Private video
Private video hosting for internal training
Training material that should only be seen by staff needs more than an unlisted link. Here, playback keys are issued only to the domains you list, every segment is encrypted as it is packaged, individual videos can be shared through signed links that expire, and a watermark can attribute a copy that escapes. All of it is available on the first paid plan.
Internal, and it stays internal
The controls
Four layers that keep internal video internal
Each does a different job, and they combine. Together they cover the realistic ways staff-only video gets out.
- Encrypted on-demand deliveryEvery plan
- Each HLS segment is encrypted as it is packaged, so a segment intercepted in transit is not a watchable file on its own. This is the base layer everything else builds on.
- Playback restricted to your own domainsEvery plan
- Add your intranet, portal or LMS domains to an allowlist and the playback key is only issued to requests from them. An embed snippet copied onto another site asks for the key from an origin you have not allowed, and does not get it.
- Signed links that expireEvery plan
- For a video that has to reach someone outside the portal — a contractor, an auditor, a new starter before their account exists — generate a signed private link. It can be revealed, rotated or revoked per video, so access ends when you decide rather than when someone remembers.
- Dynamic watermarkingEvery plan
- An overlay applied at playback gives you attribution if a recording does circulate. It does not prevent capture; it makes an escaped copy traceable, which changes behaviour more than most technical controls do.
- Projects per departmentOrganisation
- Group induction, compliance and product training into separate projects that carry their own configuration, so the right protection settings apply automatically to new material.
- Choose the reporting level you needPlus and larger for user IDs
- Use aggregate plays, watch time and completion for broad programme health. On Plus and larger plans, pass your own user ID — such as an employee or learner ID — in the embed when individual viewing history is part of your training process.
Setup
How to stand this up without a leak
The order matters: configure protection before anything is published, not afterwards.
- 01
1. Populate the origin allowlist first
- 02
2. Group material into projects
- 03
3. Prove the block, do not assume it
- 04
4. Decide the external-sharing route
- 05
5. Turn on watermarking for the sensitive set
- 06
6. Review access when people move
Where it fits
The internal libraries this suits
Onboarding and induction
Company orientation, policy and role-specific training delivered on the intranet, with completion reporting per video so you can see the programme is landing.
Compliance training
Mandatory material kept inside the business, restricted to your own domains, with aggregate reporting or customer-supplied learner IDs when individual follow-up is required.
Product and process training
Internal systems, unreleased features and operating procedures — the material you most want to keep off a public URL.
Recorded briefings
All-hands recordings and leadership updates, with chapters so people can find the part relevant to them.
Contractor and partner access
Signed links with an expiry give outside collaborators exactly the video they need, for exactly as long as they need it.
LMS-driven libraries
Where a learning system owns the catalogue, the REST API can publish, caption and retire video so the two never drift apart.
Questions
What internal-video owners ask
How private is private video hosting?
Playback keys are issued only to the domains on your allowlist, every segment is encrypted as it is packaged, and individual videos can be shared through signed links that expire. Populate the allowlist, leave the account-level exemptions off, and an embed copied onto another site stops playing in a browser. What remains possible is someone who is allowed to watch recording their screen, which is what watermarking addresses.
How do I check the restriction is working?
Paste one embed snippet on a page that is not on your allowlist and confirm it refuses to play. Do that before you publish the library, and again whenever the allowlist changes. It takes five minutes and it is the only assurance worth having.
How do I share one video with someone outside the company?
Generate a signed private link for that video. It can be revealed to the recipient, rotated if it needs replacing, and revoked when the engagement ends — so access has a defined end rather than depending on a link being forgotten.
Can I see which employee watched which video?
Yes, when your application supplies the identifier. On Plus and larger plans, add your employee or learner ID to the embed so analytics can map viewing back to that user. If you do not pass an identifier, aggregate reports still show programme-level plays, watch time and completion.
Do you support single sign-on or directory provisioning?
Not today, and we will not imply otherwise. Access to the video is controlled by the origin allowlist and signed links rather than by an identity integration, which works well when your intranet or LMS already authenticates the viewer before the page renders. If your policy specifically requires single sign-on or automated provisioning, ask us and get the answer in writing.
Which plan do I need for this?
Encrypted delivery, origin-restricted playback, signed private links and dynamic watermarking are on every published plan, starting at USD 24 a month with 300 GB of storage and 1 TB of monthly delivery. The band you need is decided by library size and monthly viewing, not by which controls you want.
What does watermarking actually achieve?
Attribution. An overlay applied at playback means a recording that circulates can be traced back, which is a genuine deterrent among people who know it is there. It is not a technical barrier to capture, and we do not present it as one.
Bring us your security requirements
Tell us what your policy actually demands and we will answer against it plainly, in writing, before you commit a library. That is a better conversation than a feature checklist.