PassMatch is a small, closed system on your own LAN. It talks only to the devices you list, accepts nothing from the outside, and never touches the access control system's network.
| Port | Direction | From / to | Purpose |
|---|---|---|---|
| 8080 | In | I/O devices only | Badge counts |
| 1883 | In | Cameras only | People counts |
| 8081 | In | Guard and admin PCs | Live web page (sign-in) |
| 80 | Out | I/O devices and cameras | Alarm pulse, health check, camera reconnect |
| 587 / 465 / 25 | Out (optional) | Your mail server | Email alerts |
Put the cameras, I/O devices and monitor PC on a security VLAN, and allow each port only from the device addresses above (step-by-step firewall rules are in the install guide). Traffic on the LAN is not encrypted today, so keeping it on a security VLAN is the right place for it. Encrypted connections are on the roadmap.
The camera counts people on its own processor, the I/O device counts badge pulses, and the monitor compares them on a local PC. There is no cloud service, no subscription and no outside connection. It keeps working when the internet is down.
The camera sends only numbers, never video. The monitor stores counts and events, not images.
The access control system connects with two dry-contact pairs per door: a spare auxiliary relay out, a spare alarm input in. There's no API, no driver, no integration license and no change to the panel's firmware or network.
That keeps the access control system's cybersecurity boundary exactly as it is, makes IT approval simple, and works with Mercury-based panels and most other panels that have a spare relay and input.
We can install PassMatch on a single door alongside your existing access control, with no changes to how the door works, and show you the tailgates it catches.
