Customer Keys, Codes and Lockbox Custody

Why this matters

A customer who gives you their garage code, their alarm code or a key to the back door has handed your shop the one thing their locks exist to keep from strangers. Most shops treat it as a convenience detail, and so the codes end up in job notes, printed on service reports, typed into techs' phones and visible in the corner of a photo. Nothing goes wrong for years. Then a former employee, a lost tablet or a forwarded invoice puts a working way into someone's home in the wrong hands, and the shop is the obvious place the trail leads. Custody is the word for it: from the moment you hold a key or a code, where it lives and who can see it is your responsibility.

What you are actually holding

Not all access is the same, and the differences decide how carefully each one is handled.

• Gate and community codes. Often shared by a whole street or complex and changed rarely. Low harm alone, but they are frequently the first barrier in a chain.
• Garage keypad codes. A garage usually opens into the house through a door that is left unlocked, so for practical purposes this is a house key.
• Alarm codes. The code that turns off the thing that would have told the customer someone came in. On its own it opens nothing; combined with a key or a garage code it means entry with no record.
• Lockbox combinations. The box holds a physical key, so the combination is the key.
• Physical keys. The only item that can be copied without anyone noticing, and the only one that cannot be changed without a locksmith.
• Temporary digital codes. Smart locks and modern alarm panels can issue a code that works only on set days or can be deleted after the visit. These are the safest thing a customer can give you, and the easiest to retire.

The rule that falls out of this list: the harm is in the combination. A key and the alarm code for the same house, held in the same place, is the most dangerous pair in your files. Keep them apart.

Where each one may live, and where it must never appear

May live: the restricted access field of your job software, if the software supports one that shows only to the assigned tech; the shop's password manager, in a vault limited to the office roles that schedule access; a locked key cabinet in the office for physical keys, under a tag that does not identify the house.

Must never appear:

• On the invoice, estimate or service report. These get emailed, forwarded to a spouse or a property manager, printed and left on a counter, and kept for years. Check your document templates: many job systems copy job notes onto the customer-facing report by default, so a code typed into "notes" ends up on paper.
• In a job photo. A keypad with its worn buttons, a lockbox face, or a key with its cut edge visible is a working copy. A clear photo of a key's cuts can be enough to duplicate it.
• In a text thread, group chat or email. These sync to every device the person owns and outlive the employee.
• In a tech's phone notes or contacts. The single most common place codes end up, typed by a tired tech who wanted to stop calling the office.
• On the key itself. A key tagged with a street address is a found key that tells the finder which door it opens.
• In anything the customer portal, review request or marketing email draws from.

Who sees it, and when

Need to know, for the job window. The tech assigned to today's visit sees the code from the morning of the visit until the job closes. The office roles who book access see the field. Nobody else, which includes techs who are not on that job, the owner's relative helping with the books, and every vendor you integrate with.

Spoken aloud only when necessary, and never on speaker. A dispatcher reading a code over the truck speaker with a helper and a customer's neighbor in earshot has shared it with everyone present.

Named, not shared. If the job software keeps an access log, the record shows which person viewed which code. A shared login wipes that out, because every view is "the tablet"; see related: The Shared Login Problem.

How long you keep it

For as long as the service relationship needs it, and no longer. A sensible default: delete codes and return physical keys within 30 days after the last scheduled service when an account cancels, or when a seasonal account goes dormant, and ask the customer to re-share at the next season. Tune the 30 days to your service cadence, but pick a number and write it down, because "until we clean up the files" means forever.

Ask for the kind of access that can be retired. When a customer has a smart lock or an alarm panel that supports separate user codes, ask for one issued just for your shop. It can be deleted the day you stop servicing the house, many panels log which code was used at what time, and changing it does not force the household to learn a new code. That one request removes most of the long-tail risk in this article.

Return keys with a receipt. The customer signs or replies to an email confirming it came back. A key you cannot prove you returned is a key you still hold.

The coded key tag

A physical key carries a number and nothing else. The number means something only in a register kept somewhere other than the key cabinet.

  KEY TAG (on the ring)        REGISTER (office only)
  +------------------+         K-0417  acct 2291
  |      K-0417      |                 back door
  |  if found, call  |                 rcvd 03-14 sig: Y
  |  (shop main no.) |                 alarm: separate
  +------------------+                 user code, in
                                       vault, not here

The tag gives a finder a phone number and no address. The register line ties the number to an account, not a street, records when it was received and whether the customer signed for it, and deliberately says where the alarm code is NOT kept. The procedure for checking keys in and out against this register belongs to see related: The Customer Key and Code Handling SOP.

Worked example: a pool route's 38 ways in

A pool service company running a 6-person crew services 38 houses where it needs access to get to the pool. The owner audits what it is holding. The tally: 22 gate codes, 9 physical keys, 5 lockboxes and 2 temporary smart-lock codes, which is 22 plus 9 plus 5 plus 2, closing to 38.

Six of the 22 gate codes were in the job notes, and the job notes printed onto the emailed service report after every weekly visit. Those six customers had been receiving their own gate code by email every week, for as long as two seasons, and so had anyone they forwarded the report to. The owner moves the codes to the restricted field, turns off notes on the customer-facing report template, and tells those six customers what happened and suggests a code change. Telling them is the right call even though nothing bad is known to have happened: a customer who later learns it from someone else stops trusting the shop entirely.

Four of the 9 keys were tagged with street addresses. They get coded tags and register lines the same day. The reasoning is simple: each one was a lost-key incident waiting to happen in a truck that is left unlocked at a supply house.

One lockbox combination had not changed in three years, and a tech who knew it had left the company in that time. That customer gets a phone call asking them to change it, with the reason. The owner's rule from then on: when anyone with access to codes leaves, every lockbox combination they could have known is flagged for the customer to change; see related: The Employee Offboarding Digital Access SOP.

The 2 smart-lock codes were the clean part of the audit. Each was issued just for the shop and can be deleted from the customer's side. The owner starts asking every new customer with a smart lock for the same thing.

What would have changed the answer: had this been a commercial route, many property managers run their own key control, with numbered keys, signed receipts and periodic audits, and the shop's job is to comply with theirs rather than invent its own. Read the service agreement for it. And had a key gone missing outright, the question becomes who pays for the rekey and who is liable if the house is entered. That is a question for your insurance agent before it happens, not after: ask whether your general liability policy excludes property in your care, custody or control, and whether a third-party crime policy or a bond for employee theft of client property is appropriate for a shop that holds keys. This is not legal advice, and whether a shop is liable for a burglary using a key it lost depends on your contract and your state's law.

Codes the customer insists on handing over

Some customers give you the master alarm code and refuse a separate one, or text the code to a tech directly. Take it, because refusing access stops the work, but move it into the restricted field the same day, delete the text, and note on the account that the customer was offered a retirable code and declined. If a customer later reports that their code was misused, that note and the access log are what let you answer; the handling of that report belongs to see related: A Customer Says a Tech Shared Their Alarm Code.

References

• Your job software's documentation on restricted fields, role permissions and access logs
• Your alarm panel and smart lock manufacturers' documentation on user codes and scheduled codes, which you can point customers to
• See related: The Customer Key and Code Handling SOP, A Customer Says a Tech Shared Their Alarm Code, The Employee Offboarding Digital Access SOP