Watermarking, Screeners and Review Links for Vendors

The Short Answer

A watermark does not stop a leak. It tells you who had the file and discourages the person holding it. The MPA Best Practices treat watermarking as something to do "per client requirements", so the first step is to ask what the client wants, then use a review platform and link settings that match. The rest of this post covers how the pieces fit together for a small vendor.

What the MPA Best Practices Say

Three controls in the current Best Practices (version 5.3.2) are relevant.

• Asset tracking (OP-3.0). The Best Practice is to track assets with unique identifiers and keep transaction logs for at least a year. Watermarking assets per client requirements, with spoiling, visible and forensic given as examples, appears as an Additional Recommendation.
• Content transfer systems (TS-1.16). Transfer content through dedicated systems with an approval step, encrypt it, and delete it from the system after 24 hours or per client requirements. Recommendations include client-approved transfer systems, notifications on outbound transmissions, never embedding usernames and passwords in content links, sending credentials and links by separate channels, and avoiding SMS for either.
• Web portals (TS-1.10). Use HTTPS with a valid certificate, role-based permissions such as who can upload or download, separation between client tenants and no persistent cookies that hold credentials. For sensitive content, access that expires automatically at set intervals is a recommendation.

Authentication (TS-1.6) also requires multi-factor authentication on internet-facing systems, which includes web portals.

Three Kinds of Watermark

Platforms use different names, so describe what you need rather than the label.

1. 1Visible watermark. Text on the picture, such as the recipient's name, date or "confidential". It is a deterrent and works for anyone who can see the screen. It can be cropped or covered.
2. 2Session-based overlay. Frame.io describes this as showing the viewer's session information on screen while they watch.
3. 3Forensic watermark. An invisible identifier embedded in the video that can be traced back to a playback session. Frame.io's help article says it captures equivalent information but is not visible to the viewer.

What Frame.io Documents

We use Frame.io as the example because many vendors do. Check the current help center before you promise anything, since features depend on plan.

• Share links can require a passphrase and can expire at a set date and time. Downloads can be turned off per share, and account admins can set a default.
• Secure sharing, which limits a link to project members and invited people, is documented as exclusive to Enterprise customers.
• Forensic watermarking is documented as supported for Enterprise Prime accounts only. It is applied to the proxy files Frame.io generates, not the originals, works with fixed frame rates between 10 and 120 fps and may cause a very slight quality loss.
• For a leak investigation you need the leaked file and a NAGRA NexGuard account, and support can then provide session and account details. Frame.io states that it is not responsible for discovering leaked media.

Other platforms have their own controls and limits. The pattern is the same: per-person access, expiry, watermarks and logs.

Secure Screener Habits That Work

1. 1Ask the client first. Some require their own platform. Others specify visible watermarks only, or none.
2. 2One link per person. Shared links defeat the log. Per-recipient access tells you who opened what.
3. 3Passphrase by a different route. Send the link in email and the passphrase by phone or a different messaging app. Avoid SMS, as the recommendation says.
4. 4Expiry on every link. Match it to the review window, then revoke.
5. 5Downloads off unless the client wants them. If downloads are needed, make that a deliberate exception and log it.
6. 6Use aliases. For high-security titles, use the alias the client gave you in file names and subject lines. The recommendation says not to put the alias and the real title in the same message.
7. 7Lower resolution. A review proxy is enough for notes and keeps the master out of the link.
8. 8Keep a send log. Date, recipient, file version and platform. This is the evidence an assessor will want for asset tracking.

Common Slips

• Putting the link and the passphrase in the same email
• Leaving a link live for months after the review ended
• Sending a master file when a proxy would do
• Using a personal file-sharing account because the approved platform is slow
• Forgetting that a forensic watermark only helps if someone kept the log of who received which version

None of these takes long to fix, and each one is something an assessor or a client security team can ask about.

What To Do When Something Looks Wrong

If a link is forwarded or a screener shows up where it should not, revoke access, note which link and version, preserve the logs and follow your incident plan. Our incident response outline covers who to call. The MPA control also gives a piracy reporting address at the Alliance for Creativity and Entertainment.

Where This Fits in a TPN Assessment

Review platforms count as applications or cloud services in your scope, and an assessor will ask how you decide who can see unreleased work. A written screener procedure, a send log and screenshots of link settings go a long way. See the readiness checklist and remote editing with Frame.io.

Want a person to help?

A real person on our team can set up your review workflow, write the one-page screener procedure and check the settings against your clients' requirements. We help you get ready. The assessment itself is done by an independent TPN-accredited assessor, and we do not certify anyone or guarantee that a watermark prevents a leak. See our network security work, or plug us in with a note about how you share cuts today.