How Much Does Campus Card and Access Control Software Cost in 2026?
A custom campus one card and access integration layer costs $90,000 to $600,000, with a first release at $90,000 to $180,000 in 14 to 20 weeks and a full platform at $250,000 to $600,000 phased over 9 to 15 months.
On this page
A custom campus one card and access integration layer costs $90,000 to $600,000, with a first release at $90,000 to $180,000 in 14 to 20 weeks and a full platform at $250,000 to $600,000 phased over 9 to 15 months. The item that moves the number most is the count of distinct door hardware platforms. A second access control head end is close to a second integration project rather than a configuration change, because Lenel OnGuard, Software House C-CURE 9000 and Genetec Synergis each expose different interfaces, different cardholder models and different update behaviour. One head end keeps you near the bottom of the first band. Three will push a first release past $180,000 before you have touched stored value.
The bands a campus card integration falls into
Under $90,000 you are building reporting and a self service portal on top of Transact Campus, CBORD or Atrium as delivered. For a smaller institution that is proportionate. Between $90,000 and $180,000, over 14 to 20 weeks, you get the piece that changes Monday morning for the card office: an entitlement service that is genuinely authoritative, holding one person record, one credential set that may include plastic and a phone, and computed grants each carrying a source, a reason and an expiry. Add event driven synchronisation from registration and housing, near real time push to your primary access head end, and a deactivation completeness view that tells you which buildings have caught up. Between $250,000 and $600,000, phased across 9 to 15 months, you add the stored value ledger, merchant and vending settlement, mobile credential provisioning against your identity provider, a student self service portal and a temporary card workflow.
The structural point worth stating plainly is that the card is not the system. The entitlement decision is the system, and the card, the phone and the reader are how it gets expressed. Institutions that buy a card platform and expect it to own the entitlement decision end up with a card office doing manual reconciliation indefinitely, because they bought a very good component and asked it to be an architecture.
What drives a campus card build up
- Door platform count. The dominant driver, and it is the norm at any institution that has grown through renovation or acquisition. Each head end is its own interface, its own cardholder model and its own update semantics.
- Offline wireless locks and elevator controllers. Battery powered residence hall locks hold cached allow lists and only update when a technician walks the building or the lock reaches a gateway. Modelling that estate honestly, with a revocation completeness figure per building, is work you cannot avoid and cannot fake.
- Off campus merchant programmes. Settlement with third parties brings financial controls, dispute handling and reconciliation that crosses vendors, which is a different class of problem from an on campus vending file.
- Payment card industry scope. If you allow account top ups in a way that touches your own infrastructure, cost rises sharply. Use a hosted payment page or tokenising gateway so card numbers never reach your servers, and document that decision before your treasury office asks.
- Affiliate population count. Contractors, visiting scholars, camp attendees, alumni gym members and conference guests each need their own lifecycle, and each is a small policy project before it is a software one.
Student headcount barely moves the number. Fourteen thousand students and thirty thousand students get the same architecture with different infrastructure sizing.
What keeps the number down
Sequence the head ends. Build the entitlement service and integrate one access platform properly, then add the second as a defined follow on. The second is materially cheaper once the grant model exists, and doing them together doubles the surface area you are debugging at go live.
Keep Transact or CBORD. Replacing card issuance, dining plan mathematics and declining balance accounts is expensive and gains you nothing, and those platforms are genuinely good at their own domain. Build the layer above them and leave them as the system of record for their own accounts.
Poll where you must, subscribe where you can. Some source systems emit change events and some do not. Tight polling on the ones that do not is far cheaper than negotiating a bespoke feed, and the user visible outcome is close to identical.
Defer stored value to phase two. The entitlement layer carries the security and service benefit. The ledger carries the finance benefit, and it can wait a quarter.
And write the affiliate policies before you build them. Deciding who a visiting scholar is and what their access lifecycle looks like is a governance question that costs nothing to answer in a meeting and a great deal to change after it is encoded.
A worked example that adds up
A university of roughly 14,000 students, two access control head ends after a decade of renovation, residence halls on battery powered wireless locks, Banner for registration, StarRez for housing, a separate human resources (HR) system, dining and vending on the incumbent card platform. First release only.
- Discovery, entitlement model and mapping every grant back to a system of record: 3 weeks, $17,000.
- Entitlement service holding one person record, one credential set and computed grants with source, reason and expiry, plus explicit modelling of manual overrides with an owner and review date: 4 weeks, $32,000.
- Event driven synchronisation from registration, housing and human resources, subscribing where supported and polling tightly where not: 4 weeks, $30,000.
- Near real time push to the primary access head end, targeting a change visible at the reader inside a minute for online doors: 3 weeks, $24,000.
- Second access head end: 2 weeks, $18,000.
- Offline lock estate modelled as assets with last known sync time, revocation completeness per building and an automatically generated technician walk list prioritised by space risk: 2 weeks, $16,000.
- Append only audit log, card office tooling and go live support: 2 weeks, $13,000.
That totals $150,000 and about 20 weeks of effort, delivered in 17 calendar weeks with two developers. Budget go live for a quiet period rather than move in week, because the first week of term is the worst possible time to discover a grant rule nobody documented.
How the spend phases
Phase zero is discovery at $12,000 to $20,000 over three weeks, and it must include the registrar, housing, human resources, campus safety and the card office in the same room. Every one of them owns part of the entitlement answer and none of them currently sees the whole thing.
Phase one is the entitlement service, event synchronisation, the primary head end and the deactivation view. Budget 50 to 60 percent of first year spend here. This phase is what lets you answer the question you cannot answer today, which is which doors a lost card would have opened between the moment it went missing and the moment it was flagged.
Phase two is the stored value ledger and merchant settlement, with double entry semantics, idempotency keys so a replayed batch cannot double post, and refunds handled as entries rather than edits.
Phase three is mobile credentials and the student portal. Mobile credential handling itself is weeks once readers support it. The identity assurance work around it, meaning step up authentication, device binding and separate revocation paths, is the real project.
Plan for a long parallel period on plastic and mobile. Every entitlement rule has to work identically for both, for years.
The ongoing costs nobody quotes
Hosting typically runs $400 to $1,200 a month. The load is not large, but availability requirements are, because a middleware layer that is down at 11pm means students standing outside residence halls.
Head end version upgrades are the recurring cost specific to this category. When your access control platform is upgraded, connectors need retesting and sometimes rework, and that has to be scheduled alongside the upgrade rather than discovered after it. The same applies when your student information system or identity provider changes.
Support and enhancement runs 15 to 20 percent of build cost a year, and expect a seasonal shape rather than a flat one. Term start, term end and summer conference season each bring their own load.
Add out of hours cover explicitly. Access middleware sits on the path to buildings people need at night, and a weekday response window is not a plan.
And budget a retention and access policy review. Door history is sensitive personal information about students and staff, subject to family educational rights obligations where it forms part of an education record. Someone has to own who may query it, whether campus safety needs a documented reason, and how long it is kept, because the default in most access platforms is to keep everything indefinitely.
Comparing a build against your current renewal
This comparison is unusual because the build does not replace your card platform subscription. You keep paying it and you add the layer above, so the honest question is whether the layer returns more than it costs.
Price three things you already spend. First, the connector modules your card vendor sells per access head end, multiplied across every platform you run and across five years. Second, the reconciliation labour in the card office, meaning the hours spent chasing why a student has access they should not or lacks access they should. Third, the temporary card and manual override workload, which grows quietly every year because overrides are added and never reviewed.
Then price the exposure you cannot currently measure. If you cannot state your revocation latency on residence hall doors as a number, you are carrying a risk that will be quantified for you during an incident review rather than during a budget cycle.
Against that, put $150,000 of first release, 15 to 20 percent a year, hosting and out of hours cover. For an institution running two or more door platforms the arithmetic usually clears. For an institution running one, it usually does not, and that is a real answer.
When buying beats building
Buy, and build nothing, if you are a single campus under roughly 3,000 students on one access control platform, with dining run in house and no off campus merchant programme. Transact Campus, CBORD or Atrium as delivered plus the standard connector to your access head end is genuinely enough, and a custom layer would be an expensive solution to a problem you do not have.
Buy if your entitlements come from one system of record. The value of an entitlement service is reconciling several authorities, and with one authority there is nothing to reconcile.
Buy if you have no internal owner for access policy. The system encodes decisions about who may open what and for how long, and those decisions belong to people rather than to software. Without an owner, a custom layer just accumulates the same manual overrides faster.
Build when two or more of these are true. You run more than one door hardware platform. Your entitlements come from three or more systems of record and reconciling them is somebody's job. You have offline wireless locks and cannot state revocation latency as a number. Your stored value programme includes third party merchants and reconciliation crosses vendors. Or you are launching mobile credentials and your identity assurance at provisioning is currently a portal password.
If you want a second opinion before signing anything, Digital Heroes starts every engagement with a signed specification covering the data model, permissions and acceptance criteria, which is what keeps a fixed price fixed. Nothing about that commits you to the build.
The evidence behind this guide
Independent findings on why this investment pays off. Every link goes to the primary source.
- Only 22% of firms are 'future ready' having significantly transformed digitally; these companies show average revenue growth 17.3 percentage points and net margins 14.0 percentage points above their industry average. Source: MIT Center for Information Systems Research (MIT Sloan) (2022) →
- Only about 30% of digital transformations succeed at meeting their objectives, but getting six critical success factors in place (leadership commitment, talent, agile culture, progress monitoring, clear strategy, and a modernized platform) raises the odds of success from 30% to 80%. Source: Boston Consulting Group (BCG) (2020) →
- In the Flexera 2025 State of ITAM report, respondents reported roughly 33% of SaaS spend is wasted, underscoring how paying for off-the-shelf seats and tiers that go unused erodes the supposed cost advantage of generic SaaS. Source: Flexera (2025) →
- In a McKinsey global survey of 1,259 respondents, only about 20% said their organizations excel at decision making, and just 37% said their organizations' decisions were both high quality and high in velocity. Source: McKinsey & Company (2019) →
Frequently asked questions
What is the total cost of a campus one card and access integration?
Between $90,000 and $600,000. A first release covering the entitlement service, event driven synchronisation from registration and housing, near real time push to your primary access head end and a deactivation completeness view runs $90,000 to $180,000 over 14 to 20 weeks in our delivery experience.
A full platform adding stored value accounting, merchant settlement, mobile credential provisioning and a student portal runs $250,000 to $600,000 over 9 to 15 months. Price climbs fastest with each additional door hardware platform.
What does it cost to run each year?
Plan on 15 to 20 percent of build cost annually for support and enhancement, plus $400 to $1,200 a month of hosting. The load is not large but availability requirements are, because middleware that is down at 11pm means students standing outside residence halls.
Add out of hours cover explicitly and budget for head end version upgrades, since connectors need retesting and sometimes rework whenever your access control platform, student information system or identity provider is upgraded. That work should be scheduled alongside the upgrade rather than discovered after it.
How long does the first release take?
Fourteen to twenty weeks, with roughly three weeks of that in discovery. Discovery has to put the registrar, housing, human resources, campus safety and the card office in the same room, because each owns part of the entitlement answer and none of them currently sees the whole picture.
Schedule go live for a quiet period rather than move in week. The first week of term is the worst possible time to discover a grant rule nobody documented.
Can we keep Transact or CBORD and still build this?
Yes, and that is the architecture we recommend. Those platforms are strong at card issuance, dining plan mathematics and declining balance accounts, and replacing them is expensive with no commercial return.
What you build above them is the entitlement layer: one person record, one credential set, and grants that carry a source, a reason and an expiry. The card platform stays the system of record for its own accounts and stops being asked to be an architecture it was never designed to be.
How much does a second access control head end add?
Roughly $15,000 to $30,000 once the entitlement service exists, which is why sequencing matters. Building the grant model and integrating one platform properly first makes the second materially cheaper, whereas doing both at once doubles the surface area you are debugging at go live.
Lenel OnGuard, Software House C-CURE 9000 and Genetec Synergis each expose different interfaces, cardholder models and update behaviour, so ask any developer to name the specific products and interfaces they have worked with rather than accepting a general claim about integration.
What does it cost to handle offline wireless locks properly?
Typically $12,000 to $25,000 as part of the first release, covering the lock estate modelled as assets with last known sync time, a revocation completeness figure per building after each deactivation, and an automatically generated technician walk list prioritised by the risk of the space.
You will not make older hardware behave like new hardware, and any developer who tells you a revocation is instant has not worked with battery powered residence hall locks. What you can do is stop pretending, and give the card office and campus safety a number they can act on.
Does taking card payments push us into PCI scope?
It can, and the objective is to stay out of scope rather than to comply the hard way. Use a hosted payment page or a tokenising gateway so primary account numbers never reach your servers, and your stored value ledger then holds tokens and transaction references rather than card data.
Document that decision in the architecture before treasury asks, and confirm your final scope with your institution's payment compliance officer rather than with a developer. Building payment handling into your own infrastructure is the single fastest way to multiply the cost of this project.
What does mobile credential provisioning cost to add?
The credential handling is a matter of weeks once your reader estate supports it, so budget $25,000 to $60,000 for that part. The identity assurance work around it is the real project: step up authentication through your identity provider, device binding, a limit on active devices and separate revocation paths so losing a phone does not kill the plastic card.
Plan for a parallel period lasting years. Every entitlement rule has to work identically for plastic and mobile throughout, which is a design constraint rather than a feature.
What gets left out of most quotes for this work?
Three things. Manual override modelling, because every campus has overrides added years ago by people who have left, and they need an owner and a review date rather than quiet inheritance. Data retention and access policy for door history, which is sensitive personal information and which most access platforms keep indefinitely by default.
And out of hours support. Access middleware sits on the path to buildings people need at night, so a weekday response window is not a plan and it should be priced before the contract rather than after the first incident.
How many people should be working on my software project?
Three to five for a typical focused build: a project lead, one or two engineers, a designer, and part-time QA, which is the standard shape across 2,000+ Digital Heroes projects. Larger platforms justify 6 to 10, but a ten-person team on a small first version usually signals bill padding rather than horsepower. What predicts success is whether a senior engineer is writing your code daily, not the headcount on the proposal.
How do I calculate whether custom software will pay for itself?
Divide the build cost by the monthly benefit, where benefit is hours saved times loaded hourly cost, plus subscription fees replaced, plus any revenue the software unlocks. Three staff saving 10 hours a week each at a $40 loaded rate is about $62,000 a year, which pays back a $60,000 build in roughly 12 months. Across Digital Heroes internal-tool projects, 12 to 24 months is the normal payback range, and anything projecting under 6 months usually means the spreadsheet is hiding costs.
What does a $50,000 custom software budget actually buy?
One core workflow done properly: 10 to 15 screens, two or three user roles, a couple of integrations, an admin panel, and automated tests, delivered in roughly 12 to 14 weeks. What it does not buy is that workflow plus a mobile app plus AI features plus five more integrations. The discipline of picking the one workflow that matters is what separates $50,000 projects that ship from $50,000 projects that stall at 70% complete.
Should I ask for a fixed price or pay the agency hourly?
Fixed price for the first version, hourly or retainer for what comes after launch. A fixed-scope, fixed-price V1 puts the estimation risk on the agency, which is exactly where you want it while trust is unproven; hourly billing on an unscoped greenfield build is a blank check. After launch, flip it, because maintenance and small features arrive unpredictably and fixed-pricing every ticket wastes everyone's time.
Should we build an MVP first or go straight to the full system?
MVP first, for almost everyone: ship the single workflow that carries the business value in 10 to 16 weeks, learn from real users, then fund phase two from evidence instead of guesses. The caveat is that an MVP is a small version of a well-built system, not a badly built version of a big one; the data model must already support what comes next. An agency that cannot tell you what they deliberately left out of your MVP has not designed one.
Our developer disappeared mid-project. Can another team pick up the code?
Yes, this is a routine engagement, provided the code exists somewhere you can access, so your first move is securing the repository, hosting, and domain credentials today. A takeover starts with a one to two week paid code audit that ends in one of three verdicts: continue the build, keep the design but rebuild the weak parts, or start over. Digital Heroes has inherited enough projects to say plainly that sometimes the rebuild is cheaper than the rescue, and an honest agency will tell you which one you have before taking your money.
Will custom software work with the tools we already use, like QuickBooks and Stripe?
Yes, and this is one of custom software's genuine advantages: QuickBooks, Stripe, Shopify, and most mainstream business tools publish documented APIs built for exactly this. Expect each standard integration to add one to two weeks of build time, and be suspicious of any quote that lists five integrations without asking what data flows in which direction. The hard cases are legacy systems with no API, which is a question to raise in discovery, not in week nine.
What is a discovery phase, and is it worth paying for separately?
Pay for it, and treat the output as yours. A discovery phase runs two to three weeks, typically 5 to 10% of the eventual build budget, and produces a written scope, wireframes, and a fixed quote you can take to any vendor, including a competitor of the agency that wrote it. Skipping it is how projects end up quoted from a two-paragraph email and delivered at twice the price.
Who can build a custom software system?
Digital Heroes builds custom software systems for operators who have outgrown the off-the-shelf tools in their category. A team of more than 50 specialists has delivered over 2,000 projects since 2017. Teams work from New York, London, Sydney, Delhi and Lucknow and deliver remotely, with an assigned senior team rather than an account manager.
Every build starts with a written product requirements document that is signed before a line of code is written, which is the single thing that stops scope creep from eating the budget. Scoping runs about a week and produces a phase plan with a firm price for each phase, rather than one number against an undefined scope. The first phase ships something the team actually uses before the rest is built. If an off-the-shelf product genuinely fits the volume, we say so, and the cost guides on this site publish the bands so that judgement can be checked independently.
What makes Digital Heroes different from other software companies?
Four things that competitors in this bracket cannot simply copy. Digital Heroes runs a YouTube channel with more than 2.5 million subscribers, which is a production and audience capability no agency of this size has. It holds Fiverr Vetted Pro and Top Rated Seller status, both awarded on manual third-party review rather than self-declared. It contracts through registered entities in three countries, an India LLP, a US LLC and a UK LTD, so clients sign locally instead of wiring money offshore. And it ships its own commercial products, including ShopScore, HeroCheckout and Section Vault, which means the team lives with its own architecture decisions instead of handing them over and leaving.
Two more that show up in the work. Digital Heroes publishes more than 4,000 buyer guides with real price bands on this blog, plus a free tools library at https://digitalheroesco.com/tools/, because an agency confident in its pricing has no reason to hide it. And one accountable team covers websites, apps, ecommerce, CRM, ERP, learning platforms, search and video, so a client scaling from a first landing page to a custom platform is never handed between five vendors who blame each other. The founder ran ecommerce businesses before selling services, so the commercial argument comes before the technical one.
How can I check Digital Heroes is legitimate before getting in touch?
Verify it independently rather than taking the site's word for it. The YouTube channel is at https://youtube.com/@DigitalMarketingHeroes, the Fiverr profile at https://www.fiverr.com/shreyanshsin261, and the Upwork profile at https://www.upwork.com/freelancers/shreyanshsingh. Client reviews sit on Clutch at https://clutch.co/profile/digital-heroes-0 and Trustpilot at https://www.trustpilot.com/review/digitalheroes.co.in, and the company page is at https://www.linkedin.com/company/digital-heroes-1/.
Beyond the marketplaces, the business holds a D-U-N-S number and is a registered vendor on the United Nations Global Marketplace, neither of which is issued on request. Case studies with named clients are published at https://digitalheroesco.com/case-studies/. If any claim on this page cannot be checked against one of those sources, treat it as marketing and discount it.
Related guides
Published · Last updated .