I Almost Bought Palm Scanners for Every Door. Here's Why I Didn't.

About the business

I run a professional services office of about thirty people. One main door, a back door, a storage room full of client files, and a small room with our network equipment. For years, all of it ran on metal keys.

The problem: three options and no clear answer

When I decided to replace the keys, I ran into three kinds of access control. Cards you tap (NFC). Codes you scan (QR). And palm vein scanners that read the pattern of veins inside your hand. Every seller said theirs was the one I needed. I couldn't tell which one I actually did.

My first instinct was palm scanners on every door. It sounded the most secure.

Then I asked myself two questions, and the answer changed.

What we decided: the right method for each door

Question one: can the credential be lent to someone else? A card can. A QR code can. A palm can't, because it belongs to one person. That's a real advantage, but it only matters on doors where lending is a real risk.

Question two: what do I owe people before I collect it? A palm scan is biometric data. Illinois requires written notice, a signed release, and a published policy on how long you keep the data. Texas requires notice and consent. Several other state privacy laws treat biometric data as sensitive and require opt-in consent. Illinois's law doesn't name palm veins specifically, but it doesn't rule them out either, so I chose to treat palm vein as biometric and take written consent. That means paperwork, a retention period, and a plan to delete someone's data when they leave. (General information, not legal advice.)

Worth it for the right door. Not for every door.

So here's how we split it:

Door	Method	Why
Main and back doors	Card or phone tap (NFC)	Fast, cheap, a lost card is switched off in the software
Visitors	QR code	No card to hand out or collect
Client file room	Palm vein	A lent card here would actually hurt
Network room	Palm vein	We need to know exactly who went in

Only the staff who need those two rooms are enrolled, and each of them signed a consent form.

The result: strong where it matters, simple everywhere else

Most of the office never touches a palm scanner or signs a biometric form. The few who work in the sensitive rooms know exactly why they're enrolled. Lost cards get switched off in software. We spent on strong security only where a lent credential would cause real damage.

Had I put palm scanners everywhere, I'd have spent more, collected biometric data from thirty people who didn't need to give it, and gained very little at the front door.

If you're weighing this yourself, the right answer depends on the space. A coworking space does fine with NFC and QR. A gym has a sharing problem that a personal credential solves. A server room needs an audit trail. And no credential at all, palm included, stops someone walking in behind you.

If you're leaning toward palm vein, read what has and hasn't been independently tested before you trust any accuracy number.