Your unreleased master files and studio revenue are your most valuable assets. Delivami combines private Cloudflare R2 vaults, signed Stream proxy tokens, Dojah KYC, and automated 24-hour payout security holds so you and your clients can deliver with complete confidence.
Delivami separates what your client reviews from what they download. High-resolution master files—ProRes 422 video cuts, RAW photo sets, multi-track WAV stems, and vector packages—never leave private Cloudflare R2 storage buckets until the linked invoice is verified via signed Paystack webhook.
Original master files are stored in non-public Cloudflare R2 buckets with AES-256-GCM encryption at rest. Direct bucket URLs are never exposed to the client browser.
Before payment settles, clients review adaptive-bitrate Cloudflare Stream HLS proxies authorized via short-lived playback tokens, overlaid with your studio watermark on Pro and Studio plans.
Delivami never unlocks downloads based on browser redirects alone. Presigned master download URLs are generated only after an HMAC-signed settlement webhook confirms payment.
Every delivery folder uses an unguessable high-entropy slug (dlv_...) with optional password protection, link expiration dates, and instant revocation from your dashboard.
Delivami never recompresses, downsamples, or strips color profiles or metadata from your source masters. What you upload is byte-for-byte what your client downloads after checkout.
Uploaded files undergo strict MIME-to-extension verification and pre-upload malware scanning via Cloudmersive before entering your project workspace.
Every request in Delivami derives userId, organizationId, and role from a server-verified Better Auth session. Studio accounts are hardened with FIDO2 passkeys and TOTP 2FA, while clients authenticate into their portal using 6-digit email codes.
Clients sign into /portal/:slug using a 6-digit One-Time Password sent to their verified email address—protected by Cloudflare Turnstile and rate-limit bindings.
Studios can bind TouchID, FaceID, Windows Hello, or hardware YubiKeys alongside TOTP authenticator apps. Sensitive actions like withdrawals require live step-up authentication.
Multi-seat Studio workspaces enforce strict Owner, Admin, Member, and Viewer permissions on every database query, and restrict team balance withdrawals exclusively to the Workspace Owner.
Multi-signer proposals capture sequential OTP-verified e-signatures and generate a deterministic SHA-256 document hash so either party can verify contract integrity at any time.
Active sessions are protected by double-submit CSRF tokens, idle timeouts, and device fingerprinting—with live session revocation and emergency locking via /secure-account.
Every delivery view, comment, file approval, API key action, and payout request is recorded with timestamp and IP metadata in immutable studio audit logs.
Because Delivami safeguards both your studio earnings and your unreleased intellectual property, we enforce banking-grade KYC verification, automated withdrawal cool-downs, and strict data isolation.
Changing your payout bank/Mobile Money account, password, email, or 2FA triggers an automatic 24-hour withdrawal freeze (12 hours for phone edits) and cancels unconfirmed payouts.
Manual withdrawals require clicking a 30-minute single-use confirmation link (/confirm-withdrawal) bearing your personal Anti-Phishing Code, while locking your user row with SELECT ... FOR UPDATE.
Identity verification is powered by Dojah EasyOnboard. Delivami stores only a keyed HMAC-SHA256 hash of your ID to enforce one account per identity and matches your legal name to your bank/MoMo account.
All Mobile Money, bank transfer, and card checkouts run through Paystack (a Stripe company). Delivami never stores raw card numbers and encrypts payout account numbers with AES-256-GCM.
Export your complete studio archive anytime via /api/user/gdpr-export. Account deletion requests include a 30-day restoration window before permanent R2/Stream purge and 6-year anonymized tax retention.
Voice note transcription and comment summaries run on isolated Cloudflare Workers AI and AssemblyAI pipelines with a strict contractual and technical ban on training models on your media.
Join independent creators and production studios delivering high-value work with automated Pay-Before-Download protection and verified local and international payouts.
