EncryptionTLS in transit, and encryption at rest from our hosting providers
Access controlTwo-factor sign-in, team roles and sending-only API keys
IsolationRow-level security keeps every team’s data separate
SecretsAPI keys are stored hashed and shown only once
Signed webhooksVerify every event came from Delivrie
RegionDatabase and email sending in the EU (Ireland)
01Infrastructure
Delivrie runs on SOC 2 audited cloud infrastructure in the EU (Ireland). The providers we use are listed on our Subprocessors page. Production access is limited to the people who run the service and protected with two-factor authentication.
02Application security
- Every change is reviewed and deployed from version control.
- Webhooks are signed so you can verify they came from us.
- Email authentication (SPF, DKIM and DMARC) is set up for every domain you add.
- Addresses that bounce or complain are suppressed automatically to protect your reputation.
03Compliance
We follow the Nigeria Data Protection Act 2023 and the GDPR, as described in our Privacy Policy and DPA. We do not hold SOC 2 or ISO 27001 certification yet. Email security@delivrie.io for our answers to your security questionnaire.
04Responsible disclosure
Email security@delivrie.io with steps to reproduce. We reply within 2 business days, will not take legal action for good-faith research, and credit researchers who want it. Please do not access other customers’ data or run denial-of-service tests.
Questions about this policy?Email security@delivrie.io or write to South Circle, Lagos, Nigeria.
Contact us