How Luno runs access reviews for 600 people across three continents
Luno is a global cryptocurrency and tokenised stock platform that lets people store and trade crypto safely. They hold customers’ money in a tightly regulated industry, employ 600 people across Africa, Europe and Southeast Asia, and work remotely by default. Several of the systems they use sit outside the company’s identity provider, so proving who has access to what is a permanent obligation.
Challenges before Ploy
Luno looks after people’s money, which means they have to show a regulator who had access to what and when. Not every platform they run ties into central identity, so that proof could not be inherited. It had to be built system by system, by people, alongside their day jobs.
“Before Ploy the process was almost entirely manual and it depended a lot on humans — and humans, as awesome as they are, are really fallible and have other things to do. So access reviews are not always top priority.”
Why Luno chose Ploy
Luno needed reviews that ran to a schedule, finished without chasing, and recorded the same way every time. The test was an external auditor: someone who arrives knowing nothing about the company’s tooling and has to follow the evidence unaided.
“We needed a tool where we could very accurately schedule reviews and make sure that they were done — and record the results of those reviews in a consistent manner, so we can show any auditor around the world: this is how we do it.”
Implementation & adoption
Reviews go out through Slack, which is where Luno’s people already work. A reviewer gets an alert that a review is due, clicks through, signs in, reviews the system in front of them, and submits. The file hunting and the version control went with it.
“They appreciated a tool that integrated into our communications platform. They get an alert that a review needs to be done, they can just click a link, sign in to Ploy, quickly review the tool, and submit it. It’s a lot more seamless than the manual process we had before.”
Results
Reviews were the way in, and the footprint kept growing. Access requests moved off a manual ticket queue onto a catalogue people search themselves, picking what they need against their role level and department. Offboarding, automation flows and licence management followed, each from one of the separate platforms Luno had been running alongside it.
- Reviews run to a schedule instead of a reminder
- Reviewers approve in Slack, where they already work
- An evidence trail a third-party auditor can follow without knowing the tool
- Access requests, offboarding and licence management on the same platform
“Ploy saved me from drowning in spreadsheets, manual licence assignment and SaaS sprawl. It lets us easily make sense of what’s being bought, used, and wasted — which is more than I can say for most software tools.”