Skip to main content

Your work and money,kept where they belong.

The short version: your money never passes through us, your keys are encrypted, and clients only see their own work.

0%
of your payments, on every plan
AES-256
encryption on your gateway keys
1 link
per client, opening only their work
Get your inquiry linkGSee who can see what

Free plan. No card needed.

  1. Each client sees only their own link
  2. Gateway keys stay encrypted
  3. Signed stays signed

Your money never touches Delivvo

Your client pays on your gateway's page and the money settles in your account. Delivvo sends the link and records the payment.

Where a payment goes
1Your client paysOn your gateway's own page.
2Your gatewaycheckout.stripe.comCard details stay there.
3Your bankSettled to you.
Delivvo sends the link and never holds the money.0%

Your gateway keys are encrypted

To create pay links for you, Delivvo needs the API keys for your gateway. This is what happens to them.

What happens to a gateway key
1You paste it oncesk_live_51Q••••••8fZ2In your settings, over a secure connection.
2Checked, then a codeWe test the key with your gateway and email you a 6-digit code.
3Stored encryptedv1.Hx2rQ…9Qk=.k3T…AES-256-GCM, with a key kept outside the database.
4Used at payment timeDecrypted on our server to make the pay link, and nowhere else.

Connecting a gateway, step by step.

This is the real Connect sheet. Nothing is saved until your gateway accepts the keys and you confirm the code.

Paste your keys

Who can see what.

Each person sees their own part and nothing else.

WhoSeesNever sees
Your clientTheir own portal: their projects, files, messages and invoices.Another client's work.
Your teamWhat their role allows. You pick the role when you invite them.Anything their role hides.
Delivvo's adminsAccount and document details. Opening a document or a support view needs a written reason and is logged.Your gateway keys, or any way to move your money.
Card and bank detailsYour gateway, on its own secure page.Delivvo. We never see or store them.
What Delivvo's admins can see, in full

Signed documents stay as they were signed

When a client signs, Delivvo records the time, the IP address and the device, takes a SHA-256 fingerprint of the document and locks it. A signed copy is archived and kept even if the project is deleted later.

Signing record
Document
Wedding styling contract
Signed by
Megan Shaw
When
14 Oct 2026, 6:42 PM
IP address
94.200.•••.17
Device
iPhone, Safari
Fingerprint (SHA-256)
a3f9 1c07 5be2 … 07d1 9e42

Archived. Kept even if the project is deleted.

Where your data is stored

Three places, each with one job.

  • Your account dataSupabase on Amazon Web Services in Singapore (ap-southeast-1). Stored data is encrypted at rest.
  • Your filesCloudflare R2. Every download is a short-lived signed link, issued after we check who is asking.
  • The appVercel, in the same Singapore region. Everything travels over HTTPS.

If where your data lives changes, this page changes first.

What we don't claim

Delivvo is a young product. We don't claim certifications we haven't earned, such as SOC 2 or ISO 27001. If your work needs a specific standard, open a support request and we'll tell you honestly where we stand.

When leads and clients share personal details through your forms, you decide what is collected and Delivvo processes it for you. The details are in our privacy policy and data processing agreement.

Questions about security.

More answers on the FAQ page

Does Delivvo ever hold my money?

No. Clients pay through your own connected gateway, straight to your account. Delivvo is not the merchant of record and never keeps a balance, so there is no payout delay from us.

Where are my payment gateway keys stored?

In our database, encrypted with AES-256-GCM before they are written. The encryption key lives outside the database, and keys are only decrypted on our server when a payment needs them.

Does Delivvo see my client's card details?

No. Card and bank details go into your gateway's own secure checkout. We never see or store them.

Can one client see another client's files?

No. Access is separated per client in the database itself, not only in what the screen shows. A client's link only ever opens their own projects.

Where is my data stored?

Account data with Supabase on Amazon Web Services in Singapore, files in Cloudflare R2, and the app on Vercel in Singapore. Data is encrypted in transit, and Supabase encrypts stored data at rest.

Is Delivvo certified to a standard like SOC 2?

Not today, and we won't claim certifications we haven't earned. The privacy policy and data processing agreement set out how data is handled. If you need a specific standard, open a support request and we'll answer honestly.

Your inquiry link is free.

Free plan. No card needed.