# Key, alarm code and safe access log for a restaurant: who has what, and what to change when someone leaves

*Guides · Mays Team · May 21, 2026*

![Mays cover card: Key, alarm code and safe access log for a restaurant: who has what, and what to change when someone leaves — Every key numbered, every code personal, every change written down](https://mays-uploads.s3.us-east-2.amazonaws.com/site/blog__restaurant-key-alarm-code-safe-access-log__cover.05e05fe229.png)

Ask a small restaurant owner how many back-door keys exist and you'll usually get a guess: the opener's set, the one a former opener never returned, the office spare, the landlord's, the cleaning company's. The alarm code hasn't changed since installation, and several former employees know the safe combination.

None of that matters until something goes missing. Then you need to know, quickly, who could have got in.

This post is a ready-to-use **key and access log**: an inventory, a matrix of who should have what, logs for keys, alarm codes and the safe, a lost-key report and a quarterly audit. Our post on [promoting your first shift lead](https://www.mays.app/blog/promoting-first-shift-lead-cafe) says to keep a key log when you hand over keys; this is that log, filled out.

## Step 1: the access inventory

Walk the building and list everything that controls access, including the things that aren't keys.

| \# | What | Where it's used | Copies or codes that exist |
| --- | --- | --- | --- |
| 1 | Front door key | Guest entrance |  |
| 2 | Back door key | Staff and delivery entrance |  |
| 3 | Office key | Office, cash, paperwork |  |
| 4 | Storage locks | Dry storage, beer and wine |  |
| 5 | Door keypad codes | Staff entrance |  |
| 6 | Alarm codes | Alarm panel |  |
| 7 | Safe combination | Office safe |  |
| 8 | Drop safe and bank bag keys | Deposits |  |
| 9 | POS manager overrides | Voids, refunds, discounts, drawer open |  |
| 10 | Landlord, cleaning crew, vendor access | Shared areas, after hours, early deliveries |  |

Count the copies that exist, not the ones you think are in use. If you don't know, rekey (Step 5).

## Step 2: the access matrix by role

Decide who *should* have each kind of access before you look at who actually does. Our default for a small café or restaurant:

| Access | Owner | GM | Shift lead | Opener | Closer | Cleaning crew |
| --- | --- | --- | --- | --- | --- | --- |
| Front door key | Yes | Yes | Yes | If they open alone | No | No |
| Back door key | Yes | Yes | Yes | Yes | No | Yes, numbered |
| Office key | Yes | Yes | Yes | No | No | No |
| Own alarm code | Yes | Yes | Yes | Yes | Yes | Yes, its own |
| Safe combination | Yes | Yes | Only if they deposit | No | No | No |
| POS manager override | Yes | Yes | Own login | No | No | No |

Two principles behind it:

- **Fewest people for the most sensitive things.** The safe combination belongs to the people who count and deposit cash. Our [cash handling post](https://www.mays.app/blog/restaurant-cash-handling-till-reconciliation) covers that routine.
- **Everyone gets their own code or login.** A shared alarm code tells you the alarm was turned off. A personal code tells you who turned it off.

## Step 3: the key issue and return log

Number every key (stamped, engraved or a numbered tag), then log every key that leaves the office.

| Key no. | Opens | Issued to | Date issued | Signature | Date returned | Received by |
| --- | --- | --- | --- | --- | --- | --- |
| B-01 | Back door |  |  |  |  |  |
| B-02 | Back door |  |  |  |  |  |
| F-01 | Front door |  |  |  |  |  |

- **One line per key, not per person.** Three keys, three lines.
- **Signed going out, initialed coming back** by the manager who receives it.
- **Spares are on the log too,** issued to "Office spare", so you can see the spare is still in the drawer.

## Step 4: the alarm code and safe logs

**Never write a code or combination in any log.** The log records who holds a code and when it changed. The codes themselves stay with the alarm company and the owner.

### Alarm code holders

| User no. on panel | Name | Role | Date added | Date removed | Reason |
| --- | --- | --- | --- | --- | --- |
| 01 |  | Owner |  |  |  |
| 02 |  |  |  |  |  |

Most alarm panels give each code a user number. Ask your alarm company whether it can report which user armed and disarmed the system; that's why personal codes are worth the setup.

### Safe combination changes

| Date changed | Changed by | Why (scheduled, departure, suspected leak) | Who was told | Witness |
| --- | --- | --- | --- | --- |
|  |  |  |  |  |

Keep this page in the owner's file, not on the office wall.

## Step 5: when to collect, change or rekey

Most access problems come from not acting on the day something changes.

| What happened | Same day | Within a week |
| --- | --- | --- |
| Someone leaves | Collect and log back their keys. Delete their alarm, keypad and POS codes and their app access | Change the safe combination if they knew it. Rekey any door whose key wasn't returned |
| Someone changes role | Collect keys the new role doesn't need. Update their codes | Change the safe combination if they no longer need it |
| A key is lost or stolen | Fill in the lost-key report. Note it in the manager log | Rekey that door and reissue numbered keys |
| A break-in or attempt | Police, then the alarm company for the arm/disarm history | Rekey the affected doors, change alarm codes and the safe combination |
| A contractor or vendor stops | Delete their code, collect their keys | Rekey if a key isn't returned |

A locksmith can usually rekey a lock (so old keys stop working) rather than replace it; ask which applies to your doors.

For the rest of a departure (final pay, the conversation, the schedule), see letting someone go, done right (coming Nov 10). For logins, Wi-Fi and shared accounts, see passwords, shared tablets and staff accounts (coming Nov 15). This log is the physical half of the same checklist.

## Step 6: the lost-key report

| Lost-key report |  |
| --- | --- |
| Key no. and what it opens |  |
| Who had it, and when they last saw it |  |
| Anything identifying with it (logo keychain, address, a code on a tag)? |  |
| Reported to, and date |  |
| Decision: rekey now / rekey if not found in 48 hours / no action (why) |  |
| Rekeyed on, by, and new key numbers |  |

## Step 7: the quarterly access audit

Once a quarter, the owner or GM checks:

- Every key on the log is returned or with a current employee who still needs it. Look at the spares in person.
- The alarm company's current user list matches the people who should have codes. Keypad codes too.
- Everyone who knows the safe combination still needs it. If not, change it.
- POS manager overrides match the people in manager roles.
- The cleaning crew and any vendor with access are still current, with their own codes.
- The closing checklist still includes "alarm set" and "doors checked" (see [checklists staff will actually follow](https://www.mays.app/blog/opening-closing-checklists-staff-follow)).
- Anything that came up has a fix and a date in the [manager shift log](https://www.mays.app/blog/manager-shift-log-template).

## Where Mays fits

Mays doesn't track keys, alarm codes or safe combinations. **Never put a code or combination in a chat message, a shared article or a form.** Mays helps with the routine around them:

- **App access goes with the job.** When someone leaves, deactivate them under **Locations & Users → Users**. They can't sign in on the web, in the app or with their PIN on a shared kiosk, and their hours and history stay. See [Deactivating team members](https://www.mays.app/help/team-roles/deactivate-and-delete-users).
- **The key log as a form.** Under **Tasks → Types**, build a *Key issue and return* form: an **Employee** field, **Text** for the key number, **Single choice** for Issued or Returned, a **Date / time** and a **Signature**. Submissions land in Task Data, and **Export CSV** gives you the log by date range. See [Building custom forms](https://www.mays.app/help/tasks-checklists/custom-form-task-types) and [Task Data](https://www.mays.app/help/tasks-checklists/task-data-export).
- **The audit on the calendar.** Make the Step 7 list a checklist template with a **Quarterly** frequency, assigned to the GM. See [Scheduling and assigning checklists](https://www.mays.app/help/tasks-checklists/schedule-and-assign-checklists).
- **A lost key or one not returned.** Post it in the **Logbook** under **Incidents** or **Staff**, with **Needs follow-up**. See [The manager logbook](https://www.mays.app/help/scheduling/manager-logbook).

What Mays doesn't do: there's no key inventory or list of who holds which key, and it doesn't connect to alarm panels, keypads or safes. Deactivating someone in Mays changes nothing outside Mays. Each form submission is a separate entry, so matching returns to issues is up to you; keep the paper or spreadsheet log as the master list.

## Know who can get in

Number the keys, give everyone their own code, write down every change the day it happens, and check the list against your team once a quarter.

[**Start your free trial**](https://go.mays.app/register): 30 days, every module, no card needed. Or [book a walkthrough](https://www.mays.app/book?from=blog-restaurant-key-alarm-code-safe-access-log) and we'll set up the key form and the quarterly audit with you.

## Related help articles

- Team & roles: [Deactivating team members and deleting accounts](https://www.mays.app/help/team-roles/deactivate-and-delete-users) — When someone leaves, deactivate them. They can't sign in, but their hours and history stay. Staff can delete their own account in the app; an admin can restore it for 30 days, then its contact and sign-in details are removed.
- Tasks & checklists: [Building custom forms (Task Types)](https://www.mays.app/help/tasks-checklists/custom-form-task-types) — Build your own task forms, like a cash count, a temperature log or a waste log, under Tasks → Types. Staff fill them in the app, and every answer lands in Task Data, ready to export.
- Tasks & checklists: [Task Data: viewing and exporting form answers](https://www.mays.app/help/tasks-checklists/task-data-export) — Tasks → Data lists every answer submitted on a custom form, like a cash count or temperature log, one row per submission, and downloads them as a CSV file.
- Tasks & checklists: [Scheduling and assigning checklists](https://www.mays.app/help/tasks-checklists/schedule-and-assign-checklists) — Choose which days a checklist runs, the hours staff can see it, whether unfinished tasks carry over, and who does it — a role, a department, specific people or one person per task.
- Scheduling: [The manager logbook](https://www.mays.app/help/scheduling/manager-logbook) — A daily journal for each location — handoff notes, incidents and maintenance, with comments, follow-up flags, who's read what, and how your team rated their shifts.
- Team & roles: [Roles and permissions](https://www.mays.app/help/team-roles/roles-and-permissions) — What the built-in Admin, Manager and Employee roles can do, how location access works, and how to build a custom role from individual permissions.

Canonical: https://www.mays.app/blog/restaurant-key-alarm-code-safe-access-log