Access Control for Data Centers: Securing Server Racks and Rooms

If the data center is already equipped with SH-I handles or other compatible Wiegand readers, the transition to Seenaptec can be carried out in stages. AGRG ACM2 accepts Wiegand interfaces and connects to the Seenaptec OSDP line: existing access points are preserved, while permissions, objects, events, and integrations are migrated to the new software platform. SH-O/SSB can be used right away in new rows. This makes it possible to avoid a full one-time replacement of handles, reduce the amount of hardware, and simplify further expansion without traditional controllers at every point. For migration projects, an individual price quote with a discount can be prepared; the discount amount is determined during the calculation and is not guaranteed by the calculator.

The absence of a dedicated hardware controller in each rack does not mean a single point of failure. Seenaptec provides several independent levels of resilience: hot redundancy of the software logic, alternative OSDP channels, emergency cards in supported handles, and the ability to restore the software on a compatible computing platform.

Backup single-board controller — a working feature, not a design concept

The backup node maintains a constant connection to the server, periodically synchronizes permissions and configuration, and automatically detects the loss of the primary node. Switching to backup mode occurs without manually loading the user list. Simultaneous control of the same peripheral from two sides is ruled out; after the connection is restored, synchronization and switchback are performed.

Up to three emergency cards directly in the handle

Supported AGRG devices, with the appropriate firmware and configuration, provide local emergency access using pre-provisioned credentials without server involvement. The manual describes up to three such credentials per access point. This is the last resort for obtaining authorized emergency access, not a replacement for normal operation for all employees. After the connection is restored, the corresponding local events are transferred to the log, if the scenario and device support accumulation and transfer.

Backup communication and software portability

A computing platform failure and a cable line break are different events: that is why server redundancy does not replace OSDP and power supply redundancy. The advantage of a software controller is that after a standard computer fails, it can be restored on other compatible hardware from a prepared configuration. Data center customers already know how to operate servers, backup power, monitoring, and backups; Seenaptec uses infrastructure familiar to them.

Important: the mass production of computers helps with the availability of spare equipment, but by itself does not prove that any PC has a lower probability of failure than any specialized controller. Reliability is determined by the entire configuration and proven switching scenarios.

Seenaptec supports centralized creation of card profiles and management of cryptographic keys, as well as initialization and personalization of compatible MIFARE Plus cards, including switching them to the secure SL3 mode (AES). Credential issuance, access badge assignment, and key material administration are performed within a single Seenaptec workflow — with no need for a separate standalone issuance system. These operations require a compatible reader, a correct profile, and the card's administrative keys. Switching to SL3 is irreversible and removes compatibility with MIFARE Classic, so migration of existing credentials must be planned in advance. SL3 support on the card does not eliminate the requirements for secure communication with the reader and OSDP Secure Channel configuration.

Seenaptec features integration with the fire alarm system. This makes it possible to coordinate the events and control scenarios of the two engineering subsystems within a project. However, a machine room, a cabinet, an emergency exit door, and a gas fire suppression room are different objects with different requirements.

It cannot be automatically assumed that a fire alarm opens all cabinets. The exact interface with the fire alarm panel, the list of signals, and the algorithms are defined in the project appendix and the acceptance test protocol of the specific facility.

Seenaptec provides a REST API for equipment, access objects, credentials, logs, and security; the methods are documented in OpenAPI and available for exploration via Swagger UI. Through the API, physical access processes can be linked to request and maintenance systems, equipment and cabinet registries, the service desk, corporate directories, and monitoring and logging systems. For example, an external system can initiate an approved process granting a contractor access to a specific cabinet, while ACS events and states are used to verify the actual completion of the work. The set of operations is defined by the published specification and the permissions of the integration account; connection security and access segregation are configured according to the customer's information security policy.

An example, not a real log: a contractor is issued a pass for cabinet No. 37 for the work period 10:00–11:00. He enters the machine room and presents an authorized card at the required cabinet. Seenaptec checks the object, validity period, schedule, and escort requirements; it stores the decision and the state confirmations. An attempt to open cabinet No. 38 without authorization is denied and logged. After the work is done, the system receives a cabinet-close signal and ends the session; if the session drags on, the object is placed on the watch list.

What the security team gets: not just a record of a card presentation, but interlinked data on the pass, the object, the decision outcome, equipment states, and operator actions. The history of settings changes is kept separate from the regular access log. The integrity of the log is guaranteed by a built-in blockchain.

For an idea of mounting density: if the chosen traditional scheme requires a separate 1U-high unit for each cabinet, 50 cabinets occupy 50U in total. This is not a universal property of all ACS: group controllers can be placed outside the cabinets. With Seenaptec, no dedicated 1U unit is needed in each server cabinet. When the system is expanded, additional cabinets are connected to the designed OSDP infrastructure without purchasing new traditional controllers for each cabinet; line capacity and power are verified against the design.

What makes up the cost of an ACS for a data center

The cost of an access control system in a data center depends not only on the number of server cabinets and electronic locks, but also on the architecture of the ACS itself.

In traditional systems, a significant part of the budget goes to hardware controllers, their placement, cabling, and the connection of each controlled door. As the number of cabinets grows, equipment costs increase and the infrastructure becomes more complex.

Seenaptec takes a different approach. Instead of traditional hardware controllers, it uses a software platform, and AGRG electronic handles connect via the secure OSDP protocol. A single server cabinet, regardless of the number of controlled doors, is treated as one access object. This reduces equipment costs, simplifies scaling, and at the same time provides extended access management capabilities.

In addition, Seenaptec supports a backup software controller, communication line redundancy, OSDP Secure Channel encryption, automatic SSB device addressing, management of secure MIFARE Plus SL3 cards, and integrations via REST API.

1. Inventory of cabinets and doors: mechanics, geometry, locks, bolts, sensors.

2. Zone and role map: security service, IT, contractors, escorts.

3. Design of OSDP lines, IP–RS-485 connectivity, backup power, and control nodes.

4. Pilot on several cabinets of both door types; verification of cards and alarms.

5. Testing of failover to the backup controller and emergency cards.

6. Testing of fire integration according to the agreed program.

7. Mass installation, group configuration, staff training, documentation.

Can a cabinet be opened if the Seenaptec server is unavailable?

Yes. Normal operation is maintained by a continuously synchronized backup software controller; if the software nodes are unavailable, up to three local emergency cards are provided for supported and configured handles.

How many controllers are needed for 50 cabinets?

The Seenaptec architecture does not require a traditional controller inside every rack. The number of server/backup nodes, IP–RS-485 and OSDP lines is assigned per project; it cannot be derived automatically from the number of rows.

Can existing employee cards be kept?

It depends on the card format and the protected-area settings. SH-O supports several identifier families, but compatibility and security are verified against the existing card fleet.

Do all cabinets need to be replaced to install electronic handles?

Not necessarily. A mechanical inspection of the mounting seats and selection of bolts/adapters is required; some cabinets may need modification.

Will all server racks open automatically in case of fire?

There is no universal rule. Fire-automation and access-control algorithms are agreed upon for each door type and zone. Evacuation functions must comply with the project and current requirements.

How does Seenaptec differ from traditional access control systems?

An object model of spaces and server cabinets; software-based management with redundancy; no need to install a traditional controller in every rack; secure addressable OSDP peripherals and automated SSB commissioning; device diagnostics; a REST API; secure card management. The AGRG ACM2 is provided for migrating previously installed Wiegand peripherals.

Send us the number of cabinets, the number of controlled doors, rack models, and redundancy requirements. We will prepare a preliminary specification, a wiring diagram, and a license breakdown.

Calculate the cost