Secure Video Review: Your Footage Releases When You Say So

Password-protected pages, expiring links and “disable download” toggles all share one flaw: the video still has to reach a browser to play. Once it does, the browser has the bytes. It caches them, hands them to any screen recorder running on the machine, and exposes them to every extension the viewer has installed.

Hiding the download button does not change that. It only changes how long it takes someone to find the file. If your protection can be defeated by opening developer tools, it is a courtesy, not a control.

A vaulted master never reaches a browser at all. On the web it goes dark: no playback, no share page, no download, no embed — for everyone except you. Review happens in the macOS app, where the operating system can enforce things a web page cannot:

• Screen capture is blocked at the OS level. The playback window is excluded from screen recording, so screenshots, QuickTime, ScreenCaptureKit, Zoom and Teams shares all composite black. Not a transparent overlay or a CSS trick — the window is genuinely absent from the capture stream, fullscreen included.
• The master is AES-256-GCM encrypted at rest. Footage is stream-encrypted as it arrives on the viewer’s machine. There is never a plaintext copy of your file sitting on their disk for a backup agent, a sync client, or a curious person to find.
• Every session is watermarked with the viewer’s identity. Burned into the frame, not overlaid on a page. This is the answer to the one attack no software can block — a phone pointed at the screen. It does not prevent that leak; it makes it traceable to one person, which is what actually changes behaviour.
• Links are short-lived. Signed URLs expire in minutes, so a forwarded link is dead long before it reaches anyone it was not meant for.
• The view log is tamper-evident. Sign-ins, opens, plays and approvals are recorded in a SHA-256 hash chain — each entry sealed against the one before it. Altering or deleting a record breaks the chain, and the break is detectable. You can prove who watched what, and prove the record was not edited afterwards.

Security usually costs quality. Screener platforms hand out 1080p H.264 proxies because that is all a browser can carry, which is fine for approving an edit and useless for approving a grade. So the work leaves the secure tool exactly when it matters most — and travels by hard drive, or by whatever the colourist can open.

The same pipeline carries the whole post chain instead:

• Dailies, from the camera. Point the app at the camera on set — SMB for Blackmagic bodies, FTP, FTPS or SFTP for Sony, Canon and Nikon. Takes appear as they are recorded: the proxy arrives first for instant scrubbing, the original follows on demand. Your client can be watching the shoot land, take by take, from anywhere.
• Review, at full resolution. The macOS app plays camera originals natively — R3D, BRAW, N-RAW, and ProRes up to 8K 4:2:2 HQ at 60 fps — at up to 15,000 Mbps. No proxy, no transcode, no re-encode.
• Colour, judged honestly. Frame-accurate stepping, A/B comparison between versions, scopes, false colour, clipping and focus peaking. You are grading against the master, not against a compressed approximation of it.
• Final delivery. The approved master is already there. Deliverables ship from the same place the review happened, at the same quality, under the same access rules.

Nothing is downsampled to make the pipeline work, and nothing leaves the vault to get graded.

Security marketing rewards overstatement, which is exactly why it is worth being precise about the edges.

Nothing stops a camera pointed at a screen. Capture blocking defeats software recording; it cannot defeat physics. That is what the session watermark is for — it converts an unpreventable leak into an attributable one.

Forensic (invisible) watermarking and FairPlay DRM are on the roadmap, not shipped. When a vendor lists a feature you cannot test, assume it is a slide. Everything described above is in the app today and you can verify it yourself in about a minute: vault a clip, then try to screenshot it.