DRM Protection
Enable Shaka Packager-based DRM directly from the encoder. Keys and licenses are wired for Widevine, FairPlay and PlayReady so every rendition is delivered encrypted to the player.
Multi-DRM
Widevine, FairPlay and PlayReady supported.
Shaka Packager
Industry-standard CENC/CBCS packaging.
Forensic watermark
Text or image watermark per rendition.
Per-profile control
Toggle encryption on a per-encode basis.
Why three DRM systems, not one
There is no single DRM that covers the living room. Widevine covers Android TV, Google TV, Fire TV, Chrome and Google Cast; FairPlay covers Apple TV, iOS and Safari; PlayReady covers Xbox, Windows and a large part of the set-top box market. Samsung Tizen and LG webOS support both PlayReady and Widevine, with PlayReady reaching further back into older model years, and Roku supports Widevine and PlayReady. A service that wants to reach every screen therefore ships all three, which is what "multi-DRM" means in practice.
The good news is that the media itself does not have to be encrypted three times. Common Encryption (CENC) lets one set of encrypted segments be decrypted by any of the systems; only the licence acquisition differs. FairPlay and modern Widevine use the cbcs scheme, PlayReady and older Widevine deployments use cenc, so most catalogues are packaged twice at most rather than once per DRM.
Packaging and licence delivery
Encryption is applied at packaging time with Shaka Packager, driven directly from the encoder profile so DRM is a per-encode toggle rather than a separate workflow. Content keys are fetched from the key server and the resulting manifests carry the protection headers each player needs to find its licence endpoint.
At playback the device builds a licence request from its DRM module and sends it, together with an authentication token from your subscription system, to the licence server. That token is where entitlement is actually enforced: it is what stops a valid device from playing a title the account has not paid for. Licence responses carry playback policy - output protection requirements, licence duration, and whether offline playback is allowed.
Output protection and watermarking
Studio agreements usually specify more than "content must be encrypted". Common requirements include HDCP levels for high-definition output, hardware-backed key handling (Widevine L1 rather than L3) for HD and UHD tiers, and a resolution cap when only software-level security is available. These are enforced through licence policy, not in the app.
Forensic watermarking adds a per-session or per-rendition mark that survives re-encoding, so a leaked copy can be traced back to the account it came from. It is normally required for premium and pre-release content and optional elsewhere.
Inside the CMS
Frequently asked questions
- Do we need all three DRM systems?
- Only if you target every platform. A Roku and Android-only launch can run on Widevine plus PlayReady; adding Apple TV or Safari brings in FairPlay. The packaging work is shared, so adding one later is not a rebuild.
- Is AES-128 encryption enough instead of DRM?
- For most rights holders, no. AES-128 with a plain key URL protects against casual copying but has no licence policy, no device binding and no output protection, so studio and premium-sports agreements generally require a real DRM.
- Does DRM work on Roku?
- Yes. Roku devices support Widevine and PlayReady through the platform player, so an encrypted DASH or HLS stream plays without a custom decryption layer in the channel.