City of North Port, Florida, strengthens public records compliance and credential security with Bitwarden

Size: 850 city employees
Industry: Local government and municipality
Location: North Port, Florida

The City of North Port needed to secure a rapidly expanding set of credentials while meeting strict transparency requirements under Florida's public records law. North Port officially crossed the 100,000-resident threshold, expanding significantly from around 74,793 residents during the 2020 census. As one of the fastest-growing cities in the U.S., located in Sarasota County, North Port is slated to continue growing, and its government IT team is expanding just as quickly.

That growth brought a rising number of credentials to secure, along with the full weight of the law's requirements. Known as the Sunshine Law, Florida's public records law guarantees the public's right to access government records and treats nearly any communication about official business, including emails and texts, as a public record subject to disclosure, with no exemption for drafts or informal notes. The IT team needed a way to share credentials that wouldn't create that kind of discoverable record.

Riley Jones, City of North Port technical support manager, manages the service desk team and supports desktop and systems administration. In his seven years with the city, he found that only one or two people held credentials for critical systems, creating single points of failure as the team grew.

The IT team also lacked a secure, centralized way to document or share passwords. That gap mattered even more under the transparency law, since even routine emails and chat messages about official business can be subject to disclosure. Sharing passwords over email or chat would have created exactly the kind of discoverable record the city needed to avoid. Jones knew the existing system was unsustainable and set out to find a cost-effective, highly secure, and comprehensive solution that was easy to use and would meet local government procurement and compliance requirements.

Jones championed Bitwarden internally based on his own positive experience as a personal user. The team also evaluated a few competitors but had trust and reliability concerns with them. Once the city decided to move forward with Bitwarden, prior approvals from other Florida municipalities and counties helped accelerate procurement. Because other government bodies had already vetted Bitwarden, the city pointed to existing contracts rather than starting its own review from scratch, a significant time-saver in a process that otherwise stretches on for local government IT purchases.

"We can piggyback off of other contracts," said Jones. "If another city, county, or state government has a contract that already aligns with our needs, we can say somebody else has already done the vetting."

The Bitwarden architecture gave the City of North Port a modern, least-privilege sharing model through Bitwarden Collections. With Collections, the team standardized and rotated default admin credentials while keeping them easily accessible to the right people. Collections in Bitwarden work like shared folders, grouping related logins, notes, and other items for secure sharing with access limited to specific users. Jones repeatedly cited the granular access control Collections offers as a standout Bitwarden capability.

"I really like how Bitwarden is set up with Collections and being able to create one for different groups, whether it's networking, security, or the development team," said Jones. "They can have their own groups, and you can put granular controls on who can see what."

Jones and his team also point to two other standout capabilities:

• Password generator: The city has a 21 to 26 character password policy, and the password generator is used for nearly all credentials, giving every account a strong, unique password without relying on staff to create one manually

• Bitwarden Send: Given the city's records-disclosure constraints, secure, encrypted credential sharing outside of Bitwarden is an especially urgent priority

That urgency comes down to one law in particular. As a government entity, the City of North Port must abide by Florida's public records law, which requires retaining records for seven years and complying with public record requests. The city clerk determines some exceptions for sensitive material.

The city uses Bitwarden Send for two purposes. The IT service desk relies on it to transmit temporary and reset passwords to end users and to share highly sensitive items like client secrets with app developers. This helps the city comply, since that law discourages sharing sensitive information over email or through group chats. Using Bitwarden Send instead of email or chat for sensitive information means the city isn't inadvertently creating a document that becomes subject to disclosure requirements.

"A way to not accidentally share a credential in a way that might be subject to public record is a big thing for governments," said Jones.

Compliance is only part of the equation; the city also needed a setup that matched its own security model. The City of North Port has deployed Bitwarden as a browser extension across IT-managed browsers, with the city deliberately opting out of single sign-on (SSO) integration with Okta. While Bitwarden offers direct SSO integration, Jones and his team prefer a separated environment.

"I feel like our single sign-on should be different from our password vault," said Jones. "I wanted to intentionally sign in to a vault, not just SSO in and have access to everything."

Jones values the flexibility to configure Bitwarden around what makes sense for the city, a factor that also influenced the original decision to adopt it. The team uses a main password plus Okta Verify for two-factor authentication (2FA) instead, requiring intentional, separate authentication into the vault.

Cross-device access has also made Bitwarden practical for a distributed IT team. Staff securely access credentials whether they're at a desktop or in the field, without sacrificing the deliberate separation from SSO. The city has deployed Bitwarden in the cloud, though Jones believes the self-hosted Bitwarden deployment is a great option for other government bodies with more restrictive security or data residency requirements.

That combination of compliance support and configuration flexibility reflects a broader pattern for teams like North Port's. Compared to the private sector, government IT teams face unique challenges. Security decision makers must stave off cyberattacks while also complying with audits, records requests, and procurement scrutiny. For the City of North Port, Bitwarden proved to be a strong choice, with a respected security architecture that stands up to independent audits and a sharing model that keeps sensitive information secure without creating new compliance liabilities.

"Trust is the big one," said Jones. "I know you do a lot of independent testing. How you conduct audits is nice."

See what Bitwarden offers government and public sector organizations. Start a free trial today.