Skip to content
LobbyExpress
Search

Analysis

Cloud or on-premises visitor management: what the choice really trades

Most visitor management products in our directory list a cloud option, and most of those offer nothing else. The on-premises minority is concentrated in one category, and the reasons it survives tell you when you might need it.

By LobbyExpress Editorial

For most buyers of visitor management, the cloud-or-on-premises question has already been answered by the market. The products are built as hosted services, sold by subscription, and updated by the supplier. Asking for an installable version narrows the field sharply.

That does not make the question irrelevant. It means the useful question is no longer “which is better?” but “is there a specific reason we cannot use the default?” For a minority of sites there is, and the directory data shows fairly clearly where that minority sits.

This piece looks at what the directory says, what each model actually moves between you and the supplier, and when on-premises or hybrid deployment still earns its place.

What the directory shows

Each directory profile records the deployment models a product’s supplier lists in its own public materials. A product can list more than one.

Deployment models listed by products in the directoryA horizontal bar chart of the 98 products in the LobbyExpress directory as of October 2026. Cloud is listed by 82 products, on-premises by 26 and hybrid by 17. Products can list more than one model.Products listing each deployment modelLobbyExpress directory, 98 products, October 2026. A product can list more than one.CloudOn-premisesHybrid822617020406080
Cloud dominates: 82 of 98 products (84%) list it. Because products can list several models, the three bars add up to more than 98.

Counted the other way, as mutually exclusive groups, the picture is sharper. Seventy products list cloud and nothing else. Twelve list cloud alongside an on-premises or hybrid option. Sixteen list on-premises or hybrid deployment without cloud. In other words, a buyer who requires an on-premises option has 28 products to consider, and one who requires on-premises without any cloud component has a smaller field still.

The interesting part is where those 28 sit.

Deployment options by directory categoryStacked horizontal bars for each of the four directory categories, split into three groups: cloud only, cloud plus on-premises or hybrid, and on-premises or hybrid without cloud. Access control with visitors: 8 cloud only, 3 both, 14 without cloud. Dedicated VMS: 18, 4 and 2. Vertical-market VMS: 21, 4 and 0. Workplace platform with visitors: 23, 1 and 0.Deployment options, by categoryLobbyExpress directory, 98 products, October 2026Cloud onlyCloud + on-prem or hybridOn-prem or hybrid, no cloudAccess control + visitorsDedicated VMSVertical-market VMSWorkplace + visitors8314184221423117 of 256 of 244 of 251 of 24LISTS ON-PREM/HYBRID
Seventeen of the 28 products that list an on-premises or hybrid option are access control platforms. Workplace platforms and vertical-market products are almost entirely cloud.

Seventeen of the 25 access control platforms list an on-premises or hybrid option, and 14 of them list no cloud deployment at all. In every other category the non-cloud options are a small minority: 6 of 24 dedicated products, 4 of 25 vertical-market products and 1 of 24 workplace platforms.

The same pattern shows up by customer segment. Of the 14 products that list critical infrastructure as a segment, 9 list an on-premises or hybrid option; of the 12 that list government, 8 do. Both figures are well above the directory-wide 28 of 98, though many of those products are also access control platforms, so the two patterns overlap.

That fits a straightforward explanation. Access control systems have long been installed on site, close to the doors and controllers they manage, and some security-sensitive organisations have policies about where such systems may run. A visitor module built into one of those platforms tends to follow the platform’s deployment model. Where visitor management stands alone, the cloud has largely won.

What actually moves to the supplier

“Cloud” and “on-premises” are often discussed as if they were opposite ends of everything. In practice they move a specific set of responsibilities, and leave others exactly where they were.

Who typically handles what under cloud and on-premises deploymentA grid of seven responsibilities with columns for cloud and on-premises. Under cloud, the supplier typically handles servers and hosting, operating system and database patching, application updates, backups and recovery, and availability monitoring. Under on-premises, you handle all of these, with application updates shared because the supplier provides releases and you apply them. Under both models, you handle kiosk devices and the site network, and user access, roles and retention settings.CloudOn-premisesTYPICALLY HANDLED BYServers and hostingOperating system and database patchingApplication updatesBackups and recoveryAvailability monitoringKiosk devices and site networkUser access, roles, retention settingsSupplierSupplierSupplierSupplierSupplierYouYouSharedYouYouYouYouYouYou
A typical split; individual contracts vary, so confirm it with each supplier. The two rows below the dashed line are yours whichever model you choose.

Cloud moves the server estate to the supplier: hosting, patching the operating system and database, applying updates, running backups and watching availability. You gain a smaller operational burden and current software. You give up control over the timing of changes, and you depend on the supplier’s security practice — which is why certifications such as ISO/IEC 27001 and SOC 2 reports matter, and why it is worth reading what they actually cover rather than noting that they exist.

On-premises keeps all of that with you. You control when updates happen, where data lives and how the system connects to the rest of your network. You also take on everything the supplier would otherwise do, including the security of the servers. If your IT team already runs similar systems well, that may be a modest cost. If not, it is the part most likely to be neglected.

Hybrid means different things to different suppliers. It can describe a cloud service with a small on-site component that talks to local door controllers, or a locally hosted system that synchronises to a cloud dashboard. Always ask exactly which components run where, and which data is stored in each place.

Two things do not move under any model. The kiosk tablets, badge printers and site network are yours. So are decisions about who has access to visitor data and how long it is kept.

When on-premises still makes sense

Most organisations buying visitor management will reasonably start with the cloud. The cases for something else tend to come from two directions: dependence on on-site systems, and policy about where data may be held.

A two-by-two guide to deployment choiceA two-by-two matrix. The horizontal axis is dependence on on-site systems such as access control, from low to high. The vertical axis is policy restrictions on external hosting, from low to high. Low dependence and low restrictions: cloud is the sensible default. High dependence and low restrictions: ask about hybrid or local connector components. Low dependence and high restrictions: check hosting regions and certifications first, and use on-premises if policy still requires it. High dependence and high restrictions: on-premises or hybrid is likely to be needed.Check the cloud offer firstHosting region, certifications andcontract terms may satisfy policy.If they cannot, on-premises.On-premises or hybridLikely needed. Often the visitormodule of the access controlplatform already on site.Cloud is the sensible defaultWidest choice of products andthe smallest operational load.Ask about hybrid componentsA cloud service with a localconnector to doors and controllersmay be enough. Ask what runs where.Dependence on on-site systems, such as access controlLowHighPolicy limits on external hostingLowHigh
Most organisations sit in the bottom-left quadrant. The further up and right you are, the more the on-premises minority of the market becomes relevant.

Your visitor process is tied to on-site security systems. If visitors must receive credentials from an access control platform that runs on site, the visitor component may need to sit close to it — or simply be that platform’s own module. This is where the directory’s on-premises options are concentrated.

Policy restricts external hosting. Some organisations, often in government or critical infrastructure, have rules about where certain systems and data may be held. Check whether a cloud service’s hosting region, certifications and contract terms can satisfy those rules before assuming they cannot. If they cannot, on-premises is the answer.

Connectivity is unreliable. Remote or industrial sites with poor connections are sometimes cited as a reason for local hosting. Before deciding, ask cloud suppliers how their kiosks behave offline: whether sign-in continues, how records sync afterwards, and whether an evacuation list is still available. A good offline mode may solve the problem without moving the server.

What does not, on its own, justify on-premises is a general sense that data is safer in your own building. It may be, if your infrastructure is well run. It may not be. That is a question about operational capability, not location.

Where to go next