HOW WE SECURELY GENERATE SENSITIVE SECRETS

Summary from the TLDR InfoSec newsletter

Monzo wanted a secret generation process that no entity could compromise or manipulate. Password managers with passkeys grant this assurance but don't scale to services that need to run in cloud environments. To achieve its goal, Monzo built a repeatable, deterministic build process that utilized AWS Nitro Enclaves to securely generate secrets. This was used to cryptographically verify the integrity of environments.