EVVA Doesn't Sell Locks. It Sells a Hierarchy.

The Vienna locksmith has spent more than a century selling ministries, hospitals, and airports something no catalog lists: a physical map of institutional authority.

Most organizations describe authority in documents. Org charts show reporting lines. Policies define permissions. Job titles signal responsibility.

But those structures matter only if the organization can turn them into rules about what people are actually allowed to do.

EVVA discovered that a master key system can make that hierarchy physical. A director may open every door. A department head may open one wing. An employee may open only the rooms required for the job.

The lock is the hardware. The real product is the institution's chain of command, rendered in brass and patented geometry.

Case Study: How EVVA Turned an Org Chart Into Physical Infrastructure

In 1919, a small precision-engineering workshop in Vienna registered itself as Erfindungs-Versuchs-Verwertungs-Anstalt, the Invention, Experimentation and Application Institute.

EVVA, as the acronym became known, had no grand theory of competitive advantage. It made cylinder locks.

But the company's own history traces a family business that gradually discovered a more durable principle: the deepest advantage in security hardware is not the lock. It is the map of who is allowed where.

The first validation came in 1937, when EVVA patented a new cylinder padlock. The momentum did not last. Decades later, the company found itself fighting for survival, with roughly 170 jobs at stake.

Its rescue came from an unlikely source. Nikolaus Bujas, the 63-year-old head of rival Gebrüder Grundmann, left the family company where he had spent four decades to take over EVVA.

With his son-in-law Sven Berlage running operations alongside him, Bujas doubled EVVA's turnover within five years.

The strategic insight that defines EVVA today emerged gradually.

By the 1970s, the company was using computer programs to calculate and control increasingly complex master key systems. Locksmithing was becoming an information-architecture problem, not simply a metalworking one.

A master key system is designed to reflect an organization's hierarchy. A facility director might open every door in a hospital while a night-shift cleaner can open only those required for the job.

The cylinder is only the mechanism. The real product is a map of who can go where.

That distinction matters because an institution's access system becomes intertwined with its authority structure.

Every cylinder participates in the same hierarchy of master and sub-master keys. Change the system, and the organization must preserve the underlying map of who should have access to what.

The deeper EVVA becomes embedded in an organization, the more its hardware starts behaving like governance infrastructure.

That helps explain where its systems end up.

EVVA designs master key systems for complex environments where different people need different levels of access. Its security systems are used across settings including hospitals, airports, and government facilities.

In environments like these, access is not simply a security decision. It is an expression of authority: who can enter, who cannot, and who has permission to move across boundaries others cannot.

The financial expression of that model is steady rather than spectacular.

EVVA's sustainability reporting shows group revenue rising from €85 million in 2022 to €98 million in 2024, alongside growing demand for electronic access solutions.

The company now operates across international markets while continuing to develop both mechanical and electronic access systems.

EVVA has spent decades changing the technology without changing what the technology represents: an institution's hierarchy of access.

Family continuity reinforced that strategy.

Stefan and Nicole Ehrlich-Adám have led EVVA together since the late 1990s, following generations of family leadership before them. Nicole had already worked alongside her father and grandfather, creating an overlap across three generations.

That continuity mirrors the product itself. A master key hierarchy designed under one leader may still need to make sense decades later to employees who never met the person who approved it.

EVVA's paradox is that nobody sets out to buy an organizational hierarchy. Customers think they are purchasing locks and burglary resistance.

What they are really buying is a physical encoding of their own org chart.

Once installed across an institution, that map can outlast the executives, facilities managers, and committees that commissioned it.

The hardware changes. The people change. The hierarchy remains legible.

That is a different kind of legacy: not simply building a product that lasts, but building one that becomes part of how an institution defines authority itself.

From Products to Encoded Authority

1. Sell the Hierarchy, Not the Tool

Most vendors sell a product and let customers build their own hierarchy around it. Okta goes deeper by connecting roles to the applications, resources, and privileges each person can access.

The software becomes a working map of who is trusted to do what.

That changes the nature of the product. It no longer sits alongside the organization. It reflects the organization's own boundaries of authority back to it.

2. Turn a Job Title Into Permission

An org chart can tell you who reports to whom. Workday can translate those relationships into security groups, permissions, responsibilities, and access.

A manager or HR partner does not simply hold a title. Their position determines what they can see and what they can do.

Authority becomes more durable when the system can turn it into action, because the rule no longer depends on everyone remembering where one person's responsibility ends and another's begins.

3. Make the Rules Survive the People

Organizations replace people far more often than they replace roles. That makes the role, not the individual, the more durable place to store authority.

SAP builds authorization around business roles and organizational structures, allowing access to follow responsibilities across functions and locations.

When someone leaves, the organization does not have to reconstruct every decision that person was allowed to make. The structure already knows what belongs to the role, ready for whoever occupies it next.

4. Encode Authority Into the Workflow

ServiceNow pushes the idea one step further by embedding roles and access controls into the workflows employees use every day.

A rule that once depended on someone asking who has authority can become a rule the process itself enforces.

That is the endpoint of encoded authority. Governance stops being something an organization has to repeatedly explain and becomes something its infrastructure quietly executes.

From strategy to legacy

The most durable products do more than serve an organization. They encode how the organization works: who has authority, who has access, and where those boundaries sit.

EVVA never advertised an org chart. It built one into the doors, creating a system that can remain legible long after the people who designed it are gone.

What part of your organization has quietly become infrastructure?

- Legacy Beyond Profits