The code four ex-employees still know, and the policy that retires it

Small offices accumulate door codes the way junk drawers accumulate keys: one for the front door from the lease signing, one for the side entrance the cleaners use, one for the alarm panel, one for the garage, one for the server room closet, each adopted at a different moment by a different person, none written down anywhere authoritative. The predictable result is a code that four ex-employees still know and nobody has changed since. A door code is a credential — it deserves the same lifecycle as any other secret: owned, inventoried, rotated on a schedule and on events, and never allowed to travel by chat or memory alone.

1. The inventory comes before the policy

• Walk the building and list every keypad and every code it has. Front door, back door, side entrance, garage, gate, alarm panel, server room, equipment cage, and the dial pad on the phone system if one hides a voicemail admin code. The physical security checklist covers the walk; this page covers what to do about the codes it finds.
• Write each code into the password manager, not a shared spreadsheet. "door-codes.xlsx" on the shared drive is the most commonly leaked credential store in small business — every employee, every contractor with drive access, every synced personal laptop. The vault entry per door gets: location, code, who approved it, last rotation date. The password manager rollout is the precondition; the door codes are just more tenants in it.
• Mark the zombie codes at inventory time. A code nobody can name the owner of is a code to rotate this week, not document. The inventory is not an archive of the past; it is the list of things that will get new values.

2. Two rotation clocks: the calendar and the event

• Quarterly rotation for shared codes. Any code known by more than two people — the front door, the alarm code, the cleaner's side entrance — gets a new value every quarter. The rotation is ten minutes: new code generated, written to the vault entry, keypads updated, one line in the log. Put it on the same quarterly pass as the router check and the printer firmware walk, and none of the three gets skipped.
• Event-triggered rotation, same day: any employee departure, any contractor end date, any cleaning-company change, any suspected leak, any lost key fob that shared a door. The offboarding checklist should already have the line "door codes rotated" — this page is the detail behind that line.
• Rotate on departures even when the person was trusted. The point is not suspicion; it is that four ex-employees knowing the code is itself the risk, regardless of anyone's character. Memory outlasts grudges — and outlasts NDA goodwill.

3. The departure rotation: after the walk-through, not during

• Change the code after the final walk-through, not in front of the departing person. The professional sequence: final day, exit walk-through, property returned, access reviewed — then the code changes that evening. Rotating the code while someone is still packing sends a message; the goal is the control, not the insult.
• One named person owns departure rotation. The same owner who approves grants runs the revocations — the same rule as every other offboarding artifact. When three people each assume someone else changed the alarm code, nobody changed the alarm code.
• Departure rotation covers the human network too: the person who shared their door code with a courier, the team that gave the cleaner the garage code for deliveries. The walk-through conversation ("anything you shared access to?") is fifteen seconds and catches the informal grants that were never in the vault.

4. Tier the codes like any other access

• Least privilege applies to doors. The cleaner needs the side entrance and the supply closet, not the server room. The courier needs the loading door at delivery hours. If every code opens everything, every leaked code opens everything — the fix is separate codes per door and per role, which the inventory from section 1 makes visible.
• Alarm codes are their own tier. The alarm code plus the front-door code is the complete burglary kit; anyone who needs the alarm code gets a unique user code with their own name where the panel supports it, so the panel log shows who armed and disarmed. Shared alarm codes are a finding in every insurance inspection — fix them before the adjuster finds them.
• Server room and network gear doors are the highest tier. A door code to the room with the switches and the NAS outranks almost every digital credential in the office. Treat it like a production secret: unique, two-person knowledge where practical, rotated on every change of who manages the network, and covered by the same discipline as the server hardening checklist.

5. How codes travel — the rule that prevents most leaks

• Codes move through the vault's sharing, never through chat or email. A code pasted into a group chat lives in phone clouds, in notifications on lock screens, and in the chat provider's servers. The vault share link expires; the group chat message does not. The same reasoning the secrets rotation checklist applies to API keys applies to the front door.
• "Tell me in person" is a valid distribution channel. For a five-person office, walking to the keypad together and entering the new code is the entire distribution plan — and it leaves no artifact to leak. The vault records the new value; the people know it; nothing was transmitted.
• Retire the sticky note inside the alarm cabinet. The code written next to the panel it protects is a joke with a straight face, and it is in most offices. The vault entry replaces the note; the note goes in the shred bin the same day the new code is set.

6. Keypad realities: work with the hardware you have

• Legacy single-code keypads get an upgrade path, not an excuse. If the front door keypad holds one code for everyone, put "per-user codes" on the replacement criteria and rotate the shared code quarterly until then. Most modern keypads cost little more than one locksmith call and give per-user logs.
• Length and lockout matter more than cleverness. Five or six digits beats four; lockout after repeated wrong entries beats "try again forever"; no sequential or repeated patterns (1234, 2580 — every code list starts there). The lockout setting is in the keypad manual and takes five minutes to enable.
• Check what a power cycle does. Some cheap keypads revert to factory defaults after a power loss — meaning the code you rotated is not the code that unlocks the door after the next outage. Test it once: pull the battery or breaker, power back, try the default. If the default works, that is the highest-priority replacement in the building.

7. The log, and the leak runbook

• One code-change log, four columns: date, door, "rotated" (the value lives in the vault, never in the log), authorized by. The log turns the annual question — "when was this last changed, and why?" — into a lookup. The annual security review walks the log against the inventory in the same fifteen minutes as the badge and printer passes.
• A leaked code is a credential exposure: rotate within the hour. The visitor who saw the code typed in, the delivery driver who heard it, the group chat that shouldn't have had it — the response is the same: new code today, log line written, and a check of who else might have it. The badge checklist handles the same event for cards; door codes just rotate faster.
• Entry logs, where the hardware supports them, close the loop. Per-user codes plus a keypad audit log answer "who entered at 2am" with a name instead of a shrug. If the current keypad cannot answer that, the upgrade case writes itself — bring the log excerpt from the visitor log reconciliation where the unexplained entries showed up.

Door codes are credentials: inventory them into the vault, rotate shared codes quarterly and every departure same-day (after the walk-through, not during), tier them by least privilege, move them by vault share or in person — never chat — keep a four-column change log, and rotate within the hour when one leaks. The Ops Starter Kit ($14) includes the code-inventory and change-log templates, and the Automation Starter Pack ($19) schedules the quarterly rotation and the offboarding pass so the code four ex-employees know finally expires.