Anyone else losing sleep over what their storage manager is actually doing with the gate code list

Your buddy's story is a good example of a real operational gap, and you are asking exactly the right question.

First, some vocabulary. A rent roll is the list of current paying tenants. Access credentials means whatever lets someone open the gate or a unit, whether that is a keypad code, a key fob, or an app entry. Cycling credentials means deactivating the old ones and issuing new ones when a tenant leaves.

In a well-run facility, credential cycling happens on move-out, the same day the account closes. Modern management software (think SiteLink or Storedge) ties gate codes directly to account status, so when a manager marks an account closed, the code stops working automatically. That is the standard. The gap your buddy described, a code tied to a physical unit rather than an account, is a legacy setup that some older or smaller facilities still run. It requires a manual audit to catch.

The honest problem is that third-party managers vary a lot. Some run monthly credential audits against the rent roll. Some do it only when prompted. If you are evaluating a deal with a third-party manager, the questions to ask are specific: what software do they use, does credential deactivation happen automatically at account close, and can they show you the last audit log.

The thing worth knowing beyond your direct question: liability from unauthorized access is not just a headache for the tenant. It can touch the facility owner if the operator's negligence is documentable. A property attorney in your state could tell you where that line sits. I would not skip that conversation before acquiring.

What kind of deals are you looking at, existing facilities with managers in place, or vacant land you would build on?

The credential audit gap is real and more common than operators admit. What your friend described, a code persisting through informal transfer after unit clearance, happens because most access control systems at smaller facilities tie credentials to the unit number at setup and rely on staff to manually deactivate on move-out. The assumption doing the most work in any passive hold is that your property management agreement actually specifies that process and gives you visibility into it. Most don't, and most buyers never check.

For facilities using keypad-based gate access, the deactivation step sits entirely in the software, something like StorEdge, Sitelink, or a comparable platform. A vacate event in the rental software should trigger credential removal, but only if the workflow is configured that way and staff actually close the vacate correctly. Where those two things fall out of sync, you get exactly what your buddy described, a phantom credential attached to a cleared unit.

If you're evaluating a deal or already hold an asset under third-party management, there are a few things worth confirming in writing rather than assuming. First, whether the management agreement defines a credential audit cadence, weekly or on every move-out at minimum. Second, whether the access control log is exportable and reconciled against the active rent roll on any schedule at all. Third, who carries the liability if an unauthorized access results in a claim. That last piece needs a real estate attorney to read the management agreement, not speculation.

The risk you didn't mention is theft attribution. If a tenant claims something walked, and your logs show credential activity against a vacated unit, that creates a paper trail that cuts in the wrong direction for you as the owner. The defense you want is a clean audit log, meaning deactivation confirmed at vacate, not a missing log.

What does the management agreement on the deal you're looking at actually say about access control procedures, if anything?

The common misconception is that gate access security is primarily a liability issue. It is primarily a revenue and insurance issue, which is why operators who treat it casually get hit twice: once when something walks, and again when their carrier asks about credential management protocols during a claim.

On your actual question: third-party managers vary enormously here, and the ones who do it well tie access termination to the payment system automatically, so a lapsed account triggers a credential wipe without a human remembering to do it. The ones who do not are running a spreadsheet or a clipboard, and audits happen when something goes wrong. When you are underwriting a managed facility, ask to see the specific workflow between tenant move-out, account closure, and access revocation, and ask when it last ran. If the manager cannot hand you a written procedure in thirty seconds, the answer is that it slips.

What does your current diligence checklist look like for the storage deals you have been sizing up, and does it get into operations at all or does it stop at the income statement?

The one thing I've never seen work is trusting a third-party manager to self-report audit gaps on any schedule tighter than "when something breaks." What actually happens is you get a quarterly report that looks clean because nobody ran it against the current rent roll, and the discrepancy lives there quietly for months exactly like your buddy described.

When I was underwriting a 60-unit facility outside Broken Arrow last spring the operator couldn't tell me how many active codes were in the system versus how many paying tenants they had. Couldn't answer it same day, took three days, and the number was off by eleven.

What's the management software they're running, because that gap is way harder to close on older keypanel systems than on something cloud-based where you can pull a credential export and cross it in a spreadsheet in twenty minutes?

Credential cycling tied to lease status, not to unit turnover, is where third-party managers earn or lose the job.

Most management agreements I have read specify what the manager must do operationally but say nothing about access credential audits, which means the schedule defaults to never unless you write it in as a deliverable with a reporting cadence and a consequence for a missed cycle.

Third-party managers almost never audit this on a schedule unless the software forces it.

Most third-party management agreements treat access control as a facility amenity, not a liability item, so it rarely appears in the audit schedule at all.

The gap worth pricing is this: when you underwrite a managed storage deal, the management fee line looks clean, but the contract usually defines the manager's scope around rent collection, delinquency, and maintenance calls. Credential hygiene sits in none of those buckets unless you write it in specifically. A facility running PTI or Nokē hardware can automate revocation at lease termination, but that only works if the software is integrated with the property management system and someone has configured the trigger. Older keypads tied to unit numbers, which your buddy's story describes, have no automated path at all and require a manual audit to catch stragglers. The liability exposure in that scenario is not just civil, it is your insurance carrier's first question after a theft claim: when was the last credential audit, and who signed off.

The diligence ask I would add to any LOI on a managed facility is a copy of the last twelve months of access logs cross-referenced against the rent roll at the same dates. If the operator cannot produce that, or produces it slowly, you have learned something about how the management agreement is actually being performed versus what the contract says. What does your current LOI template ask for on the operations side?

Credential drift is the audit item that shows up in no management agreement I have ever read.

Take a 200-unit facility running a flat $12 per unit monthly management fee. That fee structure incentivizes the manager to keep occupancy numbers clean on paper, not to run a monthly credential reconciliation against the rent roll, because reconciliation costs labor and generates zero additional fee. The audit simply does not happen unless the owner writes it into the scope of work with a frequency and a consequence.

The mechanism that created your buddy's situation is that most keypads assign codes at the unit level during move-in and the software marks the unit vacant when the account closes, but the physical code persists in the controller until someone manually flushes it. Cloud-based access systems like PTI or Nokē tie credential status to the active lease record, so a move-out in the software triggers a code deactivation automatically. Older systems with standalone controllers require a manual flush, and whether that happens depends entirely on whether someone's checklist requires it.

Before you underwrite any storage deal, I would pull the access control hardware spec and ask one question: does lease termination automatically deactivate the credential, or does it require a manual step? The answer tells you whether the manager's negligence is a bug or a structural feature of the system itself.

What software platform is the facility you're looking at running on the management side?

The margins look clean because operators don't price in this kind of overhead, and that gap is exactly where the slippage lives. I ran the numbers on a 180-unit climate facility outside Akron last spring and the management fee quote I got was 6%, but when I dug into the contract there was nothing in the SOW about access credential reconciliation at all, not even quarterly. So whatever that manager was doing on turnover was entirely discretionary. What software is the facility you're looking at running, because Storman and SiteLink handle this completely differently and that detail alone changes what you can actually verify remotely?

34 units or 340, the answer is the same: the audit only happens when somebody programs it into the software to trigger on lease-end, and most older installs just don't. I manage a duplex and a couple small multis and even at that scale I've had a tenant's "cousin" show up with a key three weeks after move-out, so I believe your buddy's story completely. What platform is the facility running, because SiteLink and Storedge both have auto-disable hooks if whoever set it up actually turned them on?

Credential drift is the liability, and the fix is architectural, not procedural.

Take a 200-unit facility running a legacy keypad system where codes are assigned per unit rather than per tenant account. When unit 114 turns over, the outgoing tenant's code stays live until a human remembers to pull it. If your manager runs 12 facilities and turns 40 units a month across the portfolio, that audit falls off the list fast. The only way to close that gap reliably is software that ties access credentials to the rent roll at the database level, so a lease termination automatically expires the credential the same night the account closes, with no human in the loop.

The due diligence question I would be asking on any storage acquisition is not "do you audit credentials" but "show me the integration between your property management software and your gate controller." If those two systems talk to each other in real time, the audit is automatic. If they do not, you are buying a process dependent on whoever manages the site remembering to do something, and processes like that have a half-life.

On the liability side, a single unauthorized access event probably does not move the needle on a claim without proof of loss, as your buddy found, but a pattern of them documented in a lawsuit creates a different picture for both insurance and future sale price.

What software is the facility you are looking at running on the access control side?

The line that stopped me was "nobody audited it" because that is the actual operating failure, not the code getting passed around. Codes get passed around everywhere. The problem is when nobody at the facility has a process that catches it, and third-party managers are especially bad here because their incentive is occupancy and collections, not security hygiene. I looked at a 280-unit facility outside Frederick, Maryland last spring and spent two hours going through the management agreement. Access control auditing was not mentioned once. The manager's obligations were rent collection, delinquency processing, and monthly reporting. Full stop. So when you ask if a third party does this on a schedule, the answer at that facility was: only if a tenant complains, which means almost never.

What I had not thought about before that deal, and what you are probably not going to find in the offering memo, is the gap between when a unit shows as vacant in the software and when the credential is actually deactivated in the gate controller. Those are two different systems at a lot of smaller facilities, sometimes running on different update cycles, sometimes synced manually by whoever opens on Monday morning. A unit can go vacant Friday afternoon, get re-rented by Tuesday, and the old code is still live for that whole window because nobody pushed the sync. At the Frederick property they were running StorEdge for leasing and a DoorKing panel at the gate and the property manager told me the sync was "basically automatic." I asked her to show me the last credential audit log and she did not know where to find it. I passed on that one.

The assumption doing the most work here is that a third-party manager has contractual obligation to cycle credentials, and most management agreements are silent on that specific trigger.

What software is the facility running, because SiteLink and Storedge both have auto-disable on vacate if the manager actually configured it right?

My two Canton rentals are nothing like storage operationally, but I had a property manager who could not tell me off the top of her head how many active key fobs she had issued for a four-unit. That is a much simpler system than a gate code list tied to 80 or 200 units. What does the management agreement actually say about access audits, is there a line item, or is it just assumed somebody checks?

Forty-seven active codes against thirty-one occupied units when I finally pulled the report myself last spring.

Confirm with any prospective manager whether their software auto-revokes on lease termination or requires manual intervention.