# How we generate sensitive secrets for our banking platform

**URL:** <https://community.monzo.com/t/how-we-generate-sensitive-secrets-for-our-banking-platform/166464>\
**Category:** Making Monzo\
**Tags:** blog, security\
**Created:** [26 July 2024 10:50 UTC](https://community.monzo.com/t/how-we-generate-sensitive-secrets-for-our-banking-platform/166464 "2024-07-26T10:50:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![awn](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/awn/32/22179_2.png) [@awn](https://community.monzo.com/u/awn)\
**Post date:** [26 July 2024 10:50 UTC](https://community.monzo.com/t/how-we-generate-sensitive-secrets-for-our-banking-platform/166464/1 "2024-07-26T10:50:27Z")

</div>

Hey folks! 👋 I’m Awn, part of Monzo’s Security Infrastructure team.

Secrets are everywhere, and the quest to protect them starts before they even exist. At Monzo we regularly have to create and manage secrets that grant very sensitive privileges, and so we’ve created a new process that makes it fast and easy for us to securely and verifiably perform all kinds of sensitive operations.

We’re excited to show you this blog post which talks about how this process works and what kinds of assurances we get out of it.

> **[How we securely generate sensitive secrets](https://monzo.com/blog/how-we-securely-generate-sensitive-secrets)**
>
> We regularly have to create and manage secrets that grant very sensitive privileges, and so we’ve created a new process that makes it fast and easy for us to securely and verifiably perform all kinds of sensitive operations.

Looking forward to answering any questions you might have!

---

<div class="post-metadata">

**Author:** ![AlanDoe](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/alandoe/32/45031_2.png) [@AlanDoe](https://community.monzo.com/u/AlanDoe)\
**Post date:** [26 July 2024 11:20 UTC](https://community.monzo.com/t/how-we-generate-sensitive-secrets-for-our-banking-platform/166464/3 "2024-07-26T11:20:47Z")

</div>



---

<div class="post-metadata">

**Author:** ![twigusa](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/twigusa/32/46164_2.png) [@twigusa](https://community.monzo.com/u/twigusa)\
**Post date:** [26 July 2024 11:25 UTC](https://community.monzo.com/t/how-we-generate-sensitive-secrets-for-our-banking-platform/166464/5 "2024-07-26T11:25:14Z")

</div>

Hi. This was a fascinating read. Thanks for sharing it. I had a question about Bob 🙂

Does the person verifying the CI output have access to Concourse? If so, how do you guarantee that they can’t compromise the CI and their local output?

---

<div class="post-metadata">

**Author:** ![awn](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/awn/32/22179_2.png) [@awn](https://community.monzo.com/u/awn)\
**Post date:** [26 July 2024 12:20 UTC](https://community.monzo.com/t/how-we-generate-sensitive-secrets-for-our-banking-platform/166464/6 "2024-07-26T12:20:19Z")

</div>

I guess not really! But some secrets are definitely more sensitive than others 🙂

---

<div class="post-metadata">

**Author:** ![awn](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/awn/32/22179_2.png) [@awn](https://community.monzo.com/u/awn)\
**Post date:** [26 July 2024 12:23 UTC](https://community.monzo.com/t/how-we-generate-sensitive-secrets-for-our-banking-platform/166464/7 "2024-07-26T12:23:02Z")

</div>

Engineers don’t have access to anything in our production environment by default, so in order to compromise Concourse someone would first have to get multi-party approval to get the necessary permissions. (You can read more about that [here](https://monzo.com/blog/2023/12/14/securing-admin-access-to-monzos-platform).)

However, we don’t rely on this as generally there’s at least _two_ people who will locally build the artefacts and compare their results with each other and with concourse.