Somewhere in your phone there is a door code that belongs to someone you no longer talk to.
Maybe it's the cleaner who moved away eighteen months ago. Maybe it's the one who stopped answering after a disagreement about a Saturday turnover. Maybe it's the friend-of-a-friend who covered a single week while your regular cleaner was sick. You gave each of them the same thing: a four- or six-digit number that opens a home where strangers sleep. And unless you did something deliberate afterward, every one of those numbers still works.
Most hosts never decide to leave those codes active. They just never decide to remove them. That difference is the whole article.
The code you never revoked
Think about how a cleaner's access begins. There's a reason, a moment, and a clear owner of the decision: I need someone to get in on Thursday, so I'll set up a code. It's a deliberate act with urgency behind it.
Now think about how it ends. Usually it doesn't. The cleaner just stops showing up. There's no event, no meeting, no email that says "your access is now closed." The relationship fades, and the code sits there, unremarked, doing exactly what it was set up to do.
This asymmetry is the problem. Granting access has a trigger. Removing it has none.
Why we leave things the way they are
Behavioral economists William Samuelson and Richard Zeckhauser documented what they called status quo bias in 1988: people disproportionately stick with whatever the current arrangement is, even when changing it would cost almost nothing. The existing state quietly becomes the default, and a default feels like a choice someone already made.
For door codes, that means an active code feels settled. Deleting it feels like a new action with new risks: what if the cleaner is actually still working for me? What if I lock out the wrong person on a turnover day? Leaving it feels like doing nothing, and doing nothing never feels like a decision.
There's a second force at work. Hosts tend to think of cleaners the way they'd like to think of them: as trustworthy, because the alternative is uncomfortable. Revoking a code can feel like an accusation, even when it's purely administrative. So we avoid the small social awkwardness and absorb a larger, invisible risk instead.
Security professionals have a name for the fix. It's called the principle of least privilege: any person should have the minimum access needed to do their job, for only as long as they need it. It's standard practice in how organizations handle employee accounts, and for the same reason. Access that nobody is tracking is access nobody is watching. And most of the time, the person holding it isn't a threat. The risk is the chain: a code that was shared with a helper, written in a text thread, saved in someone's notes app, or passed to a partner who didn't ask permission.
What actually goes wrong
Nobody needs a horror story to make this real. The realistic problems are quieter.
- Shared codes blur accountability. If three people use one code, and something goes missing or an unscheduled entry happens, you can't tell who it was. Most smart lock apps log by code, so a unique code per person is what makes the log meaningful.
- Old codes travel. A cleaner who used to work for you may now work for someone else, and the code in their phone is still live. Not malicious, just unmanaged.
- Guests and cleaners overlap. A code that stays active during a stay can mean a cleaner walks in on a guest who booked the late checkout you forgot about.
- You can't answer the simple question. "Who can get into this house right now?" If you can't answer it in under a minute, you're relying on memory, and memory is the least reliable lock you own.
Build access around the assignment, not the person
The fix is not a tougher mindset. It's tying access to something that already has a beginning and an end.
The cleanest version is to treat each code as belonging to a job, not a person. A cleaning assignment has a property, a window, and a cleaner. When the window closes, so does the access. Many smart locks (August, Yale, Schlage, and others) support codes with start and end times, so you can issue one that works for the Thursday turnover and then stops.
For recurring cleaners, you won't schedule a new code every week, and you shouldn't have to. Instead, give the code a fixed review date. The code isn't permanent; it's renewed on a schedule, which flips the default. If you do nothing, it lapses. That's status quo bias working for you instead of against you.
A few principles hold up across lock brands:
- One code per person, per property. Never share.
- Name every code with the person and the date it was issued. "Maria – issued March" tells you far more than "Code 3."
- Set a review date when you create it. Not when you remember to.
- Retire the code the same day the relationship changes. Not when you get around to it.
Making the removal less awkward
Part of why revoking feels uncomfortable is that there's no ritual around it. You can create one.
When a cleaner stops working with you, whether they quit, you part ways, or a season ends, send a short, plain message: "Thanks for everything. I'm closing out your access to the property today as I do with everyone who finishes a stint. Let me know if you ever want to pick it back up." It tells them this is routine, not personal. Because it is.
If you tell every cleaner at the start that codes are reviewed on a schedule, the end of the relationship needs no explanation at all. You've already said how it works.
Your next moves
- Open your lock app today and list every active code for every property. For each one, write down who it belongs to. Any code you can't attribute to a specific, current person gets deleted first.
- Delete codes belonging to anyone who isn't on your calendar this month. If you're wrong, reissuing takes two minutes. If you're right, you just closed a door you didn't know was open.
- Rename the remaining codes with a person and an issue date. If your lock only allows numeric labels, keep a one-page note outside the lock app with the same information.
- Set a recurring calendar reminder, every quarter, titled "Review door codes." Ten minutes, each property, same checklist. The reminder is the trigger that removal never had.
- Tell your current cleaners the policy now. One text: "I review lock codes every quarter and reset them when someone stops working with us. Nothing to do on your end." Done before it's ever needed.
Where this fits in the bigger picture
Access is one of those details that only gets attention when something is already wrong, and by then the conversation is expensive. The hosts who sleep well aren't the ones who trust more or less. They're the ones with a clear, current picture of who is assigned to which property, and what they're expected to do there.
That clarity is what we built Stayput around. Each property has its own cleaner, its own SMS thread, its own photo confirmation at the end of a turnover, and its own restock alerts, so the question "who is working this house right now?" always has a visible answer. It doesn't operate your locks, but it gives you the roster that tells you which codes should exist. If you'd like to see how that looks for a few properties, you can take a look at Stayput. And if not, the quarterly code review above will do most of the work on its own.