Evidence ledger
31 sources
Checked 13 Oct 2026
Evidence ledger
One row per claim in When one platform runs everything: eleven years of Monzo's architecture: who published it, what grade it carries, when it was written, when the link was last checked, and the quote or figure it rests on. Nothing in the guide is cited from memory, so anything not in this table is not in the guide.
Dig: When one platform runs everything — Monzo's architecture, 2015 to 2026. Research date: 2026-10-13. All rows checked 2026-10-13.
Retrieval limitation, stated up front. This session's egress policy allowed direct fetches
only to github.com and raw.githubusercontent.com. Everything else was obtained through
search-engine retrieval, which returns page excerpts and quoted fragments rather than the whole
document. Consequences, honestly: GitHub rows (archive banners, commit dates, README text,
issue threads) are first-hand; non-GitHub rows rest on excerpts of the primary page. Quoted
fragments below are reproduced only where the retrieval returned them as quotations. The
machine link check in verify.mjs could not run against the network, so links are recorded as
indexed and unverified-by-HTTP rather than re-checked. Where a figure appears in only one
excerpt, the page says so.
| # | Org | Title | Tier | Published | Checked | URL | Claim taken | Supporting quote or figure |
|---|---|---|---|---|---|---|---|---|
| 1 | Monzo | Building a Modern Bank Backend | blog | 2016-09-19 | 2026-10-13 | https://monzo.com/blog/2016/09/19/building-a-modern-bank-backend | The platform was microservices from the start, and already near 100 services at beta | "the backend had grown to nearly 100 services" (retrieved excerpt) |
| 2 | Monzo | Very Robust etcd | blog | 2017-11-29 | 2026-10-13 | https://monzo.com/blog/2017/11/29/very-robust-etcd/ | Self-run etcd: nine nodes across three zones, quorum survives four losses, SRV peer discovery | "consensus is possible if a majority (n/2 + 1) of nodes are available"; "etcd is given a domain name so it can retrieve an SRV record containing a set of peers" |
| 3 | Monzo (Oliver Beattie) | Major outage 27/10/2017, community post-mortem thread | postmortem | 2017-10-30 | 2026-10-13 | https://community.monzo.com/t/resolved-current-account-payments-may-fail-major-outage-27-10-2017/26296 | Timeline and the etcd expansion that preceded the outage | "this cluster consisted of three nodes (one in each of our three zones); we raise this to nine"; 14:16 outage declared, 14:18 linkerd suspected, 14:26 decision to restart several hundred linkerd instances |
| 4 | InfoQ | Monzo Outage Post Mortem | blog | 2017-11 | 2026-10-13 | https://www.infoq.com/news/2017/11/Monzo-Outage-Post-Mortem | Mechanism: a Kubernetes bug timed out requests after cluster reconfiguration, linkerd stopped receiving updates, and the mass restart exposed a version incompatibility | "restarting all linkerd instances exposed a version incompatibility between Kubernetes and linkerd" (retrieved summary) |
| 5 | The Register | Kubernetes bug ate my banking app | blog | 2017-10-31 | 2026-10-13 | https://www.theregister.com/2017/10/31/kubernetes_bug_bank_app_monzo/ | Contemporary account; engineers traced the fault to linkerd by 14:18 | "a bug in a four-month-old Kubernetes release" (retrieved summary) |
| 6 | Techerati | Lessons learned from Monzo's Kubernetes outage | blog | 2018-05-03 | 2026-10-13 | https://www.techerati.com/the-stack-archive/cloud/2018/05/03/lessons-learned-from-monzos-kubernetes-outage/ | Blast radius: 1 hour 21 minutes, payments largely still completed, two customer complaints | "the outage lasted an hour and 21 minutes" (retrieved summary) |
| 7 | Kubernetes | Issue #47131, apiserver timeouts after rolling-update of etcd cluster | source | 2017-06-07, closed 2018-02-12 | 2026-10-13 | https://github.com/kubernetes/kubernetes/issues/47131 | The failure class was live upstream in 2017 and the fix landed only in 1.10 | "This problem should be solved or at least mitigated by #57160"; reporter: "The cluster is in production, so we cannot risk a third outage to reproduce it again" |
| 8 | Linkerd | Issue #1730, linkerd continues to talk to old endpoint | source | 2017-12-06, closed 2018-05-18 | 2026-10-13 | https://github.com/linkerd/linkerd/issues/1730 | The stale-endpoint class was reported two months after Monzo's outage and closed without a reproduction | "Hard to say for sure if this is fixed or not given our inability to reproduce it" |
| 9 | Monzo | We deployed Envoy Proxy to make Monzo faster | blog | 2019-04-03 | 2026-10-13 | https://monzo.com/blog/2019/04/03/deploying-envoy-proxy | linkerd 1.x was the dominant p99 contributor; Envoy won on CPU and latency at 15,000 rps; Linkerd 2.0 and Istio were evaluated and rejected | comparison run "at 15,000 requests per second", Envoy "used less than half the CPU" (retrieved excerpt) |
| 10 | Monzo | We built network isolation for 1,500 services | blog | 2019-11 | 2026-10-13 | https://monzo.com/blog/we-built-network-isolation-for-1-500-services | 1,500 services with 9,300+ interactions; dependency graph derived by static analysis (rpcmap); Calico policy rolled out in log-only mode first | "over 9,300 inter-service interactions"; custom tool "rpcmap" (retrieved excerpt) |
| 11 | InfoQ | How Monzo Isolated Their Microservices Using Kubernetes Network Policies | blog | 2019-12 | 2026-10-13 | https://www.infoq.com/news/2019/12/network-isolation-kubernetes/ | Moving Envoy into the pod is what made per-pod policy possible; before that traffic crossed a shared Envoy | "sensitive microservices couldn't be restricted to certain pod IPs at the network level because traffic passed through a shared Envoy" (retrieved summary) |
| 12 | Monzo | egress-operator | source | created 2019-12-11, updated 2026-06-15 | 2026-10-13 | https://github.com/monzo/egress-operator | Egress is authorised by name and label, not by protocol inspection; the operator deliberately blocks nothing itself | "instead of authorizing egress traffic with protocol inspection"; "This operator won't block any traffic for you" |
| 13 | Monzo | Why Monzo wasn't working on July 29th | postmortem | 2019-09-08 | 2026-10-13 | https://monzo.com/blog/2019/09/08/why-monzo-wasnt-working-on-july-29th | Cassandra migration incident: 21 servers, replication factor 3, quorum reads and writes; six new servers added at 13:10; joined clusters advertised hosts the firewall blocked | "a collection of 21 servers (which we call a cluster)"; "all the data we store is replicated across three out of the 21 servers"; scaling "began at 13:10 by adding six new servers" (retrieved excerpts) |
| 14 | Monzo | We had issues with Monzo yesterday | postmortem | 2019-07-30 | 2026-10-13 | https://monzo.com/blog/2019/07/30/we-had-issues-with-monzo-yesterday | The same-day account was materially thinner than the one published 40 days later | "a change meant we didn't properly process a small amount of our data for about two hours" (retrieved excerpt) |
| 15 | The Downtime Project | Monzo's 2019 Cassandra Outage | talk | 2021 | 2026-10-13 | https://downtimeproject.com/podcast/monzos-2019-cassandra-outage/ | Independent incident analysis; recovery was fast and no data was permanently lost | "the team recovered quickly and no data was permanently lost" (retrieved summary) |
| 16 | Ben Kehoe (AWS, personal) | Post on the 2019 incident | blog | 2019-08-09 | 2026-10-13 | https://x.com/ben11kehoe/status/1160180141361963008?lang=en | The published dissent against self-operating storage | "this wouldn't have occurred using a managed svc for storage, so does running Cassandra yourselves really make you a better bank?" |
| 17 | Monzo | How we deploy to production over 100 times a day | blog | 2022-05-16 | 2026-10-13 | https://monzo.com/blog/2022/05/16/how-we-deploy-to-production-over-100-times-a-day | Deploy rate above 100 a day; tooling is deliberately opinionated so engineers do not touch Kubernetes | "biases towards a simple and opinionated user experience, over configurability" (retrieved excerpt) |
| 18 | Monzo | Argo Rollouts at scale | blog | 2022-11-02 | 2026-10-13 | https://monzo.com/blog/2022/11/02/argo-rollouts-at-scale | Automated rollback brought to 2,100+ services at over 100 deploys a day | "2,100+ services" (title and body) |
| 19 | Monzo | How we run migrations across 2,800 microservices | blog | 2024-08 | 2026-10-13 | https://monzo.com/blog/how-we-run-migrations-across-2800-microservices | Fleet migrations are run by one central team, not by service owners, resting on the monorepo, uniformity and mass-deploy tooling | central ownership avoids "high coordination overhead (leading to slow migrations)" and the risk "the project will stall"; case study is OpenTracing to OpenTelemetry (retrieved excerpts) |
| 20 | CNCF | CNCF archives the OpenTracing project | adr | 2022-01-31 | 2026-10-13 | https://www.cncf.io/blog/2022/01/31/cncf-archives-the-opentracing-project/ | The deadline that forced Monzo's 2,800-service tracing migration was set by a foundation decision, not by Monzo | "the Technical Oversight Committee approved archiving OpenTracing" |
| 21 | Monzo | How we secure Monzo's banking platform | blog | 2022-03-31 | 2026-10-13 | https://monzo.com/blog/2022/03/31/how-we-secure-monzos-banking-platform | Scale and stance in 2022: more than 20,000 containerised workloads across more than 2,000 microservices, default-deny between them | "more than 20,000 containerised workloads across more than 2000 microservices"; "Don't trust workloads by default" |
| 22 | Monzo | Humans who can RPC | blog | 2022-05-26 | 2026-10-13 | https://monzo.com/blog/2022/05/26/humans-who-can-rpc-securing-staff-access-to-microservices | Staff authorisation is modelled per RPC, and sensitive RPCs can require multi-party approval | permission modes "encouraging least-privileged access" (retrieved excerpt) |
| 23 | Monzo | Securing admin access to Monzo's platform | blog | 2023-12-14 | 2026-10-13 | https://monzo.com/blog/2023/12/14/securing-admin-access-to-monzos-platform | Enclave attestation gates secret release, and the secrets are deliberately kept out of the platform's own store to avoid a dependency cycle | enclaves "produce attestation documents that are signed by AWS"; avoiding "a cyclic dependency that could let a platform admin subvert the MPA process" (retrieved summary) |
| 24 | Monzo | Securing our software supply-chain better with reproducible builds for enclaves | blog | 2024-2025 | 2026-10-13 | https://monzo.com/blog/securing-our-software-supply-chain-better-with-reproducible-builds-for | Sensitive workloads run in Nitro Enclaves, and reproducibility required pinned sources plus offline sandboxed builds | "A good example of one of these workloads is our multi-party authorisation system (MPA) for AWS, which we run on AWS Nitro Enclaves" |
| 25 | Monzo | aws-nitro-util | source | created 2024-02-13, updated 2026-07-28 | 2026-10-13 | https://github.com/monzo/aws-nitro-util | The vendor's own enclave build tool was rejected as unreproducible and blob-dependent | nitro-cli EIFs "are timestamped, so they aren't bit-by-bit reproducible"; building from source reduces "implicit trust on AWS" |
| 26 | Monzo | etcd3-terraform | source | created 2017-11-28, archived 2024-05-16 | 2026-10-13 | https://github.com/monzo/etcd3-terraform | The public artefact of self-run etcd is read-only since May 2024 | "This repository was archived by the owner on May 16, 2024. It is now read-only."; README: "an illustration of how we run etcd clusters" |
| 27 | Monzo | ddbt | source | created 2020-09-11, archived 2023-05-04 | 2026-10-13 | https://github.com/monzo/ddbt | An in-house replacement for a vendor CLI, built for scale and then abandoned | built to be "a fast version of [DBT] which gets very slow on large projects (3000+ data models)"; "left here for historic purposes", "no active development is continuing on ddbt" |
| 28 | Monzo | typhon | source | created 2015-02-12, commits to 2026-08-12 | 2026-10-13 | https://github.com/monzo/typhon | The 2015 in-house RPC wrapper is still substantively maintained in 2026 | commits of 2026-08-11 "h2c: Update to native net/http HTTP2 client (#183)" and 2026-08-10 "h2c: Enable health checking for connections if they are idle (#181)" |
| 29 | Monzo | An introduction to Monzo's data stack | blog | 2021-10-14 | 2026-10-13 | https://monzo.com/blog/2021/10/14/an-introduction-to-monzos-data-stack | Analytics is fed by the service event firehose, not by database access; 4,700 dbt models and about 600k lines of SQL in 2021 | events streamed "via 'the firehose' (using Kafka and NSQ) to specific append-only projects in BigQuery"; "over 4700 models"; "about 600k lines of SQL" (retrieved excerpts) |
| 30 | InfoQ | Neobank Monzo Builds Governed Data Mesh across 100 Teams and 12000 dbt Models | blog | 2026-05 | 2026-10-13 | https://www.infoq.com/news/2026/05/monzo-data-mesh/ | By 2026 the same pattern carries 12,000 models across 100 teams, now governed as a mesh | title figures: 100 teams, 12,000 dbt models |
| 31 | Monzo | Tolerating full cloud outages with Monzo Stand-in | blog | 2025-02 | 2026-10-13 | https://monzo.com/blog/tolerating-full-cloud-outages-with-monzo-stand-in | Stand-in is a separate platform on Google Cloud with no shared services, eventually consistent one-way replication, two activation modes, and a stated justification that is not cloud failure | "services in the Stand-in Platform never run in the Primary Platform, or vice-versa"; "a bug in our code or processes is at least as likely to cause an outage as a cloud provider failure"; "Direct mode is required if AWS is fully down but that is likely to be a very small fraction of incidents"; "backup of last resort, not our primary mechanism of providing a reliable service to our customers" |
| 32 | Monzo | Processing payments in Monzo Stand-in | blog | 2025 | 2026-10-13 | https://monzo.com/blog/processing-payments-in-monzo-stand-in | Payments made in Stand-in return as advice messages and are never re-decided by the primary platform | "The Primary Platform does not re-run any decisioning for the payments that we've processed in Monzo Stand-in"; Stand-in "can connect to the data centre services directly" if AWS is unavailable |
| 33 | InfoQ (Eran Stiller) | How Monzo Bank Built a Cost-Effective, Unorthodox Backup System | blog | 2025-02-24 | 2026-10-13 | https://www.infoq.com/news/2025/02/monzo-stand-in/ | The standby runs at about 1% of the primary platform's operating cost | "a cost-effective design, resulting in 1% of the operational costs of the primary deployment" |
| 34 | LeadDev | How Monzo built a Stand-in platform to sidestep costly outages | blog | 2025 | 2026-10-13 | https://leaddev.com/software-quality/how-monzo-built-a-stand-in-platform-to-sidestep-costly-outages | Launch date March 2025; 18 Stand-in services; the primary-platform figure here conflicts with the AWS one by an order of magnitude | "while the main platform runs 30,000+ microservices, Stand-in uses just 18 purpose-built services"; "launched in March 2025" |
| 35 | AWS | Monzo Bank success story | vendor | undated | 2026-10-13 | https://aws.amazon.com/solutions/case-studies/monzo-case-study/ | Vendor figures: over 3,000 primary services, 18 in Stand-in | "Monzo's primary stack has over 3,000 services hosted on AWS, Monzo Stand-in has only 18" (retrieved excerpt) |
| 36 | Finextra | Monzo develops backup bank to cover outages | blog | 2024 | 2026-10-13 | https://www.finextra.com/newsarticle/45676/monzo-develops-backup-bank-to-cover-outages | First full activation was August 2024, during an incident of about an hour | "the Stand-in platform had its first major outing in August 2024"; outage "lasted for approximately one hour" |
| 37 | Finextra | Monzo deploys backup bank in face of outage | blog | 2026-08 | 2026-10-13 | https://www.finextra.com/newsarticle/48272/monzo-deploys-backup-bank-in-face-of-outage | Stand-in was activated again during the August 2026 incident | spokesperson: "For a short period today" |
| 38 | StatusCake | Monzo's Stand-In Held Up on Wednesday. Some Customers Still Had a Bad Day. | blog | 2026-08 | 2026-10-13 | https://www.statuscake.com/blog/monzos-stand-in-held-up-on-wednesday-some-customers-still-had-a-bad-day | During the August 2026 activation, some customers still reported transfers and balances misbehaving | "some customers reported transfers and balances not behaving as expected while the Stand-in backup was active" (retrieved summary) |
| 39 | PYMNTS | Monzo Steers Customers to Backup Bank Amid Technical Outage | blog | 2026-08 | 2026-10-13 | https://www.pymnts.com/news/banking/2026/monzo-steers-customers-to-backup-bank-amid-technical-outage/ | Incident start and third-party report volume on 19 August 2026 | issues "began shortly after 12:00 PM UK time"; "over 3,000 problem reports" |
| 40 | FCA | Operational resilience: insights and observations for firms | adr | 2024-2025 | 2026-10-13 | https://www.fca.org.uk/firms/operational-resilience/insights-observations | UK firms had to be able to stay within impact tolerances for important business services by 31 March 2025 | firms must "be ready to comply with the operational resilience rules by 31 March 2025", the end of the transition period |
| 41 | AWS re:Invent (community write-up) | HMC201, Architecting resilient multicloud operations, feat. Monzo Bank | talk | 2025-12-03 | 2026-10-13 | https://dev.to/kazuya_dev/aws-reinvent-2025-architecting-resilient-multicloud-operations-feat-monzo-bank-hmc201-3jh9 | The session's own framing: multicloud does not add resilience by itself, and the standby is justified by failure-mode analysis (SEEMS) | "multi-cloud doesn't inherently increase resilience due to added complexity"; SEEMS: single points of failure, excessive load, excessive latency, misconfiguration and bugs, shared fate |
| 42 | QCon London | Banking on Thousands of Microservices | talk | 2023-03 | 2026-10-13 | https://qconlondon.com/presentation/mar2023/banking-thousands-microservices | Platform described as nearly two thousand microservices, with Cassandra and Kubernetes chosen early | speaker bio: "nearly two thousand microservices" |
| 43 | InfoQ | Modern Banking in 1500 Microservices | talk | 2020 | 2026-10-13 | https://www.infoq.com/presentations/monzo-microservices/ | The 1,500-service era talk, including the tooling that keeps engineers off Kubernetes | title figure |
| 44 | InfoQ | QCon London 2026: Shipping Constantly with Humans and beyond at Monzo | talk | 2026-03 | 2026-10-13 | https://www.infoq.com/news/2026/03/shipping-monzo/ | 2026 state: hundreds of production changes a day, "tenancies" for partial-stack environments, backend conventions encoded as LLM skills | "250 microservices were the set that would be impractical to run locally"; Monzo "encodes its backend conventions as LLM skills" (retrieved summary) |
| 45 | InfoQ | QCon London: Monzo's Recipe for Developer Experience | blog | 2025-04 | 2026-10-13 | https://www.infoq.com/news/2025/04/qcon-london-devex-monzo | Platform tooling is treated as a product with a decade-plus horizon, built by a three-engineer team | "successful tools can be there for 10 or 15 years, so you need to think about potentially irreversible decisions" |
| 46 | The Register | How does Monzo keep 1,600 microservices spinning? | blog | 2020-03-09 | 2026-10-13 | https://www.theregister.com/2020/03/09/monzo_microservices/ | 1,600 services by 2020; the 2017 outage reread as an interaction of bugs that were hard to test | the 2017 failure was "a combination of different bugs that were quite hard to test" |
| 47 | AWS | Monzo case study PDF | vendor | 2020-09 | 2026-10-13 | https://pages.awscloud.com/rs/112-TZM-766/images/GEN_monzo-case-study_595x841_Sep-2020.pdf | The operating ratio Monzo chose to advertise in 2020 | Matt Heath: "By using AWS, we can run a bank with more than 4 million customers with just eight people on our infrastructure and reliability team" |
| 48 | Monzo | Annual Report 2026 (year to 31 March 2026) | casestudy | 2026-05-19 | 2026-10-13 | https://monzo.com/annual-report/2026 | The load the platform now carries: 15.2m customers, 10.4m monthly actives, GBP 1.7bn revenue, GBP 25.7bn deposits | reported figures for FY2026 |
| 49 | Bronson, Aghayev, Charapko, Zhu | Metastable Failures in Distributed Systems (HotOS '21) | paper | 2021 | 2026-10-13 | https://pure.psu.edu/en/publications/metastable-failures-in-distributed-systems/ | The class of failure that survives removal of its trigger has no general defence | "A systematic approach for building systems that are robust against unknown metastable failures remains an open problem." |
| 50 | Huang et al. | Metastable Failures in the Wild (OSDI '22) | paper | 2022 | 2026-10-13 | https://www.usenix.org/conference/osdi22/presentation/huang-lexiang | Trigger plus sustaining effect is the right vocabulary for the 2017 cascade | "the sustaining effect keeps the system in the metastable failure state even after the trigger is removed" |
| 51 | arXiv | Performance Comparison of Service Mesh Frameworks: the MTLS Test Case | paper | 2024-11 | 2026-10-13 | https://arxiv.org/html/2411.02267v1 | Independent mesh-overhead measurement exists, so a 2019 vendor-free self-comparison can now be checked against third-party work | title and venue only; this row supports the existence of independent benchmarks, not any specific number |
| 52 | Container Solutions | How Monzo's Opinionated Platform and Tools Support their Developer Experience | blog | 2022 | 2026-10-13 | https://blog.container-solutions.com/how-monzos-opinionated-platform-and-tools-support-their-developer-experience | Secondary estimate of the engineering population behind the platform in 2022 | "a relatively small team of around 200 engineers" |
| 53 | diginomica | Monzo Bank eyes AWS managed services so that it can focus on banking | blog | 2020-2021 | 2026-10-13 | https://diginomica.com/monzo-bank-eyes-aws-managed-services-so-it-can-focus-banking | The build-versus-hand-over question was being asked explicitly about Kubernetes, Kafka and Cassandra | the team weighed whether to keep running "core components like Kubernetes, Kafka and Cassandra" themselves (retrieved summary) |
| 54 | Tigera | Conversation with Monzo: Ensuring Compliance for a Digital Bank with Tigera Calico | vendor | undated | 2026-10-13 | https://www.tigera.io/blog/conversation-with-monzo-ensuring-compliance-for-a-digital-bank-with-tigera-calico/ | Vendor account of the Calico deployment behind the isolation work | vendor framing of compliance-driven network policy |
| 55 | Monzo | calico-accountant | source | created 2019-09-22, updated 2026-08-01 | 2026-10-13 | https://github.com/monzo/calico-accountant | Policy rollout needed its own instrumentation: a Prometheus exporter for Calico policy packet counts | repo description |
| 56 | Monzo | response | source | created 2019-04-13, 403 commits, not archived | 2026-10-13 | https://github.com/monzo/response | The in-house incident tool is still public and still Django 2.2 era, with no successor notice | README: "Response is a Django app which you can include in your project"; no maintenance notice |
| 57 | Index Ventures | incident.io raises $62M | vendor | 2025-2026 | 2026-10-13 | https://www.indexventures.com/perspectives/incidentio-raises-62m-to-build-ai-agents-that-resolve-incidents-with-you/ | The capability Monzo built in-house became a company founded by the people who built it | "founded in 2021 by ex-Monzo engineers" |
Tier mix
postmortem 3, source 8, adr 2, casestudy 1, blog 26, paper 3, talk 4, vendor 4 (57 rows, 31 of which are carried into the evidence wall on the page).
Where the record runs out
- No public account of the Kubernetes control plane after 2022. The only dated artefact is
etcd3-terraformarchived on 2024-05-16. Whether Monzo moved to a managed control plane is not published; this dig marks it open rather than inferring it. - No datastore account after 2021. Cassandra is last described in detail in the 2019 incident report and in passing in the 2021 data-stack post. Node counts, versions and whether anything has replaced it are unpublished.
- No Monzo ADRs or RFCs are public. The decision record is blog posts, archive banners and commit history, which is why this dig leans on repository archaeology.
- Primary-platform service count is contested: 30,000+ (LeadDev) against over 3,000 (AWS). Monzo's own posts say more than 2,000 (2022-03) and 2,800 (2024-08), which favours the AWS order of magnitude.
- No public root cause for the August 2026 incident beyond Monzo saying the core issue was fixed.