Secure video hosting with real control over who watches

Secure video hosting is hosting where every link between the uploader and the viewer is individually secured: the team account, storage, link, stream, download, and embed.

It sounds like a list from a brochure. But look where the chain usually breaks. Not in encryption—everyone’s been doing that for a while. It breaks where it’s convenient: a forwarded link, a shared login for three people, a folder accessible to “everyone with the link”, a player copied to someone else’s website.

Imagine a video about a reorganization that management won’t show to employees until Friday. It’s ready by Tuesday. The three days between “ready” and “available” is exactly when secure video hosting is needed: the video is there, working, being approved—and no one else can see it. A regular cloud isn’t designed for this—we discuss why in the article video hosting vs. cloud storage.

At VodSpot, it’s routine: the video is private from the moment it’s uploaded, the approval page is password-protected and expires on Friday, downloads are disabled, and on Friday, you open access for everyone with a single click.

Security isn’t a vault. It’s a schedule: who, what, and until when.

The password on the link is the main and often the only lock for most services. Secure video hosting begins where a password alone isn’t enough.

Zoom provides a good example of how a “link as a lock” can be broken. In 2019, Check Point researchers demonstrated that they could guess about 4% of randomly generated meeting numbers: if a meeting didn’t have a password, those 9-11 digits were the only thing protecting it (Check Point Research, January 2020). Zoom responded as almost every service does: by turning passwords on by default.

The password closed one hole and opened another. A password is a shared secret. It’s sent in the same email as the link (for how to share it correctly, see our video password guide), forwarded to a colleague “to watch too,” or posted in a group chat. It protects the page from random people, but not from being forwarded.

Therefore, secure video hosting at VodSpot offers two more levels. The first is a separate delivery page for each recipient: the distributor has their own link, the agency has their own, and revoking one doesn’t affect the others. The second is email sign-in: the viewer enters their email address and a one-time code sent to that address. A forwarded link is useless without access to the recipient’s inbox.

A password says “one of us.” Email sign-in says “which one.”

DRM (Digital Rights Management) encrypts video so that only a trusted player on a trusted device can play it. This is what Netflix and Disney+ rely on. For a studio, agency, or course author, this is usually overkill—and here’s why.

Vimeo’s DRM is an add-on to the Enterprise plan, which is sold only through its sales team. Vimeo’s help section honestly lists the price of this convenience: DRM-enabled videos “will not work on third-party players” and “may be capped at 720p in certain environments.” Wistia also only offers playback protection on its Enterprise plan. So, you pay the Enterprise price to let clients watch your 4K film in 720p.

And most importantly: DRM doesn’t stop a phone from pointing at the screen. That’s why even large studios add watermarks over DRM to know whose copy leaked. For more information on watermark types and when they work, read our article what is a video watermark.

Secure video hosting at VodSpot takes a different approach. We don’t have DRM, and we don’t hide it. Instead, on the Studio plan and above, the viewer’s confirmed email floats translucently across the frame—even in full screen. The player is standard, 4K remains 4K, and anyone who wants to record the screen will also record their name.

DRM locks the file. A watermark signs the copy.

The most valuable thing about secure video hosting isn’t the link, but the account from which those links are distributed. Through it, everything is visible: every project, every master, every client.

Imagine Andre: he runs a five-person post-production studio in Burbank. He hires a freelance colorist for a week. The freelancer receives a “sponsorship” email with an attachment; he opens the file, and malware steals his session cookies from the browser. No password is required, no second factor is needed—the attacker logs in as the colorist.

This isn’t fantasy. In 2021, Google’s threat analysis team described exactly this campaign against YouTube creators: emails promising collaboration, malware, and cookie theft. Google counted approximately 15,000 malicious accounts and restored approximately 4,000 accounts to their owners (Google Threat Analysis Group, October 2021). Session hijacking bypasses both passwords and two-factor authentication.

Does this mean the second factor is useless? On the contrary. A 2019 Google study with NYU and UC San Diego showed that even an SMS code stops 100% of automated bots, 96% of mass phishing, and 76% of targeted attacks, while on-device verification stops 100%, 99%, and 90% of attacks. The second factor blocks almost everything. The rest is blocked by roles, sessions, and the log.

This is how it looks for Andre at VodSpot. The colorist was on the team with the Editor role, not the owner: he can’t delete projects or change billing. At 3:12 AM, “he” publishes a delivery page with an unreleased ad. In the morning, Andre sees it in the activity log: who, what, and when. He unpublishes the page—the link stops working, views in progress stop within about a minute—and removes the colorist from the team. The colorist ends all their sessions and enables two-factor authentication. The damage is one night, not the studio’s archive.

They don’t hack the video. They hack the people who have access to it.

Security that’s difficult to use gets disabled. NIST researchers call this “security fatigue”: when there are too many rules and passwords, people take the easy way out and start breaking the rules (Stanton et al., NIST, 2016). Therefore, a good secure video hosting service is tested not by the length of the feature list, but by what’s enabled by default.

Ask the service these questions:

• Are videos private from the moment they’re uploaded? Or public first, until you remember to switch them to private?
• Can you disable one link without deleting the video? Will the other links still work?
• Is there email sign-in, not just a shared password? And is it clear who opened the page?
• Is downloading configurable for each video? Yes for the final cut, no for drafts.
• Can you lock the player to your own domains? So that the copied code doesn’t play on someone else’s website.
• Are there no public file URLs? Or can a storage link be forwarded and still open a year later?
• Does the team have roles, two-factor authentication, and a log? Or does everyone work under the same login?
• Does revoking stop views already in progress? Or only new ones?

With secure video hosting from VodSpot, the answer to every question is “yes.” Where this depends on the plan, see pricing.

The best protection is the one you don’t have to remember to turn on.