Qonto Strikes Essential Balance
Between Flexibility and Security With
OneLogin to Enable Unfettered Growth“ With OneLogin, we can exponentiallyscale security to go hand in handwith business growth.”

AYOUB EL AASSAL
Head of Security

ABOUT
Qonto is the leading European businessfinance solution. It simplifies everything fromeveryday banking and financing to bookkeeping
and spend management. With its fast andinnovative product, highly responsive customer
service and transparent prices, Qonto
energizes SMEs and freelancers so that they
can achieve more.

INDUSTRYUSERSFinancial Services

1,100 users

INTEGRATIONSAWS and Cloudflare

Launched in 2017 by Steve Anavi andAlexandre Prot, Qonto serves more than
220,000 clients in 4 countries (France,Germany, Italy and Spain) and employs morethan 500 talents in Paris, Berlin, Milan andBarcelona. Since its creation, Qonto has raised
a total of €622 million from Valar, Alven, theEuropean Investment Bank, Tencent, DST
Global, Tiger Global, TCV, Alkeon, Eurazeo, KKR,
Insight Partners, Exor Seeds and Gaingels tosupport its global growth ambitions.

Get a Free Trial

Get a DemoQonto has been listed by the Frenchgovernment in the Next40 index, whichbrings together the 40 most promising scaleups in France with the potential to become
a global leader.

CHALLENGE
As is true of many fast-growing companies,
Qonto calls upon a combination of employees
and contractors to support its business.
Previously, when onboarding, both employees
and contractors received multiple emails withpasswords to relevant applications. Workers
struggled to know who to turn to when theyexperienced app access issues.
For many teams, onboarding quickly becamean exponential nightmare as Qonto welcomed
up to 20 people every two weeks and provided
access to as many as 60 applications.

“ You can enforce accesspolicies and punish people
for not maintaining up todate credential lists, but
only single sign-on
guarantees results because
it enables centralized
identity management.”
AYOUB EL AASSAL
Head of Security

While each employee is associated with an HR
file, contractors come and go, introducing
different challenges for the security team whenit comes to maintaining app access andcredential lists.
The challenge continued with the offboarding
process. A point-in-time audit that was quickly
out-of-date was insufficient for understanding
who still worked for Qonto and who didn’t.
Plus, it was complicated for the security teamto revoke application access in shared accesssituations.
As Ayoub El Aassal, Head of Security for
Qonto, explains, these issues and many moreare unsolvable without identity and accessmanagement (IAM). “You can enforce accesspolicies and punish people for not maintaining
up to date credential lists, but only single signon guarantees results because it enablescentralized identity management.”

SOLUTION
El Aassal recognizes the many ways toapproach IAM. “It’s relatively easy to tackle itthrough more bureaucracy and manual work:
Email rounds to notify which people are leaving
or getting promoted, weekly controls to ensurethat all users across dozens of applications are
up to date, quarterly verifications of password
policies, and so on.” But this approach hardly
scales and, past a certain threshold, becomes
cumbersome and inefficient.

Get a Free Trial

Get a DemoQonto realized that its salvation lies withinautomation and technical innovation. EnterOnelogin. “We chose OneLogin because it
elegantly solves a difficult equation involving
flexibility, security, and automation,” says ElAassal.
With robust support for integrations within
OneLogin, Qonto deployed 60 apps within
three months. “We’re a relatively small
security team. OneLogin provides APIs thatstreamline integration and makes it easy tocreate OneLogin accounts and automate
many core processes,” says El Aassal.
He also appreciates that OneLogin unleashes
innovation. “We can easily scale, such as byconnecting an app with 1,000 users using
just three lines of script.”

RESULTSIn the past, when new employees requested
app access, each request generated a ticket
for the team owner of the tool. This used tobe the norm and overwhelmed teams overtime. Now, it’s an anomaly for the security
team to receive those tickets.

When employees and contractors join today,
their access permissions and rights are set
automatically, based on their role and/orgroups. This reduces friction during
onboarding, enabling workers to accessneeded apps without delay. “Before, we wereunable to enforce app access in such a
granular way,” El Aassal explains.
At the same time, Qonto no longer needs todedicate one engineer to spend a full day
every two weeks provisioning app access for
new joiners since OneLogin handles thisautomatically. “OneLogin eliminates
frustration for new users and for our security
team,” continues El Aassal.
As El Aassal says, “Most companies treat
security as a fortified castle. We are breaking
down this model and rebuilding security,using SSO as a central brick to propagate andcontrol identity, and applying different
controls in line with the perceived threat leveland context. That’s a vastly different
approach from simply slapping a VPN onto
an app and considering it secure.”

Get a Free Trial

Get a DemoOne good example of “eliminating the moat” isusing OneLogin’s policy-based Multi-Factor
Authentication (MFA), which protects Qonto’s
employees from phishing attacks. According
to El Aassal, there’s no excuse for not having
MFA in place. In fact, he says it’s the only
reliable way for Qonto to secure its criticalapps against phishing. “Forget about phishing
simulations and employee training. One of themost efficient ways of dealing with phishing isrobust MFA. Users are protected without being
aware of OneLogin platform,” he explains.
Moreover, OneLogin provides a clear view into
application access at all times, making it easy
to automatically identify and alert on any
suspicious behavior. “Imagine you want togather access logs from all your internal
applications, parse them and define
suspicious behavior...that’s impossible. Butwith OneLogin, it’s just a click away,” explains
El Aassal.
With OneLogin in place, Qonto doesn’t have toworry about security as it scales and yet
knows new workers are empowered to work
efficiently on day one.
El Aassal knows Qonto could support its rapid
growth without OneLogin. But he also knows
Qonto’s engineers would be bogged down.
“They would be frustrated spending so muchtime managing a routine process instead ofbeing freed to develop innovative ideas andsolutions. Plus, new employees wouldn’t get agood feel for our company,” he continues.

Going forward, El Aassal plans to further enable
his vision of breaking up the old security“castle” by putting all apps behind OneLogin.
“We don’t want security where we rely on
assumptions of trust. ‘This partner comes fromthis IP address therefore they are allowed
passage.’ It’s a start but it’s not quite enough.
We are working on ways to systematically prove
elements of security every step of the way,transparently and efficiently. OneLogin is one
important component among many others toachieve that.”
In fact, El Aassal is taking advantage ofintegration between AWS and OneLogin toassign rules on the spot to users who needapplication access. This makes it possible forthose users to access all needed resources via
a single account versus the multiple accounts
needed in the past. “We can easily assign these
temporary access rules. It’s just one example of
how we use – and plan to use – OneLogin toenable the best security with the mostflexibility,” he concludes.

See the Trusted Experience
Platform in Action
Get a Free Trial
Get a Demo