Adding Facial Authentication to Genetec, LenelS2, C•CURE, or Genea

The question that kills most campus biometric conversations isn’t privacy and isn’t price. It’s the quiet operational one: “We run twelve hundred doors on our access control system. Are you asking us to replace it?”

The answer that keeps the conversation alive: no — the Rock presents to Genetec, LenelS2, Software House C•CURE, and Genea as a standard reader over Wiegand or OSDP, so facial authentication arrives as one more credential inside the system you already run, and your panels, policies, schedules, and badge fallback stay exactly where they are. This post walks the integration the way your ACS administrator will interrogate it.

What does the ACS actually see?

A reader. When an enrolled person authenticates — a 3D, liveness-checked, one-to-one match completed on the device in under a second — the Rock passes a standard credential to the panel, exactly as if a card had been presented. The ACS applies the same door schedule, the same access level, the same alarm logic, and writes the same event record it always has. Nothing about the panel firmware, the head-end software, or the operator workflow changes; the meaning of the event upgrades from “a card was read” to “a person was verified,” and the system carrying it doesn’t need to know the difference. Enrollment, consent, and device management live in the Alcatraz Platform alongside — cloud or on-premises — without touching cardholder data in the ACS. The architecture walkthrough has the full diagram.

How does each platform pairing work?

Genetec Synergis — the Rock joins as a reader within the unified platform; door events and tailgating flags land in the same operational picture your SOC already watches. LenelS2 OnGuard — a certified integration (2025), the pairing common at large institutions with deep OnGuard estates; existing access levels and segments apply unchanged. Software House C•CURE — enterprise deployments keep their clustering, partitions, and event routing; the Rock is a reader object like any other. Genea — the cloud-native pairing, where a cloud-managed reader fleet and a cloud ACS make the all-remote administration model complete. In every case the wiring is the familiar kind — Wiegand where that’s what the door has, OSDP where you want supervised, encrypted reader communication (specify Secure Channel where your panels support it, the same hygiene you’d apply to any reader refresh).

What does deployment actually involve?

Per door: mount the Rock (or Rock X outdoors — IP66, IK08, −40°F to 150°F, so the perimeter and garage doors are in scope), land the Wiegand or OSDP wiring on the existing panel, and configure the door’s authentication mode in the platform — face-first, face-plus-badge two-factor for high-assurance rooms, or badge-only as the untouched fallback. No panel replacement, no head-end migration, no re-badging event. Rollouts sequence door by door for exactly this reason: wave one goes live while the other eleven hundred doors run untouched, per the roadmap.

What are the honest gotchas?

Three, and naming them saves a site visit. Legacy Wiegand carries no supervision or encryption on the wire — it works, but if the refresh budget allows, moving those doors to OSDP is worth folding in. Door hardware and code requirements (fire egress, ADA operators) are unchanged by the reader but still govern the opening — survey before scheduling. And the biometric layer adds a consent and policy workstream that the ACS never had — enrollment communications, the consent form, and the governance in the playbook run in parallel with the wiring, not after it.

Bring your panel inventory and door count to a demo — the 30-minute working session with an access control engineer exists for precisely this conversation.

Frequently asked questions