Protection
Encrypted delivery for the video you sell
Encryption gives on-demand video one precise protection: an intercepted encrypted segment is not a directly watchable media file. Combine it with the domain rules you configure and playback stays inside the pages you publish it on, so a copied media URL is no longer a copy of the video.
Key requests
- listed-domain.com
- ✓ key issued
- unlisted-domain.net
- ✕ refused by allowlist
The problem
Why encrypted delivery matters
A plain HLS stream is a playlist and a series of media segments, all fetchable over HTTP. Anything that can read the playlist can download the segments and reassemble them, which is exactly what a browser extension or a command-line downloader does. No login is bypassed and nothing is broken; the files were simply available.
The consequence is that access control on your page becomes decorative. Someone who reaches the video once can keep a copy and hand out the media URL, and your gate never sees either event.
Encryption changes what those files are on their own. The segments still travel over HTTP, but each one is ciphertext, and the key that makes it playable is requested separately during playback. Which requests for that key succeed is governed by the domain rules on the account or project — which is configuration you do, not a property that arrives with encryption.
The mechanism
What the platform does, step by step
Four statements, each traceable to current platform behaviour.
- AES-128 packagingOn-demand HLS, at conversion
- On-demand HLS can be packaged with AES-128 encryption while the file is converted, where the plan makes video encryption available and the project produces plain HLS output. Video encryption is entitled on Pro and Enterprise plans by default, and the pricing page renders the current inclusions. It applies to output produced after the setting is saved and does not re-encrypt output that has already been packaged, so choose the mode for a project before you upload into it.
- What an interception amounts toIn transit
- The benefit is precise, and worth stating precisely: an intercepted encrypted segment is not a directly watchable media file. Where capture by a viewer you have already authorised is the concern, dynamic watermarking is the layer that makes that copy attributable.
- Key requests follow your domain rulesAccount and project
- Key requests are checked against the allowed-domain list, which you configure. An empty list means no origin restriction, a project can override the account list with a list that may itself be empty, and an account-level setting can exempt encryption-key requests from the check entirely. Configure it and confirm it; do not assume it.
- One protection mode per projectConfiguration
- A project uses the applicable protection mode: AES-128 and certified DRM are not enabled at the same time, and certified DRM uses CMAF where AES-128 needs plain HLS. Choosing protection is a project-level decision, made before content goes in.
The workflow
From upload to protected playback
Upload, encrypt, deliver, decrypt — with the configuration step at the front, where it belongs.
- 01
Choose the project and its protection mode
- 02
Upload and process
- 03
Set the domain rules that govern key requests
- 04
Embed on your own pages
- 05
Tighten the link where it matters
Alongside encryption
Layer encryption with access and attribution controls
Encryption governs one thing. These sit alongside it, and each does something encryption does not.
Domain restrictions
An allowed-domain list, applied to embedding and to key requests. It is configuration rather than a default: an empty list, an empty project override, or the account-level encryption-key exemption each leave requests unrestricted.
Signed and expiring links
Playback URLs that can be signed, time-limited and view-limited, so access has a shape rather than being permanent.
Viewer watermarking
Where your plan makes dynamic or IP watermarking available, the option is switched on, and identity text is available server-side, playback can overlay an account-scoped subscriber identifier or the client IP. Missing identity data produces no invented value.
Certified DRM
A licensing layer: each licence request reruns content and distribution authorization and rejects missing, substituted, replayed or revoked app sessions. It replaces AES-128 on that project rather than adding to it — see the DRM page for the boundary.
Questions
Questions about video encryption
The questions buyers ask before they move a paid library.
What is AES-128 video encryption?
AES-128 is a standard symmetric cipher. Applied to HLS, each media segment is encrypted as the video is packaged, so that the segment on its own is not a directly watchable media file — the player has to obtain the key separately in order to decode it. It is the same primitive used across the industry for on-demand delivery.
Can viewers download an encrypted video?
The encrypted segments travel over HTTP like anything else, and what an intercepted segment is not, on its own, is a directly watchable media file. What happens next depends on the key — and which key requests succeed depends on the domain rules you configure, which is why listing your origins is the step that turns encryption into real control.
What is the difference between AES-128 and certified DRM?
AES-128 encrypts delivery, and the key request is subject to whatever domain rules you have configured. Certified DRM adds a licensing layer: each licence request reruns content and distribution authorization and rejects missing, substituted, replayed or revoked app sessions. DRM is required by some distribution agreements and brings packaging and playback constraints AES-128 does not — it uses CMAF where AES-128 needs plain HLS. A project uses one or the other.
Do I need DRM if I already have AES-128?
Start with obligation: if a rights holder, a distribution contract or an internal policy specifies DRM, that decides it for that project. Absent an obligation, weigh what each mode does against the material you are publishing — the licence-level authorisation DRM reruns at playback, against the packaging, plan and device requirements it brings. A project uses one mode, so make the choice per project before content goes in.
Does encryption cover live streams?
Not automatically. On-demand delivery is encrypted, and HLS segment encryption is available for eligible live streams and plans — availability depends on the stream configuration, so confirm it for your stream before a sensitive event. Domain rules still govern where a live stream can be embedded, and encryption is a delivery protection rather than access control.
Which plans include encryption?
Video encryption is entitled on Pro and Enterprise plans by default. Inclusions come from the current billing catalogue, which the pricing page renders directly — read them there, and ask us to confirm in writing if a specific inclusion is decisive for your purchase.
Put a real video behind it
Upload something of your own, set your allowed domains, and try to play it from somewhere else. That test tells you more than any security page can.