Building Security to Unlock Engineering Velocity

At Robinhood, we believe that safety and speed are complementary forces driving progress. SERA (Secure Enhanced Remote Approval) is our latest example — a proprietary internal platform that lets engineers approve securely from anywhere, combining strong authentication with intuitive design. It’s proof that when security and usability work together, innovation moves faster and safer than ever.

Security is at the center of our core values — Safety Always. It defines how we protect our customers, our data, and our infrastructure. At Robinhood, we believe strong security and great developer experience should go hand in hand, and we’re always looking for ways to make protection seamless in day-to-day engineering.

Last year, our engineering and security teams came together to tackle one of those friction points: access approvals. Getting the right permissions is a normal part of software development, but for engineers at Robinhood, the process depended on using corporate laptops and VPN connections. We saw an opportunity to make the experience simpler and more efficient.

So we asked ourselves: Could we make this process faster and easier, while strengthening our security standards?

Picture this: it’s 7 PM on a Tuesday, and a production issue needs immediate attention. The on-call engineer is ready to respond, but the approver is away from their laptop. In the past, that meant a frustrating delay—finding the corporate device, connecting to the VPN, and authenticating just to approve a request.

At the time, many approvals happened through Slack. It was convenient, but it came with tradeoffs. Slack sessions could stay active for long periods, which reduced confidence that an approval reflected a fresh, intentional action. And because Slack-based workflows required public network access, they weren’t a good fit for our most sensitive systems.

To reduce that risk, we tightened our approach: certain types of access requests could only be approved from corporate devices connected to VPN. This improved our security posture but created friction for engineers, especially during off-hours or incident response. The result was slower approvals, longer wait times, and added pressure when speed mattered most.

We needed a way to keep security tight and ensure users weren’t met with friction in their work.

The breakthrough came from a simple question: how can we verify identity securely in a way that felt effortless to the user?

That idea led to SERA (Secure Enhanced Remote Approval), an internal platform that allows employees to approve requests securely from any device—no VPN or managed laptop required. SERA combines modern authentication standards with Robinhood’s focus on usability, allowing people to complete approvals using the same biometrics they already use to unlock their phones or laptops.

To address these gaps, we adopted passkeys as a second factor during approvals, a modern identity solution built on the WebAuthn standard. Passkeys are an implementation of WebAuthn that leverages asymmetric cryptography to prove possession of a private key stored securely on a user's device. When a user needs to approve a request, they perform a local gesture — like a fingerprint scan or facial recognition — to sign a cryptographic challenge. This ensures the approval is both intentional and interactive.

This approach allows us to:

• Bind the approval to a specific user and specific device.

• Eliminate reliance on long-lived sessions.

• Ensure approvals are tied to a real-time authentication event.

By pairing a security-first mindset with an emphasis on user experience, SERA shows that safety and speed don’t have to be tradeoffs—they can reinforce each other.

Instead of building a one-off solution, we created a reusable "WebAuthn-as-a-Service" platform.

The platform:

• Handles passkey registration and authentication across browsers and device types.

• Exposes APIs for initiating challenges and recording binary decisions (approve/deny).

• Stores the signed response, allowing the requesting service to poll for the result.

• Maintains an auditable mapping of users to cryptographic keys, enabling forensic accountability and traceability.

• Keeps all highly-privileged backend systems behind the VPN; no public ingress required.

We expect future internal services to adopt this platform for other use cases that require secure user intent verification without sacrificing security posture or network boundaries.

SERA was built through collaboration between Robinhood’s Security Engineering, Cryptography, and Infrastructure teams. Each brought deep expertise in different layers of our stack—and a shared goal of reducing friction for engineers without compromising trust.

Together, the teams designed a flow that starts in a high-trust environment and ends with flexibility.

• Employees initiate credential setup from a corporate device connected to VPN, ensuring new secure credentials (known as passkeys) are created in a trusted environment.

• Once enrolled, those same credentials can be used to approve requests from personal devices, using built-in biometric authentication.

Behind the scenes, SERA verifies each approval request, records the decision, and makes the result available to internal services—all while keeping high-privilege systems protected inside our network.

The outcome: a system that’s secure by design and intuitive to use.

SERA supports two main workflows: passkey management and action verification. These are deliberately split to enforce device trust during registration while allowing secure approvals from anywhere.

Figure 1: SERA system architecture

The architecture enforces clear trust boundaries between passkey management and action verification. All management operations, such as initiating a registration request, must originate from a VPN-connected managed device and flow through the SERA management proxy. This ensures that new keys are only enrolled within a high-assurance environment.

Once a passkey has been registered, approvals can be completed from unmanaged devices. The SERA service verifies the signed challenge, records the decision, and makes results available to the requesting service through polling, without requiring public ingress into the high privilege environment.

Passkey registration, deletion, and recovery can only be initiated from a corporate managed device on the VPN. This ensures that enrollment requests always begin in a trusted environment, even if the passkey itself is registered on an unmanaged device. During this flow:

• A registration request is initiated through the VPN-restricted SERA management proxy.

• The proxy retrieves a short-lived internet-accessible registration URL from SERA.

• The user visits the URL and completes WebAuthn registration using a biometric or device unlock gesture.

• SERA securely stores the public key and associated device metadata, enabling posture checks during future approval requests.

Figure 2: Passkey registration flow — This diagram walks through how a user securely registers a passkey using a trusted, VPN-connected device. The process is mediated by the management proxy and completed by the SERA service.

The approval workflow is designed to work from any device without requiring a VPN. This enables fast, secure approvals — especially during off-hours or incident response — while maintaining identity and intent assurance through passkeys.

The process begins when a user submits a request for access. This triggers our access management system to initiate the verification flow with a designated approver. The flow then proceeds in a few simple steps:

• The requesting service notifies the approver of the request and includes a link to complete verification via SERA.

• The approver visits the link and completes verification using their registered passkey with a biometric or device unlock gesture.

• The requesting service (access management system in this case) polls SERA for the approval outcome.

• Once a decision is available, the system notifies the original user of the result (e.g., access granted or denied).

This deliberate separation of workflows allows us to enforce strict device trust during the initial passkey enrollment while giving our engineers the flexibility and speed they need when making decisions later on.

Figure 3: Action verification flow — This diagram shows how a user completes an approval action using their passkey. The requesting service polls the SERA service for the signed result and notifies the user once the decision is processed.

Since launching SERA, we've seen measurable improvements in both responsiveness and adoption:

• Growing Adoption: SERA now handles 13% of all approvals and that number jumps to 26% during non-business hours when mobile approvals are most critical.

• Increased Efficiency: Average approval time has improved by 23%, helping teams get unblocked faster without sacrificing trust or control.

The feedback has been overwhelmingly positive. Users describe SERA as “a game changer” because it combines high assurance with everyday convenience.

Building a system like SERA isn’t just about speed—it’s about doing speed safely. The team took a thoughtful, layered approach to ensure that each design and engineering decision strengthened trust without adding friction.

• Trusted enrollment: New credentials can only be initiated from within the VPN, ensuring they start from a verified, secure device.

• Device trust: Each registration is tied to a specific device and browser context, providing continuity and control.

• Risk-based approach: Today, SERA covers low- to medium-risk actions, while higher-sensitivity operations continue to use additional verification layers.

• Auditability: Every approval leaves a tamper-evident record, giving us complete traceability for investigations and compliance.

These guardrails help ensure that as SERA scales, our confidence in every action remains just as strong.

Balancing security and velocity is hard: Security systems are often seen as blockers, especially when they interrupt core engineering workflows. Our goal with SERA was to raise the security bar without slowing teams down — and we believe passkeys help us get closer to that balance.

Security as an enabler: By removing the need for VPNs and Slack-based approvals, we've made it easier for engineers to move quickly without compromising on assurance. Thoughtful platform design can reduce friction and improve security at the same time.

More use cases ahead: SERA was designed as a general-purpose platform for verifying user intent. Beyond access approvals, we're exploring how it can support:

• Pull request approvals

• Deployment approvals

• Other binary decision points that require verified user interaction

More broadly, SERA embodies how we approach security at Robinhood: through engineering, not compromise. We believe the safest systems are the ones that make it easy for people to do the right thing.

At Robinhood, we see security as something that enables our success — it is a design problem waiting to be solved. SERA is one example of how our teams work together to create solutions that protect users, empower engineers, and move fast responsibly.

If you're passionate about solving real-world security problems at scale—whether it's authentication, infrastructure hardening, or building next-gen detection—we'd love to hear from you.

Check out our open roles on the careers page and join us in democratizing finance for all. Securely.

Shreyas Sriram is a member of Robinhood's Proactive Security team, where he led the SERA project from concept to launch. His current focus is security preparedness for the AI era, spanning continuous vulnerability management and close collaboration with infrastructure teams to redesign systems for it.