History says if you send any bitcoins to derivabit you will duly be relieved of them by some hacker.
Wouldn't the first priority be to establish escrow with a trusted third party, or use m-of-n transactions?
At the very least, build the site with full transparency so you can prove publicly, every 24 hours, that you control the private keys to all Bitcoins entrusted to you.