Protection
Certified DRM for video you are required to protect
Certified DRM makes every playback conditional on a licence: the request reruns your authorisation rules before a viewer can decrypt anything, and a session that has been substituted, replayed or revoked is refused. That is the control a distribution agreement means when it asks for DRM, and it is worth understanding before you commit a library to it.
Key requests
- app.yourcompany.com
- ✓ key issued — origin allowed
- copied-embed.example.net
- ✕ refused — not on the allowlist
The problem
Why a licensing layer exists at all
Encrypted delivery solves interception: pull a segment off the wire and you get ciphertext. It does not solve authorisation, because the key still has to reach a player somewhere, and a player is software running on a machine you do not control.
That gap is what certified DRM addresses. Instead of the player holding a key, it must ask for a licence each time, and the answer can depend on who is asking, from where, and whether that session is still valid. The consequence for you is practical: a session that leaks can be refused later, rather than remaining valid because it once was.
Where a distribution agreement or a rights holder specifies DRM, this is the layer they mean, and the obligation settles the decision for that project. Where nothing specifies it, weigh licence-level authorisation against the packaging and device requirements it brings, and compare it with what encryption, domain rules and signed links already give you for the material in question.
The mechanism
What the platform actually does
Four statements, each backed by current platform source.
- Three certified DRM systemsPackaging and playback
- The platform has Widevine, PlayReady and FairPlay packaging and playback paths. Which system a given viewer uses is decided by their browser and device, not by you: Widevine on Chrome, Android and Chromecast; FairPlay on Safari, iOS, iPadOS and Apple TV; PlayReady on Edge, Windows and Xbox. Robustness follows the viewer’s own hardware and software, so test a protected video against the device mix your analytics show — Firefox and older devices vary most.
- Licence requests are re-authorisedPer playback
- A licence is not granted because a player asked politely. Each request reruns content and distribution authorization against your rules. This is the control that decides whether playback happens.
- Bad sessions are refusedPer request
- Licence requests are rejected when the app session is missing, substituted, replayed or revoked. A captured request cannot simply be replayed later, and a session you revoke stops working rather than continuing until it expires.
- One protection mode per projectConfiguration
- A project uses the applicable protection mode: DRM and HLS AES-128 are not enabled simultaneously. Choosing DRM for a project is therefore a decision about that whole project, not a per-video toggle you can mix freely. Certified DRM is an on-demand protection; for a live event, HLS segment encryption is available for eligible live streams and plans, so confirm it for your stream when you plan one.
The workflow
Turning DRM on, in order
The order matters: two of these steps can invalidate the plan you had if you leave them to the end.
- 01
Confirm entitlement
- 02
Decide the project boundary
- 03
Enable DRM on the project
- 04
Restrict where playback keys go
- 05
Test on the real device mix
Alongside DRM
The access controls that do the everyday work
DRM decides whether a licence is issued. These decide who is in a position to ask. In most real leaks, these matter more.
Domain-restricted playback
Where you have listed origins and the account-level encryption-key exemption is off, playback keys are issued only to those origins, and an embed copied to another site fails rather than quietly continuing to serve your video. An empty list or that exemption leaves key requests unrestricted.
Signed, expiring, view-limited links
A playback URL can be signed, time-limited and view-limited, so a link shared once does not become permanent access for everyone who receives it.
Viewer watermarking
When enabled and the data is available, playback can overlay an account-scoped subscriber ID or the client IP — so a capture that does escape points somewhere.
Other restrictions
If you need geographic or network-level restrictions, ask us what is currently configurable for your account rather than assuming from a feature list. We would rather confirm it than have you design around something unavailable.
Choosing
Who actually needs certified DRM
DRM earns its place in specific situations — and there are cheaper controls that fit the others better.
Licensed or third-party content
When a rights holder or distribution agreement names DRM, nothing else satisfies it. This is the clearest case, and the one to confirm entitlement for early.
High-value premium libraries
Where a single leaked title represents meaningful revenue, licence-level authorisation and revocation are worth the device complexity.
Paid courses and memberships
Usually better served by encryption plus signed links, domain restrictions and a subscriber watermark. The realistic threat is shared access, and attribution changes behaviour more than DRM does.
Public marketing video
Reach is the goal here, so leave protection off and let the video play everywhere. Spend the effort on distribution instead.
Questions
Questions people ask about DRM
What buyers ask before they commit a library to certified DRM.
Why three DRM systems rather than one?
Because the viewer chooses, not you. Google, Apple and Microsoft each ship their own system in their own browsers and devices, so covering a normal audience means packaging for all three. Having all three paths available is what makes a mixed audience workable — it is not a claim about a percentage of devices.
Does DRM stop screen recording?
No. Some device and configuration combinations degrade or block a capture, and many do not; it depends on hardware and software we cannot inspect per viewer. Plan on the assumption that the picture can be captured, and use watermarking so a capture is attributable.
Which devices and browsers work?
Chrome, Edge, Safari and their mobile equivalents each map to one of the three systems. Firefox and older or unusual devices vary. Rather than publish a coverage figure, test a protected video against the browsers and devices your own analytics show before you migrate anything.
What happens on a device that cannot play DRM?
Playback fails on that device rather than silently falling back to an unprotected copy — which is the correct behaviour for protected content, and the reason testing your real device mix matters. If a segment of your audience cannot be served, that is a decision to make deliberately.
Does it work inside my LMS or website?
DRM-protected video plays through the same player and embed as the rest of your library, on pages you control. Whether a specific third-party platform permits that embed, and whether your audience’s devices support the DRM, are both things to test rather than assume.
Is DRM available on my plan, and what does it cost?
Certified DRM is arranged per account rather than switched on by a plan tier, so the entitlement and the commercial terms are set for your case. Tell us the volume and the kind of content and we will confirm current availability and terms in writing.
Is DRM completely secure?
DRM raises the effort required and gives you a licence decision you can refuse and revoke — which is a genuine reduction in unauthorised use rather than a guarantee. Pair it with viewer watermarking when you also want a copy that escapes to point somewhere.
Confirm it against your plan and your devices
Tell us what you need to protect and who watches it. We will confirm what your plan entitles and where the device boundary sits, before you build anything on it.