Shared Office Security: Is Your Equipment Safe Overnight?
Equipment left in a private, lockable office, inside a building controlled by fob entry and monitored by CCTV around the clock, is about as safe as equipment gets outside your own home. It is not risk free, and any operator who tells you otherwise is selling rather than answering. The honest position is that a shared building moves the risk around rather than removing it, and what protects your kit is a combination of the building’s controls, your own door, your own habits and your own insurance policy.
This page goes through each of those in turn: who can reach which part of the building, what cameras genuinely achieve, who holds a key to your office, what happens when cleaners and contractors are in the building at seven in the evening, and what your contents insurance has to say about a multi-occupancy address. It is the question most buyers ask last and decide on, so it deserves a straight answer rather than reassurance.
Key takeaways
- Access comes in three layers, being the building entrance, the communal areas and your own office door. Most people assume one control covers all three, and it never does.
- Offices here are private and lockable, and an intruder alarm can be fitted to an individual office as an option, which is unusual and worth having for anyone leaving valuable kit or client files behind.
- CCTV records, it rarely prevents, and it never covers the inside of your office. Treat it as evidence after the event, not as a guard.
- The building’s insurance does not cover your equipment. Your own contents policy has to name the risk address and describe a shared building correctly, or a claim gets difficult.
- Fob access is only as strong as the process for cancelling a fob the day somebody leaves.
- Confidential paper is the risk people forget, and it is the one the Information Commissioner’s Office is most likely to ask about.
- Twenty-four hour access is a genuine convenience with a genuine cost attached, and the cost is managed rather than eliminated.
Every office in our building is private and lockable, sits behind fob-controlled entry, and can take its own intruder alarm. Our private lockable serviced offices in Cardiff run from 80 to 1,200 sq ft for teams of 2 to 30, with 24/7 CCTV monitoring, daily cleaning and free on-site parking included. Ring 029 2089 4700 and ask us the awkward security questions before you ask about the rent.
Who administers the system, and is entry recorded
Access systems are administered by the building, not by tenants. That means the operator issues fobs, cancels them, sets which doors each fob opens, and holds whatever record the system produces. Modern fob systems log events by default: which credential opened which door and when.
Two questions are worth asking any operator. Who inside the organisation can add or remove a credential, because a system where four people can quietly issue a fob is a weaker system than one where a single named manager does it. And can you see the log relating to your own door after an incident. The answer to the second is usually yes, on request, and it should be, because you have a legitimate interest in knowing who opened a door you rent.
Fobs, and what happens the day one goes missing
A lost fob is the most common security event in any shared building, and the speed of the response is the whole story. A fob reported lost should be cancelled the same day, not at the end of the week, and a replacement issued against a record of who holds what.
Here that call goes to reception on 029 2089 4700, or to Kay Brook, our Centre Manager, and the credential is deactivated. Because we are independent and owner managed, there is no regional service desk between you and the person who can remove it from the system.
Not the fob that gets lost. It is the fob that never comes back. Staff leave, contracts end, a freelancer finishes a six-week project, and the credential quietly stays live because nobody told the building.
Build fob return into your own leaver checklist alongside the laptop, the door key and the email account, and tell the centre the same day somebody leaves.
We explain the entry system, visitor rules and deliveries in detail on our guide to round-the-clock access at our Cardiff business centre, so this page stays on the risk side of the question. Ask, too, how many credentials come with your office and what a replacement involves, because a business that hires seasonally needs a different arrangement from one with a stable team of four.
What CCTV does, and what it does not
CCTV is an evidence system. It records what happened so that an incident can be investigated, a claim can be supported and, where relevant, the police can be given something to work with. Its deterrent effect is real but modest, and its investigative value is high. Confusing the two leads to a false sense of protection.
- Records shared and external areas around the clock
- Supports an investigation after an incident
- Supports an insurance claim
- Gives the police something to work with
- Deters, modestly
- Cover the inside of your office, and no reputable operator would put a camera there
- Stop anything happening in real time
- Keep footage indefinitely
- Eliminate blind spots, because every building has them
- Hand footage to anyone who asks, because it is personal data
Coverage and retention are two separate questions
Coverage means which areas a camera actually sees. Ask about the entrance, the car park, the corridors serving your floor and any goods or rear access. Ask where the blind spots are, because every building has them, and an operator who claims none has not walked the site with the question in mind.
Retention means how long recorded footage is kept before it is overwritten. There is no single legal figure. The Information Commissioner’s Office guidance on video surveillance asks organisations to keep footage no longer than is necessary for the purpose it was collected for, and the Home Office publishes a Surveillance Camera Code of Practice covering how systems should be operated. What that means practically is that footage has a window, and the window is not long. Report anything you want reviewed immediately rather than a fortnight later, because the recording of a quiet Thursday evening does not wait around for you to notice a missing monitor.
Requesting footage after an incident
The process is worth knowing before you need it. Report the incident to the centre in writing, with the date, the time window and the location as precisely as you can give them. The operator reviews and, where an incident is confirmed, works with you and with the police. Footage is personal data, so it is not simply handed over on request to anyone who asks, and a request routed through the police after a crime number is issued is usually the cleanest path.
The practical lesson from all of this is unglamorous. Cameras help you afterwards. Locks, alarms and habits help you beforehand.
Your own door, master keys and the alarm option
Yes, your office door locks, and yes, somebody else holds a means of opening it. That is true in every managed building in the country, and an operator who tells you otherwise is either wrong or has a fire safety problem.
The reason is practical. The building has legal duties around fire safety, and emergency services need access. Maintenance happens. Water gets in. A tenant locks themselves out at eight in the evening. A managed building without emergency access to its own rooms is not a safer building, it is a building where a burst pipe runs all weekend.
The master key question, answered directly
- Who holds emergency access, by name or by role?
- Is its use recorded?
- Will you be told when somebody has entered your office, and how quickly?
- Are there circumstances short of an emergency where staff enter, for example to read a meter or attend to cleaning, and can those be scheduled or declined?
A good operator will answer all four without becoming defensive. The warning sign is not a master key. The warning sign is an operator who cannot tell you who holds it.
The optional intruder alarm, which is the answer most people are looking for
An intruder alarm on your own office door is available here as an option, and it is genuinely the strongest control available to a tenant in a shared building. It changes the picture in a way nothing else does, because it puts a detection layer inside your own space rather than around it.
Think about what that means for a two-person design studio with three high-specification desktop machines, two large monitors and a drive array sitting on a shelf. Building entry stops the casual visitor. CCTV records the corridor. Neither of those does anything about somebody who is legitimately inside the building and tries a door handle at nine on a Sunday evening. An alarm on that door does, and it does it at the exact point where the value sits.
It is also the control insurers care about. Many contents policies for business equipment carry conditions about minimum protection, and being able to state that your own office is separately alarmed can affect both what is offered and what it costs. Ask your broker before you dismiss the option as unnecessary.
Walls, ceilings and the space above them
One physical detail is worth checking on a viewing, and it is the one almost nobody checks. Do the partitions between offices run to the structural ceiling, or do they stop at a suspended ceiling with an open void above. A void that runs between two offices matters for sound, for privacy of conversation and, at the margin, for physical security. Stand in the room and listen. Ask the question. It costs nothing and it tells you a great deal about how the building was fitted out.
Leaving desktops, servers and monitors overnight
Here is the real scenario. It is nine in the evening. Your office holds four desktop machines, six monitors, a small server or network drive, a printer, two docking stations, a box of spare laptops and a filing cabinet with client papers in it. Nobody from your business is in the building. Somewhere in the same building, other people are working, and cleaners have been through the corridors.
Two are uncommon. Four are realistic. Two are the ones that actually happen most.
- Uncommon, 2 of 8
- Realistic, 4 of 8
- Happens most, 2 of 8
Scroll the table → hover any row to focus it
| The risk | What reduces it | Why it sits where it does |
|---|---|---|
| Desktops and monitors takenUncommon | A locked door in a fob-controlled building | Bulky, hard to remove unseen, low resale value |
| Server or drive array takenUncommon | An intruder alarm on your own office door | Same reasons, but the data loss would be severe |
| Laptop left in a communal areaRealistic | Nothing portable leaves your office unattended | The middle layer is open to everyone with legitimate access |
| Papers read rather than removedRealistic | Locked cabinet, clear desk, locked waste console | Loss of information, not loss of hardware |
| A fob that never comes backRealistic | Fob return on your leaver checklist, told to the centre same day | Nobody notices a credential that quietly stays live |
| Tools or kit from a vehicleRealistic | Nothing visible, tools indoors overnight rather than in a van | A persistent problem for trades across South Wales |
| A door left on the latchHappens most | Lock it every time, including for a ten-minute coffee | The single largest cause of loss in shared buildings |
| Tailgating at the front doorHappens most | Staff who let the door close, visitors sent to reception | No fob system stops a polite person holding a door open |
What actually reduces the risk
Four things do most of the work, and none of them are expensive. Lock the door every time, including for a ten-minute coffee. Move the small, valuable and portable out of sight: laptops go in a drawer or a cupboard, not on the desk facing the glazed panel in the door. Encrypt everything and make the loss of a device boring, because a stolen encrypted laptop is a hardware claim while a stolen unencrypted one with client records on it is a reportable personal data breach. And take the alarm option where the contents justify it, then tell your insurer you have.
Laptops go home in bags every night. Their overnight exposure is a printer and some furniture, and the alarm option would be money spent on an empty room.
Two workstations that cost more than a car each, plus a drive array holding project data going back nine years, none of which is going home in anybody’s bag. Same building, same controls, completely different answer.
Both of those teams fit in the same corridor here. Our two-person offices in Cardiff are private rooms with their own lockable door rather than desks in a shared room, which is the distinction that decides everything above once the kit stays behind at night.
Who else is in the building when you are not
Daily cleaning of offices and communal areas is part of what the building provides, and cleaning is done by people who are in your office when you are not. That is true of every serviced building and every managed office in Britain, and pretending otherwise helps nobody.
What makes it acceptable is process. Cleaning happens to a known schedule rather than at random. The people doing it are employed or contracted by the building rather than being strangers with a fob. Contractors who are not regulars are signed in, and where work is out of hours somebody knows they are on site.
Questions worth asking any operator: when do cleaners work, are they the same team week to week, are they vetted, and can I ask for my own office to be cleaned only when somebody from my business is present. That last request is entirely normal for solicitors, accountants, healthcare businesses and anyone else holding sensitive files, and a sensible operator will accommodate it. Some tenants take it further and keep their own office off the cleaning round altogether, emptying their own bins and taking their own confidential waste to a locked console.
Does 24 hour access make the building less secure at night?
It changes the risk rather than adding to it, and the trade-off is worth stating plainly. A building open only from eight until six has a simpler security position, because for fourteen hours nobody legitimate is inside. A building with 24/7 access has people who are entitled to be there at unusual hours, and that means the front door has to work harder.
- Reception staffed Monday to Friday, roughly 8:30am to 4:45pm, which is when visitors, deliveries and contractors arrive. The busiest and most exposed part of the day is the part with a person watching the door.
- Tenants working late and cleaners on a known schedule. Everyone here is entitled to be, and the middle layer is at its most open.
- Fob-controlled entry and CCTV monitoring only. Nobody walks in behind a queue of arriving staff, because there is no queue.
We would rather be honest about it than pretend. Twenty-four hour access exists because businesses need it: a team shipping a tender at midnight, a consultant back from Bristol at ten, an accountant in at six during the January filing run. The cost of that freedom is that the building can never rely on being empty, so it relies on controls instead. A business that wants both should take the alarm option and lock its door.
Insurance: the building’s cover does not cover your kit
This is the paragraph most tenants skip and later wish they had not. The building’s insurance covers the building and the operator’s own liabilities. It does not cover your computers, your furniture, your stock, your tools or your data. Your equipment is your risk, and it needs your own contents policy.
Wrong pictures are how claims get argued about
- The risk addressWritten as it appears on your licence, with the building described accurately as multi-occupancy or shared. An insurer told you occupy a self-contained unit when you rent one room in a shared centre has been given the wrong picture.
- The protectionsPolicies for business equipment commonly carry conditions about locks, alarms and how the premises are secured when unattended. A condition requiring an alarm to be set is a condition, not a suggestion.
- The limits and the excessWork out the real replacement cost of everything in the room, then check whether the policy pays new for old or on an indemnity basis after depreciation. Check whether laptops are covered away from the premises, because most of your equipment leaves the building most nights. Check whether business interruption is included.
Public liability is a separate matter and covers injury or damage to third parties, which becomes relevant the moment clients visit your office. Employers’ liability insurance is a legal requirement for almost every business with employees under the Employers’ Liability (Compulsory Insurance) Act 1969, and that duty follows you into a serviced office exactly as it would into your own premises. Our note on what a fully managed business centre handles for tenants sets out where the building’s responsibilities end and yours begin.
“Highly competent and professional service always given.”Tenant testimonial, Alexandra Gate Business Centre
Security in a shared building is mostly a competence question. The controls are ordinary and widely available. What differs between buildings is whether somebody cancels a fob on the day it is reported, and whether the person you ring can walk to the comms room.
Paper, confidential waste and the duties that follow you in
Moving into a shared building changes nothing about your obligations under UK GDPR. You remain the controller of your clients’ personal data, the Information Commissioner’s Office remains your regulator, and a breach caused by a document left on a communal printer is your breach, not the building’s.
Paper is where shared buildings bite. A printer in a corridor, a bin under a desk, a stack of files on a shelf visible through a glazed door, a whiteboard with a client name still on it. None of these look like security incidents until one of them is.
What good handling looks like
Keep confidential paper in a locked cabinet inside a locked office, not in an open tray. Use a locked confidential waste console rather than a desk bin, so that the moment a document is finished with it is out of reach. Where you shred in-house, use a cross-cut machine rather than a strip-cut one, and where you use a waste contractor, ask which standard they destroy to, because BS EN 15713 is the recognised standard for the secure destruction of confidential material in the UK.
Ask for a certificate of destruction and keep it. It is a single sheet of paper that proves the chain ended properly, and it is exactly the sort of evidence an auditor or the ICO will want to see when they ask how you dispose of client records. Businesses under professional regulation, and anyone certified to ISO 27001, will need it as a matter of routine.
Set a clear desk habit for the end of the day. It sounds like the sort of policy nobody follows, and in a two-person office it takes ninety seconds. Nothing sensitive on a desk, nothing sensitive on the printer, nothing sensitive on the whiteboard.
Digital duties in a shared space
Cyber Essentials, the UK government-backed scheme overseen by the National Cyber Security Centre, sets out five controls that sit entirely inside your office regardless of the building: firewalls, secure configuration, user access control, malware protection and keeping software updated. Screens facing a glazed door should be turned or fitted with a privacy filter. Screen locks should engage in minutes, not hours. And a notifiable personal data breach has to reach the ICO within 72 hours under UK GDPR, which is a deadline that arrives quickly when the incident happened on a Friday evening.
Visitors, tailgating and the front door
Tailgating is the technical term for somebody following an authorised person through a controlled door, and it is the most common way an access system gets defeated anywhere. No fob system in the world stops a polite person holding a door open for someone carrying a box.
The defences are cultural more than technical. Staff who are comfortable letting a door close behind them. Visitors who go to reception rather than being waved through. A sign-in record, which matters for security and matters more for fire safety, because the Regulatory Reform (Fire Safety) Order 2005 requires a responsible person to account for everyone in a building during an evacuation, and you cannot account for a visitor nobody logged.
Reception here is staffed Monday to Friday, typically 8:30am to 4:45pm, which covers the period when almost all visitors, couriers and contractors arrive. Meet your own visitors at reception rather than sending directions to your office door, and collect deliveries rather than leaving them in a corridor. Both habits take a minute and remove the two most common ways a stranger ends up standing outside your office unaccompanied.
Brief your own team on the awkward part: what to do about somebody in the corridor they do not recognise. The answer is not to challenge them aggressively. It is to say good morning, ask who they are visiting, and tell reception. Buildings where people do that are noticeably harder to walk around.
The car park
Free on-site parking removes a security question most city centre buildings leave unanswered, which is where your team’s vehicles sit all day and what is inside them. A car park attached to the building, used by tenants and visitors, is a different proposition from a public multi-storey or a street bay two streets away.
The rules are the ordinary ones and worth repeating because tool theft from vehicles is a persistent problem for trades and site-based businesses across South Wales. Nothing visible on a seat. Laptops out of boots before you arrive, not after you park. Tools and sample cases indoors overnight rather than left in a van.
Ask on a viewing whether the car park is covered by the camera system, how it is lit after dark, and whether access is shared with the public or restricted to the building.
What to ask any operator before you sign
Take this to every viewing you do, ours included. The answers separate buildings far more sharply than the photographs do.
- Which doors does my fob open, how many credentials come with the office, and how quickly is a lost one cancelled?
- Who can issue and revoke access credentials inside your organisation?
- Which areas do the cameras cover, how long is footage kept, and what is the process for requesting it after an incident?
- Does my office have its own lock, who holds emergency access, and is its use recorded?
- Can I fit an intruder alarm to my own office, and what does it connect to?
- When do cleaners work, are they vetted, and can I ask for my office to be cleaned only when we are present?
- Are out-of-hours contractors signed in and escorted?
- Is there a locked confidential waste service, and is a certificate of destruction issued?
- What does the building’s insurance cover, and what am I expected to insure myself?
- Do the office partitions run to the structural ceiling?
A building that answers all ten comfortably has thought about this before you asked, and that is worth more than any single feature on the list. Our full checklist for viewing a Cardiff office covers the rest of the building on the same basis.
Three things that protect the kit here
Frequently asked questions
Is my equipment safe if I leave it in a shared office overnight?
In a private, lockable office inside a fob-controlled building with CCTV monitoring, yes, in the ordinary sense, and thousands of businesses do it every night without incident. The residual risk is mostly about small portable items and about information rather than large hardware, so lock the door, keep laptops out of sight, encrypt them, and consider an intruder alarm on your own office where the contents justify it. Your own contents insurance is the backstop, and it needs to describe a shared building accurately.
Does anyone else have a key to my office?
Yes. The building holds emergency access, as every managed building does, because fire safety, maintenance and lockouts require it. The useful questions are who holds it, whether its use is recorded, and whether you are told when your office has been entered. Ask those three directly and judge the operator on how comfortably they answer.
How long is CCTV footage kept?
There is no fixed legal period. The Information Commissioner’s Office asks organisations to keep footage no longer than necessary for the purpose it was collected for, so retention windows are typically short and vary by building. The practical consequence is the important part: report anything you want reviewed straight away rather than weeks later.
Does the building’s insurance cover my computers?
No. The building’s cover protects the building and the operator’s own liabilities. Your equipment, furniture, stock and data are yours to insure through your own contents policy, and that policy needs the correct risk address, an accurate description of a multi-occupancy building, and protections that match what you actually do at night. Check the excess, whether cover is new for old, and whether laptops are covered away from the premises.
Can I get an intruder alarm just for my own office?
Yes, that is available here as an option on individual offices, and it is the single strongest control a tenant can add in a shared building. It is worth taking seriously by anyone leaving high-value equipment, physical client files or regulated data in the room overnight, and it is worth mentioning to your insurance broker, because separate alarm protection can change what a policy offers.
Four more things a viewing should settle
Security you can inspect before you commit
The right way to judge a building on security is to walk it and ask. An operator with nothing to hide will happily spend twenty minutes on this, and the ones who rush you are telling you something.
- Stand at the front door and watch how people come through it
- Look at where the cameras point
- Open your office door, look at the lock, look up at the ceiling
- Ask who cleans it and when
Independent and owner managed since 2005, which means the people answering these questions are the people who make the decisions. Ring 029 2089 4700 and ask us anything on the list above.
