For security sensitive open-source projects, it is desirable to provide reproducible builds. Given the same source code, a reproducible build will always create bit-identical output. That way users can take your source code and check whether the binaries you provided were tampered with, e.g. used a patched source code.
If your software is not executed by users but e.g. on your server as a SaaS offering, no good trust mechanism is possible. One way to handle this is to implement client-side/end-to-end encryption. That way, it is less important whether the server contains a backdoor since the server never sees plaintext data. However, this is not feasible for most applications.