A method, performed by an access controller device, the method comprising: accessing, by the access controller device, a global database that includes access control information for a plurality of access controller devices; deriving, by the access controller device, a local access rules table from the global database, wherein the local access rules table relates users to access rules, wherein the access rules determine whether to grant a user access to a secure area based on an identity of the user, and wherein the local access rules table is encrypted with a local access rules key; deriving, by the access controller device, a local credentials table from the global database, wherein the local credentials table relates hashed credentials to users, wherein the local credentials table stores, for the user, the local access rules key encrypted with unhashed credentials associated with the user, wherein the unhashed credentials are not stored in the access controller device; receiving, by the access controller device, a credentials value from a reader device; determining, by the access controller device, whether a credentials entry exists for a hash of the received credentials value in the derived local credentials table; identifying, by the access controller device, a user associated with the received credentials value based on the derived local credentials table, when the credentials for the hash of the received credentials value exists in the derived local credentials table; decrypting, by the access controller device, the local access rules key, associated with the credentials entry, using the received credentials value; decrypting, by the access controller device, the derived local access rules table using the decrypted local access rules key; determining, by the access controller device, whether an access rules entry exists in the decrypted local access rules table for the user; and executing, by the access controller device, one or more access rules associated with the user based on the access rule entry, when the access rules entry exists for the user in the decrypted local access rules table. accessing, by the access controller device, a global database that includes access control information for a plurality of access controller devices; deriving, by the access controller device, a local access rules table from the global database, wherein the local access rules table relates users to access rules, wherein the access rules determine whether to grant a user access to a secure area based on an identity of the user, and wherein the local access rules table is encrypted with a local access rules key; deriving, by the access controller device, a local credentials table from the global database, wherein the local credentials table relates hashed credentials to users, wherein the local credentials table stores, for the user, the local access rules key encrypted with unhashed credentials associated with the user, wherein the unhashed credentials are not stored in the access controller device; receiving, by the access controller device, a credentials value from a reader device; determining, by the access controller device, whether a credentials entry exists for a hash of the received credentials value in the derived local credentials table; identifying, by the access controller device, a user associated with the received credentials value based on the derived local credentials table, when the credentials for the hash of the received credentials value exists in the derived local credentials table; decrypting, by the access controller device, the local access rules key, associated with the credentials entry, using the received credentials value; decrypting, by the access controller device, the derived local access rules table using the decrypted local access rules key; determining, by the access controller device, whether an access rules entry exists in the decrypted local access rules table for the user; and executing, by the access controller device, one or more access rules associated with the user based on the access rule entry, when the access rules entry exists for the user in the decrypted local access rules table.