How DXAPlay protects money, data and access: infrastructure, identity, data protection, engineering practice and AI controls.
Short-lived signed tokens between services, signed webhooks with replay protection, a guard against server-side request forgery, a least-privilege database role, scrypt password hashing, role-based access in the back office, encrypted integration secrets and a central audit log.
Cloud hosting behind Cloudflare, a managed PostgreSQL database with encrypted connections, and automated checks on every change: type checks, unit, contract and integration tests, and a migration dry run.
| Control | How it works |
|---|---|
| Hosting | The platform runs on AWS in the United States (us-east-2, Ohio), behind Cloudflare's network, DNS and web application firewall. |
| Database | Managed PostgreSQL. Connections are encrypted with TLS. |
| Encryption in transit | HTTPS for every public endpoint and TLS for database connections. |
| Encryption at rest | Provided by our hosting and database providers. |
| Backups | Our managed database provider offers point-in-time restore of platform data. |
| Control | How it works |
|---|---|
| Role-based access control | Six back-office roles with module permissions, enforced on every request. |
| Service-to-service security | Short-lived signed tokens between services with audience checks, signed webhooks with replay protection, and a guard against server-side request forgery. |
| Secrets | Deployment secrets are held in protected CI environments, and integration secrets are encrypted with AES-256-GCM. |
| Passwords and API keys | Passwords are hashed with scrypt. API keys are stored as SHA-256 hashes and shown only once. |
| Least privilege | The application connects to the database with a restricted role that cannot alter the schema. |
| Control | How it works |
|---|---|
| Customer data separation | Operators, brands and their records are separated in the data model, and money paths are pinned to each brand. |
| Audit logging | A central audit log records compliance decisions, status changes and key operator actions across the platform's services. |
| Data retention | Retention periods are set out in the Privacy Policy. |
| Sub-processors | Listed publicly, with advance notice to customers before a new one processes player data. |
| Data processing agreement | Part of every customer contract. |
| Service levels | Agreed per customer in the order form. |
| Breach notification | Customers are told of a confirmed personal-data breach affecting their data without undue delay. |
| Control | How it works |
|---|---|
| Secure development | Every change goes through a pull request and automated checks: type checks, unit tests, database-backed contract tests, integration tests and a migration dry run. |
| Money correctness | Real-money movements are recorded double-entry in the ledger and carry an idempotency key, and balances can never go negative. |
| Compliance gate | Bets on the platform's own games and sportsbook, deposits, withdrawal requests and prizes are checked against holds, limits and exclusions before they run. |
| Control | How it works |
|---|---|
| AI model provider | The AI features use Anthropic's Claude models. Anthropic is on the sub-processor list. |
| AI data handling | The AI assistants send aggregated figures, catalogues and the operator's own text. They do not send player records. |
| AI training policy | Customer and player data is not used to train shared models unless an explicit, legally reviewed agreement permits it. |
| AI approval controls | AI assistants never act on their own: a person reviews and saves every result. Agents act only within their execution level, and restricted decisions always go to an authorized person. |
| Control | How it works |
|---|---|
| Security headers | HTTPS only (HSTS), a strict Content Security Policy, no framing, and strict referrer and permissions policies. |
| Cookies and tracking | No advertising or tracking cookies. Fonts are self-hosted. Page statistics are first-party and cookie-less. |
| Forms | Enquiries are stored in a private database. Bot traps and rate limits protect the forms, and network addresses are kept only as short-lived hashes. |
If you believe you have found a security problem in DXAPlay, please tell us through the contact form with the topic "Security report". Include enough detail for us to reproduce it.
Please do not access, change or delete data that is not yours, do not degrade the service, and give us reasonable time to fix the problem before you disclose it. We will acknowledge your report and keep you informed.
Ask during your demo or through the contact form.