Public institutions are our youngest segment: one municipal works depot and two municipal companies — plus the requirement lists from public-sector buyers that reach us long before a single key is scanned. That is exactly why the segment belongs in this series. Nowhere have we learned so much about what is demanded of a key management system before it was even in use.
What follows is therefore less a field report than a list of requirements — compiled from tenders, data protection reviews and the questions a caretaker in an administration asks differently from one in a car dealership. Six lessons, as always without the gloss.
Lesson 1: the review comes before the product
In every other sector of this series the first question was: "What can it do?" In the public sector it is: "Where is the data stored?" Before anyone scans a key, a piece of software has to pass three bodies that have nothing to do with keys — the IT department, the data protection officer and the procurement office. Each asks its own questions, each can end the project, and none of them cares how elegantly a return works.
We have learned to treat this review not as a hurdle but as part of the product. Servers located in Germany, a data processing agreement that is ready rather than negotiated from scratch, role-based access where the caretakers see movements and the department head sees master data — for a municipality these are not features, they are the price of admission. Many tools from the US cloud do not get past this point, and that is no criticism of the municipalities. What we have to say about data protection and hosting is on a page of its own — in this sector it is the most-read one.
Lesson 2: many people with keys, few people responsible
Hardly any building has as many key holders as a school. Teachers, caretakers, cleaning service, after-school care — and in the evening the sports hall with three clubs whose coaches leave the key in the car until the next training session. Unlike in building services these people are not employees, and unlike in property management they come back every week.
We brought the lesson from other sectors, but nowhere does it apply as strictly: externals must not need an account. The caretaker scans the key out, picks the coach from the contact list, sets the return date to the next morning. Whoever unlocks the hall on Friday evening shows up in the overview on Monday if the key is not back — without anyone having kept a list. In the public sector this is where it is decided whether a key management system survives in daily use or only on paper.
Lesson 3: responsibility is an office, not a person
Transfers, retirement, new areas of responsibility: in administrations, responsibilities change regularly — and the key stays with the predecessor. Not out of carelessness, but because nobody was responsible for asking for it back. A handover protocol exists in theory; in practice the master key to the archive has been in a drawer for three years, belonging to a colleague who now sits in the social welfare office.
The lesson for the process: keys belong to roles, not to people, and the change of role is the trigger for the handover. Anyone who anchors the overview of open checkouts per person in the HR process — on every change, check what the person still holds — gets the handover protocol for free: timestamp, name, signature on request, created as a by-product. It is the same insight as with staff turnover in building services, except that here nobody leaves the organisation. They merely change corridors.
Lesson 4: the audit office asks about years, not weeks
In home care the medical review board asks for last quarter's documentation. In the public sector the audit office asks about key issuance over the past five years — and a paper key book from that period, if it still exists, is not an answer. On top of that comes the worst case: a lost master key in a municipal property means replacing an entire locking system, and the question of whether the administration met its duty of care is put with a file reference.
What this demands of the system sounds technical and is: a history that cannot be altered after the fact, that lasts for years and that can be exported as a report — per property, per period, per person. We described in part 5 how in building services the proof is the bid for the next contract. In a municipality it is the answer to the audit that is certain to come — you just do not know when.
Lesson 5: the works depot is a caretaker service with an official stamp — and the utilities are bigger than the town hall
Two observations that corrected our picture of the "public sector". First: in its key processes the municipal works depot is a building service provider — one team, dozens of properties, winter service, vehicles, tools. Everything we learned in part 5 about the key store, seasonal staff and equipment as objects applies there one to one. The difference lies not in the process but in the procurement route.
Second: the largest municipally owned inventory we manage does not hang in a town hall but at a municipal grid operator — more than a thousand keys to substations, distribution boxes and technical rooms, spread across an entire region. Municipal companies — utilities, grid operators, their service providers — have the key counts of an alarm service association, the site structure of a facility manager and the audit duties of a public authority. Anyone thinking about keys in the public sector should not start with the town hall, but with its subsidiaries.
Lesson 6: digitalisation in an administration needs no server of its own
The last lesson runs against our own expectation. We had assumed that public institutions expect an IT project — tender, requirements specification, installation on their own servers, training days. What we learned instead: the caretakers want a terminal on the wall, the administrative staff want to log in with a PIN rather than a password on a sticky note under the keyboard, and the IT department above all wants to have nothing to operate. No server infrastructure of your own, no training effort — in a municipality that is not a convenience argument but the precondition for an overstretched IT department agreeing at all.
The works depot that started with us had its terminal in use within a few days. The review beforehand took longer than the rollout afterwards. That, in short, is the whole lesson of this sector.
What this means for your municipality
If you are responsible for keys in an administration, a school authority, a works depot or a municipal company, the six lessons make a usable preparation — not first for the software, but for the review before it: where does your data have to be stored, and who has to approve that? How many externals regularly unlock your buildings without being employees? Is a change of responsibility handled as a key handover? And could you prove to the audit office today who was issued a master key in 2022?
Everything else can be found on our page about key management for public institutions — and, for the questions from IT and data protection, on the page about security and data protection. If you would rather talk through your own routines directly: we offer a free initial consultation — also as preparation for a tender, and also when no Log+Key comes of it in the end.
Six sectors, one pattern
Six parts are now in place. Assisted-living alarm services, home care, property management, car dealerships, building services, the public sector — six sectors in which keys travel completely different routes: they stay in the store and only ride along on a call-out, they pass from hand to hand, they hang on the same hook for decades, they leave the building with the vehicle, they belong to the client, they belong to the authority.
And yet in all six it is the same process that breaks, and at the same point: the moment when documenting takes longer than walking away. Everything we have built is the attempt to shorten that moment to a single scan — on a smartphone, at the terminal, without a list. The rules that follow from it for every organisation we have summarised in one place: in the key management best practice guide. Anyone who has read the series will recognise the six sectors in it. Anyone who has not is best off starting there — and with part 1, at three in the morning.
The series continues. Which sector comes next is decided by the questions that reach us — security services, hotels and hospitals are on the list.
