Securing DevOps for Parcel Logistics

Boxtal is a Paris‑based logistics scale‑up. Founded in 2009, Boxtal has built a proprietary multi‑carrier shipping platform. The system lets more than 300,000 small and medium‑sized businesses, online retailers, emerging marketplaces, and individual shippers use carrier options and shipping software that were previously available mainly to large e‑commerce companies, such as comparing carriers, print labels and track parcels from one SaaS platform.

Back in 2017 at Boxtal, credentials were scattered across Dashlane vaults, browser stores, paper notes and a KeePass file known only to a handful of system administrators. Each new root password required a manual warning so that no one opened the database simultaneously. With dozens of AWS accounts, CI/CD pipelines and a growing team, the approach was clearly unscalable and risky, especially for off‑boarding. The company also insisted on keeping secrets inside its own AWS tenancy and auditing the source code that protected them.

In early 2019 Boxtal surveyed the market. Bitwarden was considered, yet its multi‑container architecture and unclear licensing were immediate deterrents. Passbolt, by contrast, could be deployed with a single Docker image, was fully open source and had been designed from day one for team collaboration rather than individual vaults.

A proof‑of‑concept on a Synology NAS convinced the DevOps team within weeks; by late 2021 Passbolt had become the mandatory password solution for everyone at Boxtal. Since early 2024 the entire company has been running the self‑hosted Passbolt Pro edition after five years on Passbolt Community.

Seventy employees rely on hundreds of shared administrator and service passwords every day.

Deployment was handled entirely in‑house. After the initial NAS trial the service was migrated to AWS, integrated with the Passbolt browser extension and, later, with a Python script that publishes selected secrets automatically to AWS Secrets Manager for use in build pipelines.

To further reduce the attack surface, Boxtal ensures that its self-hosted Passbolt instance, like other internal tools, is only accessible via a self-hosted VPN. This approach effectively places the password manager within a private network, limiting exposure and aligning with Boxtal’s strict access control policies.

Because the database schema is open, Boxtal even built its own SQL‑driven dashboard to visualise who can access which credential at any moment.

The only time Boxtal contacted Passbolt support during a production hostname change, the response was quick and decisive. That episode reinforced confidence not only in the product but also in the team behind it.

No formal user training was required during initial adoption of passbolt due to its high usability.

Today every employee logs in to ten or more systems per day without copying and pasting passwords. What once cost about a minute per login is now instantaneous, saving hours each week and, more importantly, providing peace of mind. Centralised auditing shows exactly who can reach critical root accounts, and a single click removes access when someone leaves the company. The Passbolt API has turned credentials storage into an automation hub rather than an isolated store of secrets.

Equally important, Boxtal has seen significant progress in its overall security posture. After years of internal advocacy and education around password hygiene, browser-based password storage has been entirely eliminated. All employees now use Passbolt not just for shared secrets but also for their individual credentials. With secure password generation made easy, strong passwords have become the default, and two-factor authentication (TOTP) is enabled wherever possible. Passbolt has proven to be a key enabler in this cultural shift.

Passbolt has moved Boxtal from improvised, fragmented password handling to a secure, auditable and automation‑friendly backbone - exactly what a logistics platform needs when shipping tens of thousands of parcels every day.