Safety first: how to choose a security-minded bicycle leasing partner

You always lock up your bicycle, right? So why wouldn't you choose a bicycle leasing partner that keeps your data secure? All too often, data security is far from the top of the HR checklist for bicycle lease providers. And that’s a risk. Use these three questions to help you choose a partner that takes data security seriously. 

When choosing a bicycle leasing partner, companies generally consider the classic criteria. Does the leasing company take a lot of work off your hands? Are employees given a wide selection of bicycles to choose from? Is payroll straightforward?

However, one crucial factor is often overlooked: security. More specifically, we're talking data, system, and access security. And security is just as important as the other criteria. 

Three reasons why data security is important 

1. Preventing sensitive data from being breached

Just think of the amount of sensitive data shared with a leasing partner – email addresses, names, phone numbers, billing information, contract details, personnel numbers, payroll information, etc. This is all information you definitely don’t want to fall into the wrong hands. Having good data security is therefore not a luxury, but a must.

2. Preventing improper use of accounts and access 

What if a former HR employee still has access to personnel data? Or worse – what if someone uses a hacked account to order bicycles via your organisation’s lease plan? Only through robust access security can such scenarios be prevented.

3. Preventing hacks and data breaches 

It’s not just your systems that need to be secure – the same must go for your leasing partner. Because if they get hacked, it is likely your data and that of your employees will also have been breached. The average cost of a data breach is €4.44 million. And that’s not even to mention the reputational damage, wary customers, and angry employees.

Choose a secure partner with these three questions 

You get the idea – you want a partner that takes data, system, and access security seriously. But how do you check that? Simply ask these three questions.

Check 1: As leasing partner, how will you ensure your employees handle our company data securely?

Why ask this question?
Hackers don't just target technology – they target people, too. Say employees get a fake email from ‘the CEO’, an ‘urgent’ payment request, or a phony support request containing an ‘important’ link. This is called social engineering and is a common hacking method. 

That’s why it pays to know whether a leasing partner trains its employees to handle data securely.

What answer should you be looking for?
You want your leasing partner to make employees aware of the risks, as well as being able to explain specifically how they go about this. Good initiatives would include:

• Regular training to ensure every employee knows how to recognise and handle suspicious activity. 
• Simulated attacks where the company sends fake phishing emails to its employees, thereby seeing who clicks on them. This tells them who needs extra training and keeps everyone on their toes. 

Check 2: How will you, as leasing partner, secure access to your tools?

Why ask this question?
Your chosen leasing partner will provide tools for HR and employees to manage all aspects of bicycle leasing. Want to keep your data secure? Then you need to keep access to these tools secure. A password alone isn’t enough these days. You want your accounts to be extra secure, while also being able to manage access both easily and effectively. 

This is achieved by protecting accounts across multiple layers. This is the only way to protect sensitive data from unauthorised access, theft and misuse, as well as to prevent cyberattacks and data breaches.

What answer should you be looking for?

• You want your leasing partner to provide MFA. MFA stands for 'multi-factor authentication’ and adds an extra layer of security. So even if a password is compromised, the account remains secure.
• You want your leasing partner to support SSO. SSO stands for ‘single sign-on’, whereby employees log in once via a trusted portal (such as Google, Microsoft or your own portal) and are automatically granted access to all relevant systems. This means your IT department retains full control over access, permissions and security policies, rather than the leasing partner (alone). 

Check 3: How will you, as leasing partner, protect our company data on your systems? 

Why ask this question?
Having well-trained employees and robust access security protocols form a solid foundation. But what happens to your data once it’s stored on the leasing partner’s systems? Your sensitive data cannot be breached, exposed to the outside world or lost. 

A reliable partner will protect data at all stages: when stored, processed and transferred. 

What answer should you be looking for?
You're looking for a partner who can clearly demonstrate that data are secured in a systematic manner, in line with best practices. These are strong indicators that the bicycle leasing partner:

• encrypts data during both transfer and storage;
• manages access according to the principle of ‘least privilege’, i.e. employees are only granted access to what they need, with clearly defined roles and regular access reviews;
• monitors and tracks suspicious activity so that incidents can be quickly identified and addressed;
• continuously updates and tests their systems;
• is able to clearly explain where your data are stored and processed; ideally, this should be on servers within the EU or EEA, so that the level of data protection (GDPR) remains high;
• makes backups, carries out recovery tests and has an incident response plan in place.

ISO 27001 certification – a good sign 

A good bicycle leasing partner won't just tell you that your data are secure – they can prove it. You should therefore always ask whether the partner in question holds ISO 27001 certification. Please keep the following in mind: 

• Check carefully that it is actually ISO 27001. 
• Check that the name of the bicycle lease partner is actually listed on the certificate. 
• Ask for the Statement of Applicability (also known as an SoA). This document sets out which security measures from Annex A of ISO 27001 do or do not apply to the bicycle leasing partner.

What is an ISO 27001 certificate?

There are many types of security certificates (various ISO standards, SOC, etc.), but not all certificates mean the same thing. ISO 27001 is the internationally recognised standard for information security, as well as the most demanding one. 

Whereas other certifications often capture a company snapshot, ISO 27001 revolves around continuous improvement – identifying risks, implementing security measures and demonstrating their efficacy – while external audits are carried out every year. 

Practice what you preach

o2o Bicycle Leasing is ISO 27001 certified. This means that:

• our employees are security-minded;
• access to our tools is secure;
• our systems are safe to use.

“For us, ISO 27001 certification is more than just proof that we take security seriously. It is, above all, a tool that keeps us on our toes. It challenges us to improve our IT security each and every day. It means we are always one step ahead of the ever-changing risks.” - Jeroen Coupé, Security Officer at o2o Bicycle Leasing

• An independent auditor carries out an annual review of our security measures.
• We engage every part of the chain – banks, insurers, bicycle dealers, cloud and SaaS partners – to ensure data are protected at every stage of the process.
• We have in-house security experts who are involved in everything we do, from onboarding to orders, and from internal tools to new features.
• Access to our platforms is secure thanks to SSO and MFA.
• We provide continuous training for our employees, including through our very own security coach, Albert.
• We invite customers to challenge us on the critical issues raised in this blog post. Transparency is an essential part of ensuring security.

“GDPR requires organisations to process personal data correctly, and security is the cornerstone of ensuring privacy in practice. ISO 27001 helps us organise our security practices, whether that's identifying risks, implementing controls or demonstrating their efficacy. GDPR places great emphasis on this, as personal data is only protected if information security practices are up to scratch. “With our ISO 27001 certification, we can demonstrate that, not only do we ‘take it seriously’, but that we can also ‘prove it’” - Sara Vydt, Privacy Manager at o2o Bicycle Leasing