Backup For
Locksmiths & Security System Installers

The records that make up a locksmith's file room

A locksmith or small security installer's paperwork is organized around one thing above all else: the building. Everything that matters gets filed by address, because the system it describes belongs to that address for as long as the building stands.

• Master key system records and key-system charts, the layered structure that determines which keys open which doors across an entire property
• Client key and lock inventory, kept per address, listing what hardware is installed where
• Access-control card and fob assignment logs, tracking who was issued what credential on a given system
• Alarm panel programming record copies, documenting how a client's panel was set up and configured
• Safe and vault service records, covering installs, servicing, and combination changes performed over time
• Rekey and service work-order history, organized by address rather than by date
• Commercial service contracts and account records for recurring clients
• Job photos taken during installs and service calls
• Estimates and invoices
• QuickBooks company files covering the business side of the operation

All of this sits on the Windows computer or computers in your shop as ordinary files, not as a regulatory record, and Everyday Backups makes no compliance or recordkeeping claim about any of it. It backs up files saved locally to your Windows computer. If your key-tracking software or your access-control software is cloud hosted, described here only as software categories and not as a recommendation or compatibility claim for any specific product, its database lives on that vendor's own servers, not on your shop computer, and is not something a local backup service reaches. What is covered is anything your team saves or exports onto your own machines, which for most independent locksmiths and installers is the majority of what would actually be painful to lose.

Two of the more common recurring commercial accounts on that list are worth naming directly. A homeowners association or community association is a standing multi-building account, its common-area doors, pool gates, clubhouse, and mailroom running on the same kind of master key system and fob-assignment records this page is about, and its board can turn over every year while the key system itself does not, which our backup for HOA and community associations page covers from the association's own side. A self-storage facility is another standing account built the same way, with its own parallel per-facility lock and gate access-control records sitting alongside the ones you keep as the servicing locksmith, as covered on our backup for self-storage facilities page.

A lost file costs you the building, not just the paperwork

Most service trades measure a lost record in dispatch cycles. A locksmith measures it in buildings, and that difference is worth walking through carefully, because it is the reason this page exists.

A master key system record is address-permanent. When you cut a master key system for a commercial building, the chart that describes it stays valid for the life of that building's lock hardware, which in practice can mean decades. That chart is not a snapshot of one job, it is the reference document that lets you, or anyone else, cut a correct replacement key, add a new tenant to the system without disturbing the rest of it, or service that building again next year or in ten years. The building does not get a new master key system just because time has passed. The chart is either still on file somewhere, or the system has to be reverse-engineered or rebuilt from nothing.

Compare that to a normal service trade's dispatch record. A plumber or an HVAC technician who loses last year's work order for a client has lost a piece of history, an inconvenience, and maybe a callback that takes longer than it should. It is a recurring cost measured in delay: they can still show up, still diagnose the system in front of them, and still fix it, just with less context than they would like. A lost dispatch record does not stop the next job from happening.

A lost master key system record stops the next job from happening the way it should. If the chart is gone and you cannot reconstruct which keys correspond to which doors and which levels of access, the practical answer is often to start the key system over: rekey the affected doors or the whole building, recut and reissue keys, and rebuild the chart from scratch. That is not paperwork, it is hardware and labor, and it is a cost that lands on the client because your business no longer has the record that would have let you avoid it. The same shape applies to alarm panel programming records and access-control fob assignment logs: without the record, the fastest honest path forward is often to reprogram the panel or reissue every credential on the system, not to quietly pick up where the last technician left off.

So the honest way to say it is this: a normal service trade risks a recurring cost every time a dispatch record goes missing, one bad callback at a time. A locksmith risks a one-time but much larger cost, the ability to service a given building at all without re-doing work that a client already paid for once. That is a different risk shape, and it is why "we'll just note it down again next time" is not really an option here the way it might be somewhere else.

What this covers, and what it does not

Everyday Backups backs up files saved locally on your Windows computer. It does not back up a cloud-hosted key-tracking platform, a cloud-hosted access-control management system, or any vendor's hosted alarm monitoring database.

It is also worth being plain that Everyday Backups is a data recovery tool, not a security product, and decisions about how sensitive client records are stored and who may see them remain entirely your own responsibility.

This page also does not cover, and is not the place to look for, guidance on handling key codes, bitting information, or safe combinations. Those are the kind of sensitive detail you decide for yourself whether to keep on a given machine at all, and this page makes no recommendation either way.

Why this is not the field-service page

This page is not the field-service backup page, even though a locksmith's van and paperwork can look a lot like an HVAC or plumbing contractor's from the outside.

Our backup for HVAC, plumbing & electrical contractors page is built around a recurring maintenance dispatch cycle. A technician gets dispatched, services a piece of equipment, closes out a work order, and the client comes back on a schedule, whether that is a seasonal tune-up or a service agreement renewal. The record that matters most there is the history of visits.

A locksmith's core record works differently. A master key system chart, a client's key and lock inventory, and an access-control fob assignment log are not a maintenance history, they are a permanent per-building system record. There is no seasonal renewal that naturally refreshes or re-confirms them the way a maintenance contract does. The chart you cut in year one is still the chart that governs that building in year fifteen, unless the building's locks are physically changed. That is a different kind of file to protect than a dispatch log, and it is why this page treats the risk differently than the field-service page does.

Where backup gaps hide in a locksmith's shop

A locksmith's shop does not usually lose files all at once. The gaps tend to hide in a handful of specific habits.

• Key-tracking software treated as the only copy. Your key-tracking software, named here only as a software category and not as an endorsement of or a compatibility claim about any specific product, opens and edits your records. It does not by itself guarantee that an independent backup exists somewhere other than the machine it runs on.
• Master key system charts kept in one folder on one computer, never confirmed to be part of any backup routine. A chart that has been correct for ten years is easy to assume is safe simply because nothing has gone wrong with it yet.
• Per-address client files scattered across paper, spreadsheets, and software with no single backed up source. When the record for a given building lives in three places and none of them are backed up, you effectively have zero reliable copies.
• Access-control fob and card assignment logs stored only in the access-control software's local database file. If that database file lives on one machine with no separate backup, losing the machine means losing the record of who was issued what.
• Alarm panel programming records saved once at install and never revisited. A programming record from years ago is often the only documentation of how a panel was actually configured, and it does not get recreated automatically.
• Cloud storage sync mistaken for backup. A synced folder mirrors whatever is currently on your device. If a key-system chart is deleted, corrupted, or encrypted by ransomware, that change can propagate to the synced copy too, often within seconds. See cloud sync versus backup for the distinction.
• QuickBooks file stored only on the shop computer that also holds every key-system chart and work-order history. A single failure on that machine can threaten the entire record set and the accounting records at the same time.
• Backup media kept in the same building it is meant to protect. An external drive sitting next to the computer it backs up offers no protection against fire, flood, or theft affecting the whole shop at once.
• Whoever set up the key system for a longtime client has since moved on. A small locksmith operation is often run by a lean staff, and when the technician who remembers how a given building's system was structured leaves, that knowledge needs to already be written down and backed up somewhere else.

Understanding the 3-2-1 backup rule for a locksmith or installer

The 3-2-1 rule is a straightforward framework promoted by CISA and widely used in small-business backup guidance. Applied to a locksmith's shop, here is what it looks like against the records that actually matter.

A backup standard for locksmith and installer shops

The checklist below reflects CISA small-business backup guidance and FTC small-business cybersecurity material, applied to the file environment of a locksmith or installer's shop. It is a starting framework for backup decisions, not a legal, licensing, or recordkeeping standard.

• Map every machine in the shop. List every Windows computer used for key-tracking, access-control administration, alarm programming records, and accounting. For each one, ask what data lives there that is not copied anywhere else.
• Include your master key system charts explicitly. These are often stored in a folder structure outside your key-tracking software entirely, organized by client address. That folder needs to be explicitly included in your backup configuration rather than assumed to be covered automatically.
• Retain enough version history to reach back through your full client roster. CISA guidance notes that ransomware and accidental deletions are often not discovered for days or weeks, so a short backup window may not reach a clean, pre-incident copy of a file that was quietly damaged earlier.
• Encrypt backup data in transit and at rest. Client key and lock inventories, access-control assignment logs, contracts, and QuickBooks files include contact and account detail for every client on your roster.
• Monitor backup jobs and receive failure alerts. A backup job that fails silently leaves you with no current coverage and no warning, right up until the day a longtime client calls needing a rekey.
• Test restores on a regular schedule. A practical cadence is a quarterly spot restore: pick a master key system chart, a per-address client file, a work order, and a QuickBooks file from different dates, and confirm you can retrieve and open them. CISA's guidance is direct on this point, an untested backup is not a reliable backup.
• Document who handles recovery. Someone in the shop should be able to answer three questions without searching: what is backed up, where does it go, and how do you start a restore.

For a fast two-minute self-check of your current backup posture, take the small-business backup checklist. For general QuickBooks backup practices referencing Intuit's own documentation, see backup for QuickBooks.

Your key-tracking software, access-control software, and QuickBooks: what backup actually covers

Ransomware and the locksmith's shop

The FTC and CISA both publish guidance specifically noting that small businesses, including operations holding years of accumulated client records, are targets of ransomware campaigns, in part because they typically have less dedicated IT support than larger organizations.

For a locksmith or small security installer, the factors that make a ransomware event particularly consequential are straightforward: master key system charts, per-address client inventory, and access-control assignment logs concentrated on one or two Windows machines, a commercial client roster built over years and stored locally, no backed up copy of the folders that hold current system records, and typically no dedicated IT staff checking backup health day to day. Everyday Backups is a data recovery tool, not a security product, and it does not prevent ransomware from occurring in the first place, nor does it promise that your shop can keep working uninterrupted while systems are down.

CISA's #StopRansomware guidance identifies offline and encrypted backup copies as the primary technical recovery path once ransomware has already encrypted production files. A backup connected to the same network as the infected machines, or a sync folder that mirrors changes in real time, can itself be encrypted before the attack is even noticed. A backup that is not continuously mounted on your local network is the copy most likely to come through a ransomware event with your key-system charts, per-address records, and QuickBooks file still usable. For more on what readiness looks like after an attack, see ransomware restore readiness.