Security and access control

Video security without enterprise prices

The videos worth protecting are usually the ones you sell or cannot share: a course module, an unreleased product briefing, a paid recording. Protecting them takes four decisions — encrypted delivery, the domains allowed to play it, how long a link lives and whether a copy can be traced — and none of them needs an enterprise contract.

Start free trialSee pricing
your-academy.example/lesson-1

Playback allowed on your-academy.example/lesson-1.

Same embed · two domains · one allowed

Illustration of domain-restricted key issuing, not a live security test of your account.

  • Encrypted where it matters

    On-demand segments are delivered AES-128 encrypted rather than as a downloadable file.

  • Access you decide

    Domains, links, expiry and view counts are your rules, not a platform default.

  • Traceable when it leaks

    A per-viewer watermark ties a redistributed copy back to the account that shared it.

  • Layered for stronger control

    Combine encryption, access rules and viewer attribution around the risk profile of each video.

The cost of getting it wrong

One shared file can end a product’s revenue

A course module posted in a group chat, an internal briefing forwarded outside the company, a paid recording on a download site — each is the same failure: the video left the experience you controlled and nothing stopped it playing elsewhere.

Without control

Video protected by obscurity

An unlisted link, a private page, a “do not share” note. All of it depends on nobody choosing to pass the file on.

  • The file itself is downloadable once the URL is known
  • An embed works anywhere it is pasted
  • A link shared once stays valid indefinitely
  • No way to tell which account leaked it

On your own terms

Video protected by access control

Playback depends on a key, and the key depends on rules you set. Sharing the URL is no longer the same as sharing the video.

  • Segments are encrypted, so the raw fetch returns ciphertext
  • Key requests follow the allowed-origin rules you configure
  • Links can expire and can be limited by view count
  • A per-viewer watermark identifies the source of a copy

Multi-layered video protection

Comprehensive video security features that work together

These layers are complementary and each one has a single job. Encryption protects delivered media, access control governs playback requests, licence control decides whether playback may proceed, and watermarking adds viewer-level attribution. Reach for them in that order.

Enterprise-grade encryptionOn-demand delivery
Segments are delivered AES-128 encrypted and the player requests a key per playback, so an intercepted encrypted segment is not a directly watchable media file. Video encryption is entitled on Pro and Enterprise plans by default.
Domain restrictionsPer project
Where a non-empty allowed-domain list applies and the account-level encryption-key exemption is off, keys are issued only to requests originating from the domains you list, and the same embed code lifted onto another site receives encrypted segments and no key, so playback simply does not start. An empty list or that exemption leaves key requests unrestricted, so check yours.
Token-based secure linksPer request
Playback URLs can be signed and verified for each request, so a link that leaves your system can be made short-lived rather than permanent.
Expiry and view limitsPer link
Set how long a link stays valid and how many plays it allows — useful for assessment video, previews and time-boxed access.
Geographic and IP rulesPer project
Restrict playback to the regions or networks where your audience is, which also narrows the surface for casual redistribution.
Dynamic watermarkingPro and Enterprise by default
Overlay per-viewer information on playback so a captured copy identifies its source, which reduces the value of redistributing it. Dynamic and IP watermarking are entitled on Pro and Enterprise plans by default; the pricing page renders the current inclusions.
DRM licence controlArranged per account
For content a distribution agreement requires it for, licence-based playback adds a per-request decision about whether playback may proceed. Certified DRM is arranged per account rather than switched on by a plan tier — tell us the requirement and we confirm the entitlement in writing.
#EXTM3U
#EXT-X-KEY:METHOD=AES-128
URI="…/key"
segment_0042.ts → ciphertext

Key requests

your-academy.example
✓ issued
app.your-academy.example
✓ issued
not-your-site.example
✕ denied
direct segment fetch
✕ ciphertext

Getting there

Turning protection on takes about ten minutes

Nothing here needs a migration project. The order matters more than the effort: allow your domains before you publish, not after someone copies the embed.

  1. 01

    Turn on encryption for the project

    Encryption is a project setting, so it applies to everything you upload into that project from then on.

  2. 02

    List the domains that may play the video

    Add your site, your app and any staging host. Everything else is refused a key from that moment.

  3. 03

    Decide how links behave

    Choose whether playback links expire, how many views they allow, and whether they are signed per request.

  4. 04

    Embed once and check the refusal

    Paste the embed on your page, then try it somewhere that is not on the list. Seeing it fail is the test that matters.

Questions

Video security questions

Can my videos still be downloaded?

Encryption and domain restrictions change what a URL is worth: an intercepted encrypted segment is not a directly watchable media file, and — once you have listed domains and left the account-level key exemption off — a copied embed receives no key and never starts. Capture on a viewer's own screen is a different problem, and watermarking is the layer that reduces its value by making a copy attributable.

What does domain restriction actually stop?

Once you have listed origins and left the account-level encryption-key exemption off, playback keys are issued only to requests coming from those origins, and someone who copies your embed code onto another site gets encrypted segments and no key, so the player never starts. An empty list or that exemption leaves key requests unrestricted. It does not stop someone who is already an authorised viewer from recording their own screen.

Is live streaming encrypted too?

Not by default. HLS segment encryption is available for eligible live streams and plans; availability depends on the stream configuration, so confirm it before a sensitive event. Encryption is also not access control: if an event needs restricted access, plan it around the controls that gate the page the stream plays on rather than assuming the on-demand model carries over.

Which layer should I start with?

Encryption plus domain restrictions covers most paid and private libraries, and takes minutes to set up. Add signed links when playback URLs leave your system, and consider watermarking or DRM when the content is valuable enough that attribution or licence control matters.

Protect what you sell

Stop paying enterprise prices for video security.

Encrypted delivery, domain restrictions and signed links are part of the platform — not a tier you have to negotiate for.

Start free trialTalk to us