Skip to main content

Onboarding

The onboarding process within the DEUSS ecosystem is divided into distinct flows: Partner Onboarding (e.g., Brokers, Distributors) and End-client Onboarding (SMEs/Issuers and Investors).

You can see how this process looks here: End-client (SME/Investor) Onboarding.

Partner Onboarding​

The onboarding of a new Partner is a highly secure, primarily off-platform process coordinated directly with the DEUSS team. It ensures that the partner's system integration is fully authenticated via Mutual TLS (mTLS).

Process Steps​

  1. Registration Request (Off-Platform): The partner contacts a DEUSS business or technical representative to request formal onboarding.
  2. Entity Creation (Backoffice UI): A DEUSS Backoffice administrator creates a new Partner entity in the Partner Service registry, assigning specific business roles and generating a unique partner_id (UUID).
  3. CSR Instructions: DEUSS sends the partner technical instructions for their Certificate Signing Request (CSR). Mandatory subject attributes include:
    • O (Organization): Must exactly match the generated partner_id.
    • OU (Organizational Unit): Must represent the designated role (e.g., BROKER).
  4. CSR Submission & Certificate Issuance: The partner generates a private key, creates the CSR, and securely transmits it to DEUSS DevOps. DEUSS verifies and signs the CSR, returning the public certificate.
  5. Connection Established: The partner configures their API Gateway/client to establish secure mTLS handshakes with DEUSS Core.

Once the partner is fully integrated and the API connection is established and verified, they can begin making calls to the DEUSS Core API directly from their own environment.

Whitelabel Application

To demonstrate these capabilities and illustrate the subsequent processes from a partner's perspective, a WHITELABEL application has been developed. This application acts as a reference implementation of a connected broker/distributor platform, showcasing how an integrated partner can build their own UI (such as a marketplace) on top of the DEUSS ecosystem.

End-client (SME/Investor) Onboarding​

The onboarding of end-clients ensures secure authentication, legal compliance (KYC/AML), and the setup of blockchain infrastructure.

Process Steps​

  1. Secure User Registration & Authentication: The user creates an identity via Keycloak. The platform mandates the use of Passkeys (WebAuthn) for secure, passwordless authentication.

  2. Platform Profile Setup (KYC): The user provides personal details and uploads a scan of a valid identity document along with selfies for liveness verification.

  3. Company Registration: The verified user registers their corporate entity, choosing between two roles:

    • Issuer: Small or medium enterprises (SMEs) looking to issue bonds.
    • Investor: Qualified entities looking to purchase and trade bonds.

    The user provides identifiers (TIN, National Business ID, LEI) and banking details (IBAN). The company is created in a "Not Submitted" state.

  4. Document Upload: The user uploads required corporate files (company statutes, organizational structure, audited financial statements).

  5. Submission for Review: The user submits the profile. The state changes to "Validation in progress" (Awaiting Review).

  6. Backoffice Approval Process: A Validator (Compliance) reviews the profile in the Validator App and clicks "Approve SME". The company status is updated to VERIFIED.

  7. Automated Wallet Provisioning: The DEUSS system triggers a background process (managed by JobRunnr) to provision a secure, dedicated company wallet on the blockchain. Once the on-chain confirmation is received, the company gains full platform access.