Security at D-Sports
High-level overview of how D-Sports Alliance LLC approaches custodial wallet key management, infrastructure access, responsible disclosure, and what we have (and have not) published about audits and incidents.
Last updated: September 9, 2026
Overview
D-Sports Engage includes a wallet that is custodial by default: encrypted recovery phrases and private keys are generated and stored by D-Sports so the product can sign and recover after PIN verification. This page is a public summary for users and researchers. It is not a penetration-test report and does not claim third-party certifications we have not published.
Key management and custody
For the default custodial wallet, D-Sports generates the mnemonic and derives the private key on the server. Ciphertext is stored using AES-256-GCM. Encryption keys are derived with PBKDF2 (100,000 iterations) and a unique salt per wallet record, with authentication tags. Transaction signing and recovery-phrase reveal are server-side operations gated by a six-digit PIN verified against a stored PIN hash.
Encrypted-at-rest is not equivalent to “we never store keys.” We deliberately hold encrypted key material for custodial wallets. Users who require non-custodial key storage should link an external Web3 wallet; D-Sports does not hold those external private keys. Supported chains for custodial operations include Ethereum, Polygon, and Arbitrum as enabled in the product.
Device security and PIN secrecy remain the user’s responsibility. Exporting a recovery phrase transfers control risk to whoever holds that phrase.
Infrastructure and access
Product and marketing web surfaces deploy primarily on Vercel. Authentication for the product app uses Clerk. Operational practice aims at least-privilege access to production systems, TLS for data in transit, and monitoring aimed at detecting abuse. docs.d-sports.org may still be fronted by Cloudflare while serving from Vercel/Mintlify; the marketing apex is DNS-only to Vercel.
This section describes posture at a high level. It does not publish network diagrams, key-rotation schedules, or internal runbooks.
Responsible disclosure
We welcome good-faith reports of security vulnerabilities. Please email admin@d-sports.org with subject line Security disclosure. Include steps to reproduce, affected endpoints or builds, and impact assessment. Do not access other users’ data, destroy data, or disrupt availability beyond the minimum needed to demonstrate the issue.
We will acknowledge receipt when practicable, investigate, and work toward a fix before any coordinated public disclosure.
Bug bounty
There is no public bug bounty program at this time. We still appreciate responsible reports to admin@d-sports.org.
Audit status
As of the date on this page, D-Sports has not published a third-party security audit report on d-sports.org. If an independent audit is completed and approved for public release, we will summarize scope, date, and firm identity here without implying certifications we do not hold.
Incident history and response contact
As of the date on this page, D-Sports has not published a public security incident disclosure on this site. Absence of a published disclosure is not a warranty that no security issues have ever occurred in private systems; it means no public incident report is available here.
If a personal-data breach requires notification under applicable law, we will notify affected users as described in the Privacy Policy. Material public incidents will be summarized on this page after containment. For urgent security matters, contact admin@d-sports.org. For ordinary account help, use support@d-sports.org or /support.
Updates
We may update this page when custody controls, disclosure contacts, or public audit / incident status change. Check the “Last updated” date above. Related documents: Terms of Service, Privacy Policy, and Support.