Secure video sharing for people outside your team

Secure video sharing is sending videos to people outside your team so that you decide who sees them, until when, and what they can download—and can change your mind.

The last three words are key. Any service can send a video. Almost none lets you change your mind.

And they do change their minds. Mohammad Taha Khan, Blase Ur, and their colleagues from the University of Illinois at Chicago and the University of Chicago asked 100 people to open their Dropbox and Google Drive and review 997 shared files. It turned out people had forgotten that half of those files were even in the cloud. They wanted to revoke access to 11% of shared files—and to 23% when they hadn’t been in touch with the recipient for over a year. One participant simply said, “I don’t remember sharing it with them in the first place” (CHI 2018).

So a link outlives the memory of it. That’s why secure video sharing begins with links that don’t live forever by default: expiry dates, revocation, and a list of what’s currently open—all in one place. How to set up this kind of sharing with clients, step by step, is in the article how to share videos privately with clients.

Sending a video is easy. Taking it back is the real test.

A private link is an address that isn’t published and is hard to guess. Nothing more. Anything beyond that needs checking.

“Hard to guess” is relative. Cornell Tech researchers Martin Georgiev and Vitaly Shmatikov tried 100 million random six-character bit.ly short-link codes and found 42,229,055 live links behind them. Among them were links to cloud files, and about 7% of the OneDrive accounts found had folders writable by anyone (“Gone in Six Characters,” 2016).

And the most popular “private link” in the world works even more simply. YouTube’s help section states that unlisted videos “can be seen and shared by anyone with the link.” Google Drive states that a file shared with “anyone with the link” opens without signing in. This isn’t a security hole; it’s designed that way: the link is the key. Why YouTube’s privacy settings don’t work for client work is in the article how to share a private YouTube video.

Secure video sharing in VodSpot adds what a link lacks. The page address is a long random token. The page can be locked with a password or with email sign-in and a one-time code. And it can be disabled without deleting the video or affecting other links.

A private link is a key. The question is how many copies exist.

For a two-page document, an attachment is fine. For a video, it’s not, and there are three reasons.

The first is size. Gmail’s limit is 25 MB, which is a few seconds of 4K video. Beyond that, Gmail turns the file into a Drive link, so you aren’t sending an attachment at all—you’re sending that same “anyone with the link” link.

Second, an email can’t be taken back. Wrong address, a draft instead of the final cut—Outlook recall only works within a single Microsoft 365 organization and only if the email hasn’t been opened. With a client on Gmail, it never works.

Third, you won’t know what happened next. Was it opened? Forwarded? To whom?

Secure video sharing via the delivery page solves all three: videos of any size, one-click revocation, and a list of who opened and downloaded them. And if the page uses email sign-in, that list shows actual addresses.

An email is forever. A link lasts until you change your mind.

WeTransfer and Dropbox Transfer are excellent at delivering files. Secure video sharing is a different challenge: show the video and maintain control.

Imagine Naomi: she’s the co-founder of a robotics startup in Pittsburgh. Before a round, she sends a demo video to twelve funds—a single link from Google Drive, because it’s quick. A week later, a friend texts her: the video was seen by a partner at the fund that works with her direct competitor. The link had been forwarded twice. By whom and when, there’s no way to know. Disabling the link means disabling it for all twelve funds in the middle of negotiations.

File transfer services won’t help here. WeTransfer’s free plan is, in its own words, “for individual, non-commercial use only,” and the link lasts for up to three days—a fund that returns to the demo a week later will see a blank page. WeTransfer offers passwords on all plans, but the password travels along with the link.

And everything gets forwarded. In a 2022 letter to shareholders, Netflix estimated that, in addition to 222 million paying households, its accounts are used by over 100 million additional households. If people share their subscriptions so easily, imagine how easily they share a link to an interesting video.

What would it look like for Naomi at VodSpot? Twelve delivery pages—one for each fund, each with its own link. Email sign-in: a page opens only for whoever receives the code in their own inbox. Downloads are off, and access expires when the round closes. Analytics shows who opened the page and how long they watched. And when Naomi sees an address in the list that shouldn’t be there, she unpublishes that one page—the other eleven keep working.

Twelve investors, twelve links. Anything else is a leak on a payment plan.

Storage services accumulate exposed links for years. Metomic, a data protection company, scanned approximately 6.5 million Google Drive files from its customers in 2023: 34.2% were exposed to external contacts, over 350,000 were exposed publicly, and 40.2% contained sensitive data. This is the vendor’s research, but the picture is recognizable. How such leaks occur in practice is covered in our cloud storage risk review.

Therefore, the questions for a secure video sharing service are:

• Can you disable one link without affecting the others? And without deleting the video?
• Is there email sign-in, not just a shared password? A forwarded link should be useless without access to the recipient’s inbox.
• Can you see who exactly opened and downloaded it? With addresses, not just a counter.
• Can a link close on its own? For embargoes, funding rounds, or festivals.
• Can downloads be set per video?
• Do link previews in messengers keep the content hidden? For a protected VodSpot page, the preview shows “Private delivery from” and the brand name—no cover, no title.
• Can recipients watch without an account? Otherwise, they’ll forward the file just to avoid signing up.

Secure video sharing with VodSpot covers all of it. Email sign-in and detailed analytics are on Pro and higher; passwords, expiry dates, and revocation are on every plan. See pricing.

Secure sharing isn’t a safe. It’s a light switch on every door.