Unstaffed Gym Hours: What Has to Be True Before You Unlock the Door

The appeal of unstaffed gym hours is easy to say out loud. You sell more memberships without paying anyone to sit at a desk at 5am. The building earns its rent for twenty-four hours instead of twelve.

The fear is just as easy to say, and most owners say it quieter. What happens when nobody's watching?

That fear is the whole reason this post exists. Going staffless isn't a switch you flip because the software has a 24/7 setting. It works when a short list of things are true, and it goes sideways when you assumed one of them and it wasn't.

So before you hand out the first fob, walk the checklist. This is the honest version, including the parts where the answer is "you need a camera, not just a credential."

A quick note on lanes. If you're still deciding whether to go extended-hours, start with the 24-hour gym pros and cons. If the thing keeping you up is liability and the 3am medical emergency, that's its own subject, with its own guide linked at the bottom.

This post is the operational layer: the preconditions for 24/7 gym access control that have to be working before you trust the door to run itself. For how the hardware and the software fit together in the first place, see our guide to gym access with smart locks.

Precondition 1: The Door Reads Your Roster

Here's the one that separates a real unstaffed system from a fancy lock.

When you're at the desk, you are the access control. Somebody who froze their membership last week walks in, you notice, and you have a conversation.

Nobody's at the desk anymore. The door has to make that call, and it can only make it if it's reading the same membership list you are.

That means access follows membership status automatically. A member freezes, cancels, or lapses, and the credential stops working on its own. No manual step, no fob to go deactivate in the morning, no window where a former member still walks in at 11pm because you didn't get to it.

This is the piece most gyms get wrong, and it's usually not the hardware's fault. It's that the door and the billing system are two separate worlds that don't talk.

Somebody cancels, the payment stops, and the fob keeps working until a human remembers to kill it. In a staffed gym that's an annoyance. In an unstaffed one, it's your access control quietly failing open.

With Gymdesk access control, the door is bound to membership status directly. When a member is no longer active, the door doesn't open. There's nothing to remember.

The one caveat worth getting exact

This is the single most-asked question, so the answer has to be precise. A frozen, cancelled, or lapsed membership stops the credential automatically, and that part is true today. When a member's card declines and their membership eventually lapses because the payment never went through, the door follows them out.

What you shouldn't promise yourself is a same-day lockout the instant a single payment fails midcycle. That's a stricter behavior, it's on the roadmap, and building your policy around it before it ships is how you get surprised. Assume access follows the membership, and set your billing and grace-period rules with that in mind.

Precondition 2: Every Entry Has a Name on It

You hand out a keypad code. Three months later it's on a group text and twelve people have it.

That's the classic failure of shared access. There's no record of who came and went, so when something happens overnight, you're scrubbing two hours of grainy footage trying to reverse-engineer a name.

The fix is per-person credentials. Every member gets exactly one, and every entry is attributed to that specific person. One fob, one member profile, one identity on every tap.

When a member loses a fob, you kill that one fob and re-issue it without touching anybody else's. When you need to know who was in the building at 2:14am, you pull a list instead of a tape.

That attribution is also your evidence. If an incident turns into a dispute or a legal matter, "here is the timestamped entry log tied to a member identity" is a very different position than "we think it was probably him."

Precondition 3: It Still Works When the Internet Doesn't

Your internet will go down. Probably not often, but the one time it matters is 3am on a Saturday when nobody's there to reboot the router and a member is standing in the cold holding a fob that isn't opening anything.

Ask the hard question before you commit to a system: what does the door do when the connection drops?

This is the argument for physical fobs over phone-based unlock, and it's a real one. A good controller caches your member list locally. When the internet drops, the fobs keep working off that cached list, because the door doesn't need to phone home to check.

Rhombus handles this with the DC20 controller, which stores the roster on-site and keeps validating taps through an outage.

App-based unlock can't do that. A phone credential needs connectivity to talk to the system, so when the network's down, so is the door.

That's fine as a convenience layer for members who prefer their phone. Just don't make it the thing standing between a member and a locked door at 3am.

The short version: issue fobs as your baseline even if you love the phone option, because fobs are the credential that still works when the network doesn't.

Precondition 4: You've Decided What You're Doing About Tailgating

This is the precondition owners most want to skip, because the answer is a little uncomfortable.

Tailgating is when one member taps in and a second person walks in behind them on the same open door. And here's the part nobody selling you a fob system wants to lead with: no credential stops it. Not a fob, not a phone, not a keycard.

The tap was legitimate. The system did its job. A second body just came through the door.

You have two real ways to handle it, and you should pick one on purpose.

Option one: Set the norm

Signs at the door, a line in every member orientation: don't hold the door for anyone, even someone you recognize. Members respect this once they understand they're protecting each other, and for a lot of gyms it's a reasonable place to land.

But be clear-eyed. It's an ask, and a member can nod at the sign and hold the door anyway.

Option two: Add a camera

Detecting tailgating is the one job a credential can't do. A camera at the door counts the people per tap and flags the mismatch when two go in on one entry.

With Rhombus, that's either a reader with a built-in camera or a dome camera at the door. The alerts land in your Rhombus console with a video license, a separate add-on from the base door kit, and priced like one.

The base kit buys per-person accountability. The camera is what detects tailgating. Decide which one you need before you launch, not after an incident makes the decision for you.

Precondition 5: The Safety and Liability Side Is Handled

Everything above is about the door. It is not the whole story, and I'm not going to pretend it is here.

The moment you run unstaffed, you inherit a second set of questions that have nothing to do with credentials.

Does your insurance actually cover unstaffed hours? Does your waiver have language built for 24/7? What's your runbook when a member goes down at 3am and the only other people in the building are two strangers and a phone?

That's a real body of work, and it has its own home. We wrote the full playbook in run a 24-hour gym safely: insurance, waivers, monitoring, and the 3am emergency runbook.

If you're standing up unstaffed hours, read it alongside this one. Access is one precondition. Safety is the other, and you don't get to pick just one.

What 24/7 Gym Access Control Actually Costs

Owners want a number, so here's a real one, caveats attached.

The numbers

Ongoing, access control runs $100 a month for up to three doors, then $29 a month per device after that. The bigger line is upfront: hardware plus professional installation, which for a single door lands somewhere around $3,100 to $3,400 all-in (estimate; your real number depends on the site and the installer's bid).

One buy-side caveat before you order hardware. Modern readers, Rhombus included, read 13.56 MHz NFC fobs, and a lot of older gym fobs are 125 kHz, which won't work.

Owners assume they can reuse the fobs they already have, and plenty can't. Check the frequency on day one, not after the hardware ships.

I won't hand you an install date, either. Installers book out a few weeks and it varies by region, so anyone promising you a specific go-live is guessing. Plan for a few weeks from bid to install and you'll be about right.

What the price actually buys

Enterprise hardware without the enterprise IT desk to keep it running. It's the same access platform that runs 24 Hour Fitness, and it's rated #1 in Physical Security on G2 with a 10-year warranty. Installation is found, bid, and scheduled through Rhombus's installer network, so nobody at your gym touches a screwdriver.

The other thing you're buying is one accountable path. The software is Gymdesk, the hardware is Rhombus, one system with one place to call when something breaks.

That matters more than it sounds like it should. The horror stories in this category are almost always three vendors pointing at each other while a door sits broken: the gym's software company, the lock company, and whoever installed it, none of them owning the problem. One system, one support path is the thing you're actually paying to avoid.

Run the Unstaffed Gym Hours Checklist Before You Unlock the Door

Unstaffed hours are one of the better moves in the business right now. They're also the kind of move where the failures are quiet until they're loud.

So don't launch on vibes. Launch when the door reads your roster, every entry has a name on it, the thing keeps working when the internet doesn't, you've made a decision about tailgating, and the safety side is handled.

That's the checklist. Five things true, then you flip the switch.

When you're ready to price it out for your building, Gymdesk's access control is where to start.