A lockbox is a good answer to a small question: how does one person get a key to one property when you are not there?
Property managers are not answering that question. They are answering a different one: how do sixty people get access to fourteen properties, on different schedules, with staff turnover, guests every few nights, and a requirement to know afterwards who went where.
A lockbox cannot answer that, and the reason is structural rather than a matter of buying a better box.
The breaking point is people, not properties
Managers usually assume the threshold is a property count. It is not. It is the number of people who hold your codes and the rate at which that set changes.
One property with two trusted key holders is a lockbox situation, comfortably.
Fourteen properties with three cleaning companies, a rotating set of trades, two co-hosts, a letting agent and a guest every four nights is a permissions problem. The set of people with access changes weekly, and a mechanical box has no concept of a person.
A quick self-test. If you cannot answer both of these immediately, you have crossed the line:
- Who currently knows the code to unit 7?
- Who entered unit 3 last Tuesday?
What actually goes wrong at portfolio scale
Codes become permanent
Changing a lockbox code means visiting the property, opening the box, resetting the mechanism, and notifying everyone who needs the new number. Across fourteen properties, that is a day's work.
So it does not happen. The code set in 2023 is still live. Every cleaner who has ever worked for you, every contractor, every departed co-host and an unknown number of former guests still hold current credentials. You cannot revoke access because there is nothing to revoke.
One code, many people, no distinctions
A single code cannot give the cleaner Tuesday mornings and the plumber a Thursday afternoon slot and the guest four nights. Everyone who has the number has permanent, unrestricted access, and the only control available is not telling people.
Keys travel
Guests take keys home. Cleaners carry them between properties. Keys end up in a jacket pocket across town. Because there is no record of the box's contents, you find out when the next guest is standing outside.
Every failure becomes a drive
A wrong code, a seized dial, a key not returned, a contractor arriving on an unplanned day. Each one becomes somebody in a vehicle. Across a portfolio, that is not an occasional inconvenience; it is a standing line in your cost base and it scales linearly with property count.
The record does not exist when you need it
The situations where a manager needs to know exactly who entered a property are entirely predictable: damage disputes, deposit arguments, insurance claims, allegations of unauthorised occupancy, missing items, neighbour and building complaints. Every one turns on a question of fact about access, and a lockbox has no answer.
Increasingly, the rules ask
This has changed materially in the last two years and it affects a lot of managed portfolios.
Italy requires guest identification and reporting to police within 24 hours, and Rome, Florence and Milan have been removing lockboxes from public property. Spain requires guest data submission within 24 hours. Amsterdam runs an algorithm cross-referencing listings against population and building registers, and Dutch courts have held that a host's own screenshots do not constitute evidence. New South Wales can exclude a host or a guest from the industry for five years for conduct breaches.
A shared four-digit code identifies nobody. For a manager operating in any of those markets, that is a compliance exposure rather than an inconvenience.
What replaces it
The change is conceptual before it is physical: access stops being a number attached to a property and becomes a permission attached to a person for a period of time.
In practice, for a managed portfolio:
Per-person credentials. Each guest, cleaner, contractor, co-host and staff member has their own, delivered as a code, a QR, an NFC tap or a wallet pass. Crews working across several clients do not need another app.
Windows that expire. A guest holds access from check-in to check-out. A cleaner holds a recurring Tuesday and Friday morning. An electrician holds Thursday between ten and twelve. Nothing needs cancelling because nothing persists.
Instant revocation. A cleaner leaves the company and their access ends that afternoon, across every property, without visiting any of them.
A complete record. Every collection and return, named and timestamped, exportable.
Keys that stay put. Keys live in the cabinet between handoffs instead of circulating in pockets, so non-returns are visible immediately rather than at the next check-in.
Deployment for a managed portfolio
The practical question is how many installations you need, and the answer depends on geography rather than property count.
Dense, walkable portfolios frequently run from a single point. Capacity starts at 9 key positions and grows through chained expansion modules, so one well-sited installation can hold keys for dozens of units.
Spread-out portfolios work better with one point per cluster, so that guests, cleaners and contractors are always collecting near where they are working.
Building-level portfolios put the installation inside the building itself, covering every unit you manage there.
Where you do not control a wall, managers commonly install at their own office or a small leased space rather than negotiating with several building associations.
On the software side, the platforms most managers already run connect directly, including Airbnb, Guesty, Hostaway and Res:harmonics, with an API behind them. Credentials go out automatically when a booking is confirmed rather than someone remembering to send a message at 11pm.
The honest comparison
We are not going to tell you lockboxes are useless. For a single property with a couple of trusted key holders, one is genuinely fine and cheaper.
The case for changing is specific: you have more people than you can track, your codes have not changed in a year, your team is driving to properties to deal with keys, and you could not evidence who entered a unit if asked.
If none of that describes you, keep the box.
If all of it does, the cost you are already carrying in staff time, drives, disputes and lost bookings is almost certainly larger than the fix.
See how it works or talk to our team about a portfolio setup.
Regulatory details reflect publicly available information at the time of writing and are provided for general guidance only. Rules on guest identification, reporting and key storage devices differ by jurisdiction and change frequently. Confirm current requirements locally.
