xOpenBank: PSD3/Open Finance Secure Data Sharing

15 Seconds to First Transaction

Traditional open banking integration requires OAuth provider registration, API key management, webhook configuration, and SCA server setup (42-67 minutes). xopenbank collapses this to 15 seconds with zero-click accept, 90 seconds with CLI, and 10 minutes with deploy buttons.

Zero-Click Setup (15 seconds)

# 1. Set invite code (from partner onboarding email)
export XOPENBANK_INVITE_CODE=XOB-abc123

# 2. Initialize your first bank aggregation (auto-accepts invite)
npx @private.me/xopenbank aggregate \
  --provider gdpr-psd3-eu \
  --scopes accounts,transactions,payments \
  --threshold 2-of-3

What happens:

1. Invite auto-accepted from XOPENBANK_INVITE_CODE env var
2. Service DID generated and saved to .env
3. OAuth flow initiated with bank provider
4. Account data split via XorIDA (2-of-3)
5. Compliance logging enabled
6. Ready to fetch accounts

Total time: ~15 seconds

CLI Setup (90 seconds)

# Install CLI globally
npm install -g @private.me/xopenbank

# Initialize (generates service DID, saves to .env)
xopenbank init

# Connect your first bank
xopenbank connect \
  --provider gdpr-psd3-eu \
  --scopes accounts,transactions,payments \
  --threshold 2-of-3

# Output:
# ✅ Service DID generated
# ✅ OAuth flow initiated
# ✅ Account aggregation configured
# ✅ Ready to fetch accounts

Deploy Button Setup (10 minutes)

Click one button to provision OAuth server + compliance logging + reconciliation engine:

Includes:

• OAuth callback server (PSD3/GDPR-compliant)
• SCA verification endpoints (OTP, biometric, hardware key)
• Compliance event logging (HMAC-chained audit trail)
• Reconciliation engine (multi-bank transaction matching)

After deployment:

• Environment variables auto-configured
• Service DID auto-generated
• Ready to connect banks immediately

The Problem

PSD3 and Open Banking mandates require banks to share customer data with authorized third parties, but current API-based sharing exposes complete records to every authorized consumer.

Open Banking APIs give third-party providers full access to customer transaction data. A single TPP breach exposes thousands of bank customers. PSD3 expands the scope to savings, investments, and insurance.

Banks must balance regulatory compliance (share data) with duty of care (protect data). Current architectures make this trade-off binary: share everything or share nothing.

The Old Way

The PRIVATE.ME Solution

xOpenBank enables granular Open Finance data sharing where customer data is split via XorIDA so no single third party holds complete records. xLink authenticates all parties with DID identity.

Customer data is shared via XorIDA split-channel with configurable granularity. Third parties receive only the shares they need. xChange provides unconditionally secure key transport for the data exchange.

Customer consent is cryptographically bound to specific data scopes and third parties via DID-signed authorization tokens. Revocation is instant.

The New Way

How It Works

xOpenBank combines xLink DID identity, xChange key transport, and XorIDA split-channel to create privacy-preserving Open Finance data sharing.

Use Cases

Integration

import { OpenFinanceGateway } from '@private.me/xopenbank';

const gw = await OpenFinanceGateway.create({
  bankDid: bankDid,
  tppDid: tppDid,
  scopes: ['accounts.read', 'transactions.read'],
  threshold: { k: 2, n: 3 }
});

Security Properties

Verifiable Data Protection

Every operation in this ACI produces a verifiable audit trail via xProve. HMAC-chained integrity proofs let auditors confirm that data was split, stored, and reconstructed correctly — without accessing the data itself.

Ready to deploy xOpenBank?

Talk to Ren, our AI sales engineer, or book a live demo with our team.

Ship Proofs, Not Source

xOpenbank generates cryptographic proofs of correct execution without exposing proprietary algorithms. Verify integrity using zero-knowledge proofs — no source code required.

Use Cases