internet outage? Request a resilience assessment — our team reviews your current architecture, tests offline mode capability, and recommends specific enhancements to ensure your access control functions reliably regardless of internet availability.