How a Mobility Leader Enforces Security using Passbolt

ROSE Bikes GmbH is a bicycle expert with more than 110 years of tradition, whose mission is to enable people to experience unique cycling adventures.

The family-owned company from Bocholt (North Rhine-Westphalia) offers high-quality mobility and performance bicycle products which are developed, assembled, and distributed throughout Europe from its headquarters. Its extensive range of products and services can be experienced online, in ROSE stores, and through partner retailers.

Before upgrading their credential management, the IT department at Rose Bikes GmbH relied on basic file-based password managers.While this setup was sufficient for IT professionals, it proved inadequate for managing credentials and enforcing strict password policies across their 250 users.

The IT team recognised that without a centralised, professional solution, employees would resort to insecure password practices. Without firm adoption of a proper tool, users would fall back on saving passwords in Chrome or Edge, storing them in Excel spreadsheets, or even writing them down on paper. The IT team needed to enforce adoption, strengthen security hygiene, and ensure compliance across the entire organisation.

To address these security vulnerabilities, Rose Bikes GmbH sought a solution that supported a self-service model, allowing department-level groups to manage their own passwords, with designated managers overseeing credential access.

The key criteria that made Passbolt the preferred choice included its commitment to open source, self-hosting capabilities, compliance, and strong security.

Passbolt has fundamentally transformed how teams at Rose Bikes GmbH collaborate. The tool’s robust access control enables seamless inter-team cooperation and control:

• Department level granular sharing: Instead of tying passwords to individuals, ownership is assigned to department-level groups, with designated "power users” in each department managing their team's credentials.
• Differentiated Access and Inter-Team Sharing: The platform allows for strict role-based access. Department owners can see and edit all passwords, while apprentices and trainees are restricted to read-only access for specific credentials.
• Full Auditability: Passbolt provides a comprehensive audit history for shared credentials, which improves overall accountability, compliance, and security hygiene.
• Centralized Source of Truth: For the IT team, the password manager has effectively replaced formal documentation. It serves as a live, searchable repository for quickly locating information and troubleshooting issues.

To guarantee the success of this rollout and ensure strict compliance, the IT department took a firm stance on security by disabling insecure auto-password management features in browsers like Edge and Chrome.

The rollout has been gradual and strategic, starting with a diverse test group of "group admins" to create thorough, internal documentation before rolling it out to the wider organisation.