Security
Security you can check, layer by layer
No platform makes copying impossible, and we will not pretend otherwise. What DynTube gives you is a set of layers—encryption, domain rules, private links, licences and watermarks—each with one job, so you can see which risk each one covers and switch on the ones you need.
Key requests
- learn.yourcompany.com.au
- ✓ key issued — domain allowed
- copied-embed.example.net
- ✕ refused — not on your list
The short answer
How secure is video and audio on DynTube?
On-demand video is delivered as encrypted HLS, and key requests follow the domain rules you set, so a copied embed on another site receives ciphertext and no key. Private links can be revoked, DRM licences are re-authorised per request where DRM is arranged, and watermarks can trace a capture to a viewer. None of it stops someone filming a screen.
The risk map
Which layer stops which risk?
Read across a row to see what acts on a risk. The empty cells matter as much as the full ones.
| Risk | L1Encrypted HLSOn-demand delivery | L2Domain rulesPer project | L3Private linksPer asset | L4DRM licencesArranged per account | L5Viewer watermarkWhere your plan includes it |
|---|---|---|---|---|---|
| Your embed code is pasted onto someone else’s siteWith a non-empty domain list, key requests from other sites are refused. An empty list leaves keys unrestricted. | Not addressed | Blocks | Not addressed | Not addressed | Not addressed |
| The stream address is lifted from the page and fetched directlySegments are ciphertext; playback needs a key that follows your rules. Determined tools can still try, so treat this as effort, not a wall. | Raises effort | Raises effort | Not addressed | Raises effort | Not addressed |
| A private link is forwarded beyond its audienceRevoke the link, or issue an expiring or one-time link in the first place. Revoked links stop granting playback. | Not addressed | Not addressed | Blocks | Not addressed | Traces |
| A licensed playback session is replayed or reusedWhere DRM is arranged, each licence request reruns authorisation and is refused when the app session is missing, substituted, replayed or revoked. | Not addressed | Not addressed | Not addressed | Blocks | Not addressed |
| A viewer screen-records and reposts the contentNothing on this row prevents recording. A viewer watermark can point a capture at an account or IP when that data exists. | Not addressed | Not addressed | Not addressed | Not addressed | Traces |
Risk 01
Your embed code is pasted onto someone else’s site
With a non-empty domain list, key requests from other sites are refused. An empty list leaves keys unrestricted.
- Domain rulesBlocks
Not addressed by: Encrypted HLS, Private links, DRM licences, Viewer watermark
Risk 02
The stream address is lifted from the page and fetched directly
Segments are ciphertext; playback needs a key that follows your rules. Determined tools can still try, so treat this as effort, not a wall.
- Encrypted HLSRaises effort
- Domain rulesRaises effort
- DRM licencesRaises effort
Not addressed by: Private links, Viewer watermark
Risk 03
A private link is forwarded beyond its audience
Revoke the link, or issue an expiring or one-time link in the first place. Revoked links stop granting playback.
- Private linksBlocks
- Viewer watermarkTraces
Not addressed by: Encrypted HLS, Domain rules, DRM licences
Risk 04
A licensed playback session is replayed or reused
Where DRM is arranged, each licence request reruns authorisation and is refused when the app session is missing, substituted, replayed or revoked.
- DRM licencesBlocks
Not addressed by: Encrypted HLS, Domain rules, Private links, Viewer watermark
Risk 05
A viewer screen-records and reposts the content
Nothing on this row prevents recording. A viewer watermark can point a capture at an account or IP when that data exists.
- Viewer watermarkTraces
Not addressed by: Encrypted HLS, Domain rules, Private links, DRM licences
- Blocks
- The server refuses the key, licence or playback, under the conditions noted.
- Raises effort
- Harder or less useful to do. Never impossible.
- Traces
- A captured copy can carry an identifier, when identity data exists.
- Not addressed
- This layer does not address this risk.
DRM and encrypted HLS are alternative protection modes for a project, not both at once. Watermarking and DRM depend on your plan or account arrangement; confirm them before you rely on either for a launch.
Risk map for on-demand video; audio shares encrypted HLS, domain rules and private links
Media protection
What each layer actually does
One job per layer, described with the condition it depends on.
- Encrypted on-demand HLSVideo, where enabled
- Video segments are delivered AES-128 encrypted and the player requests a key for each playback, so an intercepted segment is not a directly watchable file.
- Domain and origin rulesPer project
- List the sites allowed to play your media. Key requests from anywhere else are refused, so the same embed on another site receives ciphertext and no key.
- Private linksVideo, audio, live and blocks
- Share playback without a public page through permanent, expiring or one-time links, and revoke a link the moment it travels too far.
- DRM licence controlArranged per account
- Widevine, PlayReady and FairPlay paths, where each licence request reruns authorisation and is refused for a missing, substituted, replayed or revoked session.
- Viewer watermark and Screen ShieldWhere your plan includes it
- Overlay a subscriber ID or client IP when that data exists, or a moving low-opacity pattern that makes a capture look obviously copied. Both deter and attribute; neither prevents recording.
- Encrypted audio deliveryAudio projects, where chosen
- Audio streams as audio-only HLS. Set an audio project’s playback protection to encrypted HLS and its segments are AES-128 encrypted, with keys served only against a valid playback token.
Sample data: a paid course library
- Encrypted HLS on every project
- Domain list: learn.yourcompany.com.au
- Expiring links for assessment videos
- Viewer watermark: subscriber ID
Account security
How is my DynTube account protected?
The controls around sign-in and the forms on this site, as they are built today.
Two-factor sign-in
Protect dashboard sign-in with a second step: a code from an authenticator app, or a one-time code sent by email, depending on how the account verifies.
Passwords stored as one-way hashes
Passwords are kept as salted one-way hashes, never as readable text, and two-factor secrets are stored encrypted.
Forged-request protection
Sign-in and account forms carry signed CSRF tokens, so another site cannot submit them on your behalf.
Bot checks and rate limits
Sign-up, sign-in, password reset, two-factor and public forms use a a CAPTCHA challenge check, and repeated attempts are rate limited.
Data handling
What happens to my data and payment details?
In plain words, from the privacy policy. The policy itself is the binding text.
Payments go through Paddle, as merchant of record, or directly through Stripe. Card processing is done by a PCI DSS compliant third party; DynTube keeps only an encrypted token, the last four digits and the expiry date.
The policy says DynTube will not sell your personal information to enhance its marketing or profitability, except as may relate to a corporate event such as a sale or merger. You can ask for your personal or business data to be deleted through the contact page. The policy also records that our team may access account data and videos to check compliance with our terms.
Questions
Security questions
Including the ones with uncomfortable answers.
Can DynTube stop people recording my videos?
No platform can stop someone pointing a camera or capture tool at a screen they are allowed to watch. DynTube controls who can play your media and where, and a viewer watermark can trace a capture back to an account or IP when that data exists. See screen recording protection for Ajar.
Which compliance certifications does DynTube hold?
This page lists no compliance certifications, because none is published here for you to verify. If your procurement process needs a security questionnaire or specific attestations, contact us and ask for them in writing before you commit.
Do I need DRM, or is encrypted HLS enough?
For most private and paid libraries, encrypted HLS with a domain list is the right starting point and takes minutes to set up. DRM matters when a distribution agreement requires licence-based playback. A project uses one mode or the other, not both.
Is live streaming encrypted too?
Live protection depends on the stream engine and your plan, so it is described on its own page rather than promised here. Check encrypted live streaming for what is currently qualified, and confirm it for your stream before an event.
Does DynTube support two-factor authentication?
Yes. Dashboard sign-in can require a second step, either a code from an authenticator app or a one-time code sent by email, depending on how the account verifies.
Test the layers on one private video
Upload a file, set a domain list, paste the embed on a site that is not on it, and watch it refuse to play.