Practice · security

Copying a link does not copy access

Every stream is encrypted, keys are released only against signed expiring tokens, and the edge re-checks that token on every segment rather than once when playback begins. Secrets live in a vault, not in a config file and not in a wiki page.

Talk to us Reference architectures

Overview
Content protection
Platform security
Questions

Authorise the segment, not the session

A great deal of streaming security checks entitlement once, at the start of playback, and then serves everything that follows to whoever asks. That is convenient and it means a manifest URL, once copied, is a working copy of the film until it expires.

The alternative is to treat every segment request as a request that needs authorising. It costs a token verification per segment, which is cheap, and it means revocation takes effect mid-stream rather than at the next session.

Detail

Content protection

Encryption

Encrypted at packaging

AES-128 applied when the media is packaged, so an unencrypted rendition never exists on disk to be copied.

Encrypted at packaging time
No plaintext rendition at rest
Studio DRM is not running today

Keys

Released against a signed token

The key server answers only to a signed, expiring token issued for that viewer, that title and that window.

Signed, expiring tokens
Scoped per viewer and title
Short, deliberate lifetimes

Enforcement

Checked at the edge, per segment

The edge verifies on every segment. A shared link stops working the moment the token expires or the entitlement is withdrawn.

Per-segment verification
Mid-stream revocation
Licensing windows applied per title

Devices

Device registration

A device registers before it can play, and the ceiling is enforced server-side, because a limit the client enforces is a suggestion. The slot is a registered device rather than a playing stream, and the ceiling is one platform-wide value — per-plan limits are designed and not yet enforced.

Device registration, enforced server-side
One platform-wide ceiling today
Per-plan limits: designed, not enforced

Detail

Platform security

Secrets

Vaulted, never in a file

Credentials live in a vault. Configuration files reference them; they do not contain them, and they are never printed into a log or a chat window.

Vault-held secrets
No plaintext in repositories
Rotation as a routine operation

Access

Least privilege, audited

Administrative access is scoped, time-bound where it can be, and logged. Every infrastructure change arrives through a reviewed merge request.

Scoped administrative roles
Audited access
Change history is the audit trail

Surface

Deliberately small

Services are isolated behind their own addresses and exposed only where they must be. The public surface is a decision, not an accident of deployment.

Service isolation
Explicit ingress only
Security headers and transport policy set deliberately

Response

Assume it will happen

Exposure is planned for: rotate first, investigate second, and write down what happened. A credential that has been seen is a credential that gets rotated, regardless of likelihood.

Rotation-first response
Written post-incident review
No 'probably fine' judgements on secrets

Questions

The things people ask first

Is AES-128 enough, or do we need full DRM?

It depends on your content agreements, not on the technology. AES-128 with per-segment authorisation is strong for independent and regional content, and it is what this platform runs today. Studio agreements typically require Widevine, PlayReady or FairPlay. There is no licence server here yet, so that is a build inside the engagement rather than a switch — and it changes the key path, not the architecture.

Does per-segment checking slow playback down?

No measurably. It is a token verification at the edge on a request that was already being made.

Who can see our viewers' data?

You, in your estate. Self-hosted telemetry means there is no third-party processor holding viewing behaviour.

What would a leaked manifest cost you?

For most rights-holders the answer is the contract. It is worth knowing exactly how far a copied URL travels on your current platform.

Talk to us →See the platform →