Media · Circo

Multi-DRM protection and entitlement-gated playback

Encrypt once, license per viewer: paid creator video protected across every major DRM system, where the licence decision is a business rule about who has paid. Live in production.

Architect · Engineering lead

The problem

A creator platform that sells video has to stop that video being copied, but encryption alone is the easy half. The hard question is who is allowed to watch, and on Circo the answer depends on commerce: a subscription, a pay-per-view purchase from a wallet, a gift threshold, a studio role. Protection had to carry those rules all the way to the moment a player asks to decrypt.

My role

I designed the protection and entitlement architecture and built it with my team across the transcoding, webhook and rights services. It is live in production, protecting paid video on web, Android and iOS.

How it works

Encrypt once. Every rendition is encrypted during transcoding with a single common encryption scheme. Content keys live with a specialist key provider, never on Circo's own systems.
Package twice. The same encrypted segments are described for each family of players, so web, Android and iOS each get the format and DRM system they support.
Decide per viewer. When a player asks for a licence, the provider calls back to the platform. The rights service decides whether this viewer is entitled to this post, and only a yes releases a key.

The Video Factory shows the same flow as an operable model: switch off entitlement and the encrypted stream still reaches the player, but no licence is issued.

The trade-off worth naming

Putting the commercial decision inside the licence callback means every playback start depends on the rights service being fast and available. The alternative, checking entitlement only in the app, is cheaper but bypassable. We chose the stricter path because the content is the product.

System

Adaptive streaming and the transcoding ladder

Every upload becomes a ladder of renditions, packaged once for HLS and DASH and served from the edge, so every phone gets the best stream its connection can hold. Live in production.

TranscodingABRCMAF

System

Payments, wallets, gifting and payouts

A payment service that keeps money, virtual gifts, subscriptions and payouts apart, and wires payment straight into who may watch.

PaymentsLedgersEntitlement

System

Video moderation that fails closed

A media admission pipeline that probes cheaply, gates on spec, classifies with a model, and always returns one predictable result, rejecting what it cannot inspect.

ModerationContractsReliability

Multi-DRM protection and entitlement-gated playback

The problem

My role

How it works

The trade-off worth naming

Related systems

Adaptive streaming and the transcoding ladder

Payments, wallets, gifting and payouts

Video moderation that fails closed

The problem

My role

How it works

The trade-off worth naming