Subprocessors
Version 2026-10-27 · Last updated: November 2026
To deliver fast media streaming, encrypted vault storage, and reliable local and international payouts, Delivami engages the following carefully vetted third-party subprocessors. Each subprocessor is bound by written data protection obligations and processes data strictly for the purposes stated below.
1. Core Cloud, Storage & Real-Time Infrastructure
| Subprocessor | Role & Purpose | Data Processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Edge compute (Pages & Workers), encrypted master file vault (R2), adaptive video proxies (Stream), DB pooling (Hyperdrive), Durable Objects, Custom Hostnames, and bot defense (Turnstile). | Uploaded deliverables, HLS video streams, IP addresses, request metadata. | Global Edge Network / US / EU |
| Neon, Inc. | Managed serverless PostgreSQL primary and read-replica databases. | Workspace metadata, encrypted user profiles, invoices, comments, and audit logs. | United States / European Union |
| PartyKit (Cloudflare) | Real-time WebSocket infrastructure for live timeline comments and instant studio notifications. | Ephemeral comment events, presence indicators, and notification payloads. | Global Edge Network |
2. Payments, KYC Verification, Auth & Messaging
| Subprocessor | Role & Purpose | Data Processed | Location |
|---|---|---|---|
| Paystack (Stripe, Inc.) | PCI-DSS Level 1 checkout processing (Mobile Money, bank transfers, local & international cards), bank account resolution, and automated creator payouts. | Invoice totals, payment references, tokenized billing data, payout account numbers. | Nigeria, Ghana, Kenya, South Africa, EU / US |
| Dojah, Inc. | Know Your Customer (KYC) identity verification and AML compliance for creator payout onboarding. | Government-issued ID verification, biometric liveness check, verified legal name. | Nigeria, Ghana, Kenya / Cloud Infrastructure |
| Better Auth | Authentication engine managing encrypted sessions, TOTP 2FA, WebAuthn passkeys, and Google/GitHub OAuth SSO. | Session tokens, hashed credentials, OAuth account links. | Self-hosted on Delivami Edge Infrastructure |
| Resend, Inc. | Transactional email delivery for delivery links, 6-digit client OTPs, invoice receipts, and security alerts. | Recipient email addresses, studio names, transactional email bodies. | United States / EU |
| Twilio, Termii & Africa’s Talking | SMS and WhatsApp delivery for client portal OTP codes, payment links, and instant payout/approval alerts. | Recipient phone numbers and transactional notification text. | Global / Ghana, Nigeria, Kenya |
3. Private AI, Threat Screening & Diagnostics
| Subprocessor | Role & Purpose | Data Processed | Location |
|---|---|---|---|
| Cloudflare Workers AI | Localized edge AI inference for comment summarization, revision change detection, and plain-language invoice explanations (zero model training). | Ephemeral comment text, filenames, and invoice line-item descriptions. | Global Edge Network |
| AssemblyAI, Inc. | Asynchronous speech-to-text transcription and speaker diarization for long-form video and audio deliverables (2+ minutes). | Audio tracks of deliverables submitted for timecode transcription. | United States / EU |
| VirusTotal, Google Safe Browsing, AbuseIPDB & FingerprintJS | Pre-ingest malware scanning, phishing URL screening, IP reputation verification, and anti-fraud telemetry. | File hashes, external URLs, and connecting IP addresses. | United States / Global |
| Sentry (Functional Software, Inc.) | Real-time application error tracking and performance diagnostics. | Stack traces, request IDs, and anonymized browser telemetry. | United States / EU |
| PostHog, Amplitude & Google Analytics | Consent-gated product engagement and website traffic analytics (active only when user opts in via Cookie Consent). | Pseudonymous interaction events and page view telemetry. | United States / EU |
4. Optional Studio Integrations
If you explicitly connect third-party workspace integrations inside your studio settings—such as Slack (for real-time channel notifications on comments, approvals, and paid invoices) or QuickBooks Online (for automated invoice and payout accounting sync)—Delivami transmits the relevant project or invoice events to those connected accounts in accordance with your configuration.
5. Subprocessor Updates
We update this directory whenever we add or replace a subprocessor. Studio customers may subscribe to subprocessor change notifications or request compliance documentation by contacting legal@delivami.com.