Skip to content
LobbyExpress
Search

How-to

Security questions to ask a visitor management vendor

A visitor system holds names, photos, host details and sometimes ID scans, and it runs on a tablet in a public lobby. These are the questions that separate a sound supplier from a slick demo, and how to read the answers.

By LobbyExpress Editorial

A visitor management system is an unusual piece of software to put through a security review. It holds personal data about people who are not your employees, it often stores their photographs, and its most visible component is a device bolted to a desk in the one part of the building that anyone can walk into.

Most vendors will hand over a security questionnaire response, a certificate logo and a reassuring paragraph about encryption. None of that is wrong, but none of it answers the question you actually need answered: what happens to your visitors’ data, and who can reach it?

This how-to gives you the questions to ask, grouped by where the risk sits, and explains how to read the evidence that comes back. Bring your IT security lead and your data protection officer into the process early; they will have organisation-specific requirements that sit on top of this list.

Step 1: map where the data goes

Before sending a questionnaire, ask the vendor to walk you through the architecture. You want to know every place visitor data is captured, stored, displayed or sent. For most cloud products that means five areas, and each one needs its own set of questions.

Five places to direct security questionsA central box labelled visitor management service, holding visitor records, photos and logs, is connected to five surrounding areas: the reception kiosk, the admin console, host notifications, integrations with access control and staff directories, and the hosting and sub-processor layer underneath. Each area is labelled with the questions it raises.Visitormanagement serviceRecords, photos, logsReception kioskLock-down, screen privacy,device managementAdmin consoleSSO, MFA, roles,audit log of staff actionsHost notificationsWhat personal data leavesin emails, SMS and chatIntegrationsAccess control, directory,APIs and their credentialsHosting and suppliersResidency, encryption,sub-processors, deletion
The sign-in screen is only one of five surfaces. Ask the vendor to confirm this map for their product, then work through the questions for each area.

Ask specifically what personal data appears in host notifications. A message that says “your visitor has arrived” is low risk; one that includes a photo, a mobile number and the visitor’s employer is copying personal data into inboxes and chat channels that the visitor system does not control.

Step 2: identity and access for your own staff

The admin console is where someone can export every visitor record you have ever held, so it deserves the most attention.

  • Single sign-on. Does the product support SSO through SAML 2.0 or OpenID Connect with your identity provider? Is SSO included in the tier you are buying, or a paid add-on?
  • Multi-factor authentication. If SSO is not used, can MFA be enforced for every administrator account, not merely offered?
  • Provisioning and leavers. Can accounts be created and removed automatically from your directory (often via SCIM)? If not, who removes a receptionist’s access when they leave?
  • Roles. Can a receptionist see today’s arrivals without being able to export the full history? Can site managers be limited to their own site?
  • Audit log. Are administrator actions, including exports and deletions, logged, and can you see that log?

Step 3: data location, encryption and deletion

Ask where visitor data is stored and processed, including backups and support access. “Hosted in the UK” or “hosted in the EU” may describe the primary database but not the region where backups live or where the support team works. If residency matters to you, get the answer in the contract rather than in a sales email.

On encryption, the baseline answers are encryption in transit (TLS) between every component, and encryption at rest for databases, file storage and backups. Follow up with who manages the keys and whether customer-managed keys are available, if your policies require them.

Deletion is the question vendors answer least well. Ask:

  • Can you set automatic retention periods per visitor type, so that records are deleted when your retention schedule says so?
  • Does deletion remove photos and ID images as well as the text record?
  • How long do deleted records persist in backups?
  • At the end of the contract, how is your data returned and then destroyed, and will the vendor confirm destruction in writing?

Step 4: certifications, and how to read them

Two forms of independent assurance come up most often. They are different things, and neither means “this product is secure” on its own.

ISO/IEC 27001 is an international standard for an information security management system (ISMS): the policies, risk assessments and controls an organisation uses to manage security. An organisation is certified against it by a certification body, and the certificate carries a scope statement saying which parts of the organisation, which services and which locations the ISMS covers. Alongside it sits a Statement of Applicability, listing which controls the organisation has applied and why others were excluded.

SOC 2 is a reporting framework from the American Institute of Certified Public Accountants (AICPA). An independent CPA firm examines a service organisation’s controls against the Trust Services Criteria: security, which is always included, plus optionally availability, processing integrity, confidentiality and privacy. It produces a report with an opinion, not a certificate. A Type 1 report looks at whether controls were suitably designed at a single point in time. A Type 2 report also tests whether they operated effectively over a defined period, which makes it the stronger evidence.

ISO/IEC 27001 compared with SOC 2 Type 1 and Type 2A comparison grid with three columns: ISO/IEC 27001, SOC 2 Type 1 and SOC 2 Type 2. Rows compare what each is, who issues it, what defines its coverage, the time it covers, and what to ask the vendor for. ISO/IEC 27001 is a certificate for a management system issued by a certification body, scoped by its scope statement and Statement of Applicability. SOC 2 reports are issued by an independent CPA firm; Type 1 covers control design at one date and Type 2 covers design and operation over a period.ISO/IEC 27001SOC 2 Type 1SOC 2 Type 2What it isWho issues itWhat sets coverageTime coveredAsk the vendor forCertificate for a securitymanagement systemAuditor’s report oncontrol designAuditor’s report on designand operation of controlsA certification body,ideally accreditedAn independent CPA firmAn independent CPA firmScope statement andStatement of ApplicabilitySystem description andcriteria selectedSystem description andcriteria selectedA certification cycle,with surveillance auditsA single point in timeA defined review period,stated in the reportCertificate, scope andStatement of ApplicabilityThe full report,usually under NDAThe full report, plus abridge letter if dated
The two are complementary rather than interchangeable. In every column, the row that matters most is coverage: confirm the visitor product and its hosting are inside it.

Reading the scope

The commonest problem is not a missing certificate but a narrow one. A vendor may hold ISO/IEC 27001 certification for its head office or a different product line, while the visitor product you are buying sits outside the scope. Read the scope statement and check that it names the service, not only the company. Check the certificate’s dates, and that the issuing body can be verified.

Reading a SOC 2 report

A SOC 2 report is long, but you do not need to read every page. Focus on the sections below.

Where to look in a SOC 2 reportA stylised report document divided into four typical sections: the independent service auditor’s report, management’s assertion, the description of the system, and the controls with the auditor’s tests and results. Arrows lead from each section to the question a buyer should ask of it, such as whether the opinion is qualified, whether the product is in scope, which subservice organisations are carved out, which user entity controls are your responsibility, and which exceptions were found.Independent serviceauditor’s reportThe opinionManagement’s assertionWhat the vendor claimsDescription of the systemScope, boundaries, subserviceorganisations, user entitycontrolsControls, tests, resultsWhat the auditor testedand any exceptions foundIs the opinion unqualified?A qualified opinion needs an explanation.Is your product in scope?Which hosting providers are carved out,and do they have their own reports?What must you do yourself?Complementary user entity controls,such as managing your own user access.Read every exceptionand management’s response to it.
Typical structure of a SOC 2 report. Layouts vary between audit firms, but the opinion, the system description and the exceptions are always worth reading in full.

Exceptions are not automatically a reason to walk away; a report with none can simply mean a narrow scope. What matters is whether an exception touches something you rely on, and whether the vendor explains what it did about it.

Step 5: suppliers, testing and incidents

Sub-processors. Under UK and EU GDPR the vendor, acting as your processor, needs your authorisation to engage sub-processors. Ask for the current list, what each one does with visitor data (hosting, SMS delivery, email, support tooling), where each is located, and how you will be told about changes.

Penetration testing. Ask how often the product is tested by an independent party, whether the kiosk application and APIs are in scope, and whether you can see a summary of findings and remediation. Many vendors share an executive summary or attestation letter rather than the full report, which is reasonable.

Incidents. Ask how and how quickly you will be notified of a security incident affecting your data, and who your contact is. Make sure the answer lets you meet your own breach-reporting obligations; your DPO can tell you what those are.

Step 6: the kiosk in the lobby

A sign-in tablet is a networked device in a public space, usually unattended for stretches of the day. Ask the vendor how they expect it to be secured, and check which of these protections are product features and which are left to you.

Kiosk hardening checklistA checklist of eight kiosk protections in two columns, each with a tick box. Software protections: locked to the sign-in app, previous visitor’s details cleared after each sign-in, no visitor history browsable on screen, and session timeout to the welcome screen. Device and physical protections: managed through device management, secure mount and cable lock, separate network or segment, and a remote lock and wipe capability.SoftwareDevice and physicalLocked to the sign-in appLast visitor’s details clearedNo visitor history on screenTimeout back to welcomeEnrolled in device managementSecure mount and cable lockOwn network or segmentRemote lock and wipe
Ask the vendor which of these the product enforces and which depend on your own device management. Test the software column yourself at the demo.

Test the privacy points in the demo. Sign in as one visitor, then walk up as the next. If any part of the previous visitor’s name, company, photo or host is visible, or can be reached by pressing back, that is a data leak happening in your lobby several times a day.

Putting the answers to work

Collect answers in writing, against named questions, and keep them with the contract. Where an answer matters to you, such as data residency, retention or breach notification, make sure it appears in the contract or data processing agreement and not only in a questionnaire. Re-ask the questions at renewal; scopes, sub-processors and hosting regions change.

For the wider buying process, see how to write a visitor management RFP, and for the data protection side of retention and privacy notices, read GDPR and visitor data. Security questions also differ by kind of product, as the four kinds of visitor management product explains. When you are ready to build a shortlist, start with the LobbyExpress directory and filter by cloud deployment or by category.