Cloud or on-premise
The question concerns the server of the access management system, not the barrier itself. What is decided is where the software runs that manages permissions, logs movements and maintains installations remotely, so where the data sits, who updates the server, and from where users can reach it.
The answer rests on three points: the requirements of your own IT department, the security level of the site, and how much operating effort should stay in-house. BarrierSystems offers both operating modes as options, so the comparison stays transparent within the project.
The three operating modes
- Cloud
- The server sits with BarrierSystems and is provided and updated from there. Access by browser or app from anywhere; the installations communicate with the server over the internet. Provisioning takes a few hours, and no server hardware of your own is needed.
- On-premise
- The server sits at the customer's site, on your own hardware or as NEXUS, the BarrierSystems server in a 19-inch rack including a UPS. Server and installations are reachable only in the internal network; access from the customer network, by VPN or on site. Updates run in coordination with the IT department.
- Hybrid
- Access to the ControlHub and the ControlApp stays in the internal network, while the installations may communicate with the server over the internet. This reduces the effort compared with a fully on-premise operation.
Characteristics, prerequisites, target groups and costs in detail: Hosting for the ControlHub.
What the operating mode changes for the barrier
Less than is often assumed. The controller at the installation processes the access methods locally and keeps working without an internet connection; movements are buffered and synchronized later. Authority radio does not need a network connection at the installation in any case. This holds in all three operating modes.
- Stays the same
- Opening and closing on site, the stored permissions, local fault detection, and operation while the connection is interrupted.
- Depends on the connection
- Granting or withdrawing permissions in real time, evaluating movements immediately, maintaining installations remotely, and reporting faults without delay.
- Depends on the operating mode
- From where administration is possible, who updates and monitors the server, and in whose area of responsibility the movement data sits.
Six questions before deciding
- Who updates and monitors the server?
- In the cloud, BarrierSystems does both in its own maintenance cycle. On-premise, both sit with the operator's IT, including the operating system, backups and restores.
- Where may the movement data sit?
- Access data is personal data as soon as it can be attributed to a person, regularly the case with license plate recognition. Cloud operation is then processing on behalf of a controller under the GDPR; with on-premise the data stays in your own area of responsibility. Context: Standards and legal framework.
- From where is the system administered?
- If gatekeepers, caretakers or on-call staff should also grant access while away, that speaks for the cloud. If administration stays on site anyway, that advantage falls away.
- Is there a Linux server and someone to run it?
- On-premise requires an Ubuntu server, port forwarding and VPN or jump host access. If the hardware is missing, NEXUS supplies it, responsibility for operation still stays in-house.
- Which requirements apply to the site?
- Operators of critical installations and larger companies are subject to their own requirements for network separation and record keeping, for example from the KRITIS umbrella act and the NIS2 implementation. Whether and how these apply in an individual case is for your own legal or information security department to settle.
- How many sites, and are more coming?
- Several sites under one administration speak for the cloud or for hybrid operation; a single, strictly isolated site speaks for on-premise.
Frequently asked questions
- Does the barrier still work when the internet fails?
- Yes. The controller processes the access methods locally and keeps working without an internet connection; movements are buffered and synchronized later. What is missing during that time is remote administration, not access itself.
- Is on-premise more secure than cloud?
- It shifts the attack surface and the responsibility, not automatically the security level. In the internal network, server and installations are not reachable over the internet; in return, updating, monitoring and backup sit with the operator. A neglected installation of your own is not more secure than a well-maintained cloud operation.
- Does the GDPR require operation in-house?
- No. The GDPR requires a legal basis, purpose limitation, deletion periods and, for cloud operation, a data processing agreement. Both operating modes are compatible with it. This page provides orientation and does not replace legal advice.
- What is NEXUS?
- The BarrierSystems on-premise server in a 19-inch rack including a UPS, for operators who want to run on-premise but do not want to provide server hardware of their own.
- Who is on-premise recommended for?
- For critical infrastructure, larger company sites and the protection of city centers. Examples and costs are under Hosting for the ControlHub.
- Can the operating mode be changed later?
- Yes, at any time afterwards. The decision does not lock you in: whoever starts in the cloud can move to on-premise later, and the other way around. What changes are the running costs, by how much depends on the setup on site. What drives the cost.
Discuss the operating mode
We will compare both variants for your project, with effort and costs.