Utilities and vital infrastructure
Water boards, water companies, grid operators and energy infrastructure.
Scattered, unmanned, and without power at the door
Water boards, water companies, and grid operators manage facilities that are dispersed and usually unmanned: pumping stations, treatment plants, substations, street cabinets, and civil engineering structures. Cabling or power is by no means readily available everywhere, and installing it is rarely cost-effective for a remote facility. At the same time, the people who need access to these facilities are constantly changing: in-house technicians, contractors, and breakdown services.
Sellox focuses here electronic access control in that works offline. The existing cylinder is replaced by an electronic one, without running a single meter of cable. The rights are stored in the key, management is centralized, and every usage is recorded in the audit trail: per key, per cylinder, per moment.
Since August 15, 2026, the Cybersecurity Act and the Critical Entities Resilience Act apply to water boards, water companies, and network operators, and the CSIR of Rijkswaterstaat and the water boards applies to objects with process automation. You can read what these frameworks require regarding keys and doors on the page. Compliance.
What this looks like at a water board and a grid operator
You can read what this looks like at a water board and a grid operator in the case studies. These describe the reason for the implementation, which requirements were decisive, and how the implementation proceeded.
We do not publish locations or security details for customers in critical infrastructure.
Cylinders, rights, update points and issuance
Access with an electronic key
- What
- A cylinder that requires no power supply or wiring of its own.
- Where
- Field assets and technical rooms: pumping stations, stations, cabinets, fences.
- How
- The existing cylinder will be replaced one-to-one.
The key supplies the energy for the cylinder upon contact, so nothing needs to be installed at the door. Replacement takes minutes: open the door, remove the old cylinder, and insert the new one. There is no chopping, drilling, or wiring involved, and the installation behind the door does not need to be taken out of service—not even a server room. Every opening and every failed attempt is recorded, in both the key and the cylinder.
More about the cylinders→02Rights, validity and the moment they take effect
- What
- Who is allowed in where, and until when.
- Where
- Centralized in the management software, per person and per location.
- How
- Entitlements are assigned a validity period and are collected at an update point or via the app.
A change in the software and the moment that change is recorded on the key are two different moments. With offline access, you bridge this gap with two measures: rights expire automatically if a key is not updated, and update points are located in places where people pass by anyway. How short you set the validity period determines how quickly a revoked right actually disappears from the field — and how often someone needs to visit an update point. You make this assessment per group of users; for a breakdown service, a single service is a common starting point. If a key is lost, it is centrally marked as lost and deactivated as soon as it touches a designated cylinder; a replacement round along the doors is not necessary.
More about the software→03Update points
- What
- The place where a key retrieves new rights and submits its logbook.
- Where
- Workshops, depots and support points.
- How
- The rhythm is aligned with the breakdown service and the rotation of contractors.
Collection and return take place in a single contact. Consequently, the rhythm also determines when log data is centrally available: it is included as soon as the key is updated, not at the moment of opening.
More about communicators→04Issuance and the difference compared to a work permit
- What
- Who gets the key, and for what.
- Where
- In-house technicians, contractors, and breakdown services.
- How
- Issued in the name of the holder, or via a locker with pick-up and return.
The registration links an opening to a key and to the person to whom that key is assigned. The system therefore does not check at the door who is holding the key — the value of the registration stands or falls with a watertight issuance and return process. A safe helps with this: the key is retrieved there using a PIN code or card and returned, which works particularly well when there is a frequent change of contractors.
Apart from that, access says nothing about authority: the fact that someone is allowed inside does not mean that they may carry out all activities there. That remains a matter of your work permit. The two do align, however, when the issuance is in your name and the repatriation process is established.
More about programming vaults→05Update mobile
- What
- Updating a key via a phone, instead of via a fixed update point.
- Where
- For people who do not pass by a workshop or depot daily.
- How
- The app acts as the conduit to the management software; a connection is required for this at that moment.
This is useful for field service and breakdown services, but it is not a replacement for fixed update points: it makes updating dependent on coverage, battery, and another person's device. For situations where this is not possible, provisions exist to temporarily reactivate an expired key without a phone and without a server connection. Where the risk of connection dependency is unacceptable, we design around fixed update points with a fixed synchronization rhythm.
More about the software→06Flex, for the locations where a connection *is* available
- What
- A wired variant with inputs and outputs and signaling.
- Where
- Within a location where cabling is already present.
- How
- In addition to the offline cylinders on the outdoor objects.
On Flex doors, events are received directly in the management software, rather than at the next key contact. That is the reason to deploy Flex strategically where wired I/O or signaling truly adds value.
More about Flex→07Software and hosting
- What
- CAW Enterprise as the management basis for rights, keys, and reporting.
- Where
- Central, for all locations together.
- How
- Three variants, depending on your requirements.
Shared EU hosting for small to medium-sized environments. A dedicated EU environment if you require separation, at larger scales, or for integrations. On-premise if hosting is not permitted, or if logging and IT governance must remain within your own domain.
More about the software→What it requires, from inventory to management
The items are: cylinders and padlocks, keys, update points, software and hosting, the implementation itself, and subsequent management. What a system costs in practice depends primarily on the number of objects and the number of key holders. Read: what does an access control system cost
First, an inventory of objects, doors, and key holders. Then, optionally, a trial setup at a few locations, followed by phased replacement. The lead time is determined by the number of locations and how quickly you can access the objects, not by the installation itself.
Integrations are not a standard part of the setup. This does not mean they are impossible; it means that we assess what is needed and what is required on a case-by-case basis. If you have an existing system that needs to be integrated, please bring this up early.
The cylinders are classified according to EN 15684 (mechatronic cylinders) and bear an SKG certificate; padlocks according to EN 16864 and, in combination with partner padlock housings, CEN class 5 (EN 12320). Outdoor variants are IP68, the others at least IP55, with an operating temperature of -40 to +70 °C. We will send the test reports and classifications per variant upon request.
After delivery, management remains with you, with support from the Sellox Service Desk.
About offline access in the field
When does a modified authorization become active?
At the moment the key is updated, at an update point or via the app. Until that moment, the key retains the permissions assigned to it — which is why the validity period you set determines how short that window is.
What happens if a key gets lost?
You mark it centrally as lost. It expires automatically upon the expiration of its validity and is deactivated as soon as it touches a designated cylinder. There is no need to replace or re-key cylinders.
Do the cylinders work if the network fails?
Yes. The key and cylinder work without a network and without a central connection. What does wait for the connection, however, is updating permissions and retrieving log data.
When is log data centrally visible?
As soon as the key reaches an update point. The data is stored in the key and the cylinder up to that moment, so it is not lost.
What exactly does the audit trail record?
Date and time, which cylinder, which key and the person to whom that key is assigned, and whether opening was permitted or refused — including the reason for refusal.
The same approach, per object type
How we set up access control
Cylinders, keys, update points, and software in conjunction.
Read more→How do you secure a power station?
A cylinder without its own power supply, expiring rights, and an audit trail per key.
Read more→How do you secure a water treatment plant?
The same approach, with attention to the issuance to contractors and the location of the update points.
Read more→How do you secure a gas pipeline station?
Outdoor objects without facilities, where retrofitting the existing cylinder is the fastest way.
Read more→Compare your objects and your access process with our approach
Compare your properties and your access process with our approach. During that conversation, we determine together which properties are eligible, what the issuance should look like, and where update points are logically placed. You will then gain an understanding of the scope and phasing.
An overview of the scope and phasingDo you already have a system and want to know if it is still compatible? Then the SX HealthCheck is the better place to start.
Contact us