We are developing an website which serves end users of many organizations
(banks , municipalities etc).

We have already setup meetings with the banks and they've agreed to work with us.

Ok so let's say that a user user1 of bank bank1 is entering bank1's website - then he sees a legit certificate of bank1 and a link for newService1 - : "For using the new service please click here"

This way - user1 can be sure that the new service is trusted by bank1 since bank1 showed the link to user1.


But what about the scenario where user1 has entered newService1's website directly and NOT via bank1 ? How can I show the user that newService1's website is trusted via bank1 ?

Sure I can create a link (in newService1's website) which says : "This service is trusted by bank1 - click here to see confirmation page in bank1's website".

Are there any other trust mechanism which newService1's website can implement to show user1 that newService1's is trusted by bank1 ?

By trust I mean some kind of proof for user1 that bank1 has agreed to work with newService1's .

  • 4
    OAuth with the bank. I'm not sure that there could be any other way to establish trust with a 3rd party.
    – schroeder
    Aug 23, 2017 at 11:02
  • Then it's a messaging problem. Get the bank to host a page describing the relationship and link to it on your site.
    – schroeder
    Aug 23, 2017 at 11:15
  • Another what-if: a phisher craft an email pretend to be newService1's
    – mootmoot
    Aug 23, 2017 at 13:08

1 Answer 1


If it is possible in your scenario, you might want to "multi-host" your service, under a subdomain of their domain.
E.g. newService1.bank1.com, and have them provide you with their own HTTPS certificate.

This creates an environment where you not only trusted, but it is THEIR service - at least from the perspective of the user, especially if you provide whitelabel branding, their logo, etc.

Note that in this case, you should isolate the bank from other tenants' service - on the backend as much as is feasible, but especially from the user's PoV. E.g. don't make the user re-select which is his bank, or any other bank-defined configuration, you need to function as if you ARE the bank's system. Or if you send out emails to users, these should be identified as the bank's newservice.

(P.S. this also can give you some great marketing tools, onboarding options, and easier to close the sale with many organizations... )

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .