Features › Instant revoke

Turn off someone's phone access at every door in about a second

When someone leaves the company or loses a phone, the question is how fast their access stops. With GateStride you remove or suspend the person in the center on your premises, and every door node has the change in about a second. There is no card to collect before the door stops opening for them.

By Tom Jin · Updated October 2026 · Early access

Access outlives the job, and the card is somewhere else

Most offices handle a departure the same way. HR tells the office manager, the office manager asks for the badge back, and someone eventually disables it in the access system. Each step depends on a person remembering. The employee who resigned on a Friday afternoon may still have a working card on Monday because the office manager was out, or because nobody told the person who knows the access software.

Collecting the card does not solve it either. A card can be lost, left in a car or simply never returned. Some people have a second card from years ago that nobody wrote down. Contractors and temps leave without a formal exit at all. And when a staff member reports a lost phone or wallet on a Sunday night, the honest answer in many offices is that nothing happens until someone gets to the access computer on Monday.

In our own office in Spring, Texas, we inherited a four-door Kantech system from the previous tenant. It worked, but every change meant sitting at the one machine that ran the software. That is part of why GateStride exists. You can read the full story in our Kantech story.

What happens when you press remove

Phone access in GateStride is managed in the GateStride center, which runs on your premises, usually in the comms room. When you remove or suspend a person there, the center pushes the change to every door node it manages. Each node has the update in about a second. From that moment, the node refuses that person's phone, watch or tablet at every door it covers.

The door node is the part that decides whether to unlock. Each unlock is a one-time signed challenge and response over Bluetooth between the phone and the node, and the node checks that the person is allowed through that door at that time. Once a person is removed or suspended, that check fails. The phone still holds its private key in its secure element, but the node no longer accepts it.

Every change is written to GateStride's hash-chained, tamper-evident audit log, so you can show later who removed access and when. See security for how the log works.

Suspend or remove: two different situations

Not every case is a departure. GateStride lets you choose:

• Suspend when access should stop now but the person is still with you. A lost phone is the common case. Suspend the person, then set them up again once they have a replacement phone.
• Remove when the person has left for good. Their phone access ends at every door the center manages.

Both take effect in about a second across the door nodes. Neither requires the person to hand anything back. Because there is no GateStride cloud and no relay, admins who are away from the office can make the change over the company's own VPN. See how it works for the full architecture.

Cards on your existing system still need to be disabled there

GateStride adds phones to the access control you already own. It does not take over your card database. If a person also has a card that was issued on the existing system, that card is still a credential in that system. You must disable it in the existing access software as you do today. Removing someone in GateStride stops their phone. It does not stop their card.

For many offices this becomes simpler over time. As staff move from cards to phones, fewer cards are in circulation, and the checklist for a departure gets shorter. But as long as someone has a working card, the old system is where that card is turned off. We would rather say this plainly than let an office believe that one button covers both.

Your existing system is untouched by GateStride: locks, readers, panels, request-to-exit and fire release all stay as they are. Free egress stays with your certified system, so a removed person can always walk out. GateStride never requires anything to exit.

When a door node is offline

Door nodes are built to keep working when the network or the center is down. They keep verifying phones from a cached, signed credential set and refuse anything they cannot verify. When the connection returns, they resync with the center.

That has a direct consequence for revoking. A door node that cannot reach the center does not receive the change in about a second. It picks it up when it resyncs. If you know a node is cut off, treat that door accordingly until it is back online, for example by also disabling the person's card in the existing system and keeping an eye on that door. More on this behavior is on the works offline page.

Who this helps

Office managers get a departure step that does not depend on getting a card back. IT leads get a change that reaches every door at once and a log that records it. Integrators keep servicing the existing panels and readers while the customer handles day-to-day phone access in the center. GateStride is in early access, verified on Kantech EntraPass, with LenelS2 OnGuard and Brivo in development. Check compatibility for your system.

Revoking access, step by step

1. Open the GateStride center, on site or remotely over your own VPN.
2. Find the person and choose Suspend (access should stop now, for example a lost phone) or Remove (they have left).
3. The center sends the change to every door node. Each connected node has it in about a second and refuses that person's devices from then on.
4. If the person also holds a card issued on your existing system, disable that card in the existing access software.
5. Check the audit log for the entry that records who made the change and when.

What it does not do

• It does not disable cards issued on your existing access system. Those must still be turned off there.
• A door node that is offline at the moment of the change picks it up when it resyncs, not in about a second.
• It does not stop anyone from leaving. Free egress stays with your certified system.
• It does not erase the phone or wipe its apps. It stops the door nodes from accepting that person.

Questions

How fast does revoking take effect?

Removing or suspending someone in the GateStride center reaches every connected door node in about a second. After that, the nodes refuse that person's devices at every door they cover.

Does removing someone in GateStride also cancel their card?

No. GateStride manages phone access. A card issued on your existing access system is still a credential there and must be disabled in that system's software.

What should we do when someone loses their phone?

Suspend the person in the center so their access stops right away. When they have a replacement phone, set them up again. The private key on the lost phone stays in its secure element and is no longer accepted by the door nodes.

Can I revoke access when I am not in the office?

Yes, over your company's own VPN. GateStride has no cloud and no relay, so remote admin goes through your network to the center on your premises.

What if a door node is offline when I revoke someone?

That node gets the change when its connection returns and it resyncs with the center. Until then, consider also disabling any card the person holds in the existing system and keep an eye on that door.

Is there a record of who removed access?

Yes. Changes are written to a hash-chained, tamper-evident audit log on your premises, so you can see later who made the change and when.

Related features

Stock photo. Kantech and EntraPass are trademarks of their owners; GateStride is independent and not affiliated with or endorsed by them.