YouTube Delivery.
Zero-Trust Access.
Use YouTube as your high-performance global hosting and video delivery infrastructure, while your application enforces strict per-user authorization, expiring playback leases, copy-paste embed expiry, and dynamic forensic watermarking.
The 5-Layer Private Streaming Security Model
We bridge the gap between open video platforms and private educational environments without relying on superficial JavaScript tricks that fail inspection.
1. Concealed Video IDs
YouTube video IDs and source links are never rendered in HTML, public routes, or unauthenticated APIs. Public pages reference only internal database slugs (`/courses/[courseId]/lessons/[lessonId]`).
2. Ephemeral Playback Leases
When an enrolled student clicks Play, the server issues a 90-second playback lease. The player must send a cryptographic heartbeat every 30 seconds to maintain access. If abandoned, the lease expires immediately.
3. Concurrency Lock
PostgreSQL account-row locking guarantees that a user account can only stream a single lesson at any moment. Attempting to watch in multiple tabs, another browser, or an Incognito window locks playback until the previous lease concludes.
4. Ephemeral Embed Links
Generate signed embed snippets for external portals. Tokens expire within 3 minutes and are tied to the active viewer session. Copying and sharing the link to another person or incognito tab causes it to immediately expire.
5. Forensic Watermarking
A dynamic, subtle watermark displaying the masked viewer email, active session ID, and UTC timestamp floats across the video. It changes coordinates periodically to deter screen recording and leak distribution.
Transparent Security Scope
We protect your application with complete rigor. However, YouTube serves the underlying stream; if an authorized viewer extracts a raw unlisted YouTube ID via devtools, YouTube itself allows that unlisted ID to play.
Honest Security: Application Gateway vs. Platform DRM
Streamify gives you strict institutional access control, session lifecycle limits, and leak deterrence. We ensure unauthorized visitors cannot enter your courses, scrape your syllabus, or steal embed links. For full DRM or encrypted stream delivery, we offer a modular provider architecture ready for Cloudflare Stream or Mux.
Sign In with Authenticator MFA