HolidayCheck is one of the largest independent travel portals on the German-speaking market, and the company’s dedication to building trust with its customers is a major reason why. With as many as 13 million monthly visits generating a total of over 9.4 million written reviews for more than 900,000 hotels — not to mention over 10 million holiday photos — the travel giant gives customers as much information as possible to help them plan perfect vacation.

“Most of the people I know do a big holiday once a year, and user-generated content becomes super handy,” says Björn Zapadlo, Director of Technology for HolidayCheck. “You know what you are booking. And I think this is what we at HolidayCheck stand for: to provide the best information, so that you don't get any bad surprises. Knowing that a real, verified person is behind the content is a big benefit.” 

Trust is critical for HolidayCheck. Users need to be able to trust that the reviews they are reading are accurate. They also need to be able to trust that the company is working in their best interests, and that the data they are providing the company with is secure. HolidayCheck relies heavily on user-generated content, which means making it easy for users to sign up and provide that content is critical. To better facilitate that process, the company began searching for a reliable authentication provider.

Trust Is the Most Important Currency for HolidayCheck

As HolidayCheck has grown, expanding into new platforms and services, the need for effective and consistent authentication has grown in equal measure. Whether users are submitting reviews or searching for their dream vacation, visiting the company website or using the HolidayCheck app, they need to trust that their information is safe. 

 “Proper authentication builds trust between you and your customers,” explains Stefan Lau, software engineer, HolidayCheck. “If authentication works well and reliably and becomes very low friction for the user, that just means to the user that you're building a well-working website. It's important that users can also trust you with providing their data. That's what you're doing with login or identity management: you're providing data to a company and you usually don't do that if you don't trust them.” 

Prior to partnering with Auth0, HolidayCheck used an in-house identity solution, but found that the process of manual upkeep and development became cumbersome as the company added new features, platforms, clients, and services. The company eventually decided to turn to an independently certified and GDPR-compliant third-party identity provider — and they haven’t looked back.

“I sleep quite well using Auth0, which is a good sign for me,” jokes Zapadlo. “Auth0 can do authentication much better than we can do because they are the experts. And for me, this is the most important thing, and this is the reason why I sleep that well. Because I believe, from a risk assessment point of view, that we could do authentication on our own — but we could not do it as well.”

Auth0 Does the Work of a Full Development Team

Zapadlo estimates that it would take a team of five or six developers, each making up to €500 per day, to create an in-house product capable of matching Auth0’s level of service. Lau further explains that turning to Auth0 for authentication not only saves personnel, but helps make developing new features and integrating new services and clients much easier for the existing development team.

“Because we have Auth0 on all our services and clients, it doesn't matter if the user authenticates it with the app or the website or some other machine-to-machine authentication,” he says. “You use that token the same way everywhere. You only need to know to consume it as a service, how it would validate this JSON web token, which is a standard. That makes the development of user-based features a lot faster.”

To Zapadlo, the simplicity of integrating new identify features with Auth0’s identity management service is one of its most important features. Rather than attempt to integrate each new product themselves, they can move forward with the confidence that Auth0 will take care of it for them.

“It was always a real pain when there was someone new in the market providing a single sign-on feature, and we had to integrate it into our authentication solution ourselves. Now we can just switch it on in Auth0 and it works, just like with the recent Sign In with Apple,” he says. “I'm happy with the decision that we gave authentication to Auth0, and I still believe it is the right choice. And I would make the same decision now.”