Content security
Content security: how we handle your footage, drives and logins
Unreleased footage, shared drives and admin logins are what people worry about when they hire a vendor. This page says what we do with them, what we do not do and how we describe TPN. It restates practices from our consulting pages and articles.
Footage: where it lives and how it moves
The aim is the same on every setup: unreleased media stays where it belongs and only the people on the project can reach it.
Footage stays in the facility
With remote desktop streaming the workstation stays in the studio and the editor only receives video of the screen, so no files are transferred.
Proxies for remote editing
Editors cut from small proxy files while the full-resolution media stays on your NAS.
Not open to the internet
Access is limited to approved IP addresses or VPN endpoints. The NAS and workstations are not exposed to the open internet, and remote sessions run over TLS 1.3 or WireGuard.
Review links with limits
One link per person, an expiry date on every link, downloads off unless the client wants them, a lower-resolution proxy instead of the master, and the passphrase sent by a different route than the link.
A send log
Date, recipient, file version and platform, so you can answer who received which version.
Drives and backups
Drives fail, ransomware encrypts shares and someone deletes the wrong folder. The backup plan has to cover all three.
Three copies, two kinds of media, one offsite
A 3-2-1 plan sized to how much data you have and how fast you need it back: a local copy, an encrypted cloud archive and, where the archive is large, LTO tape.
Restores are tested
We restore from each tier on a regular schedule and write down the result. A backup nobody has restored is a guess.
Monitoring
Alerts for failed jobs, low capacity and drive health, so a broken backup is reported instead of discovered during a restore.
RAID is not a backup
RAID keeps a volume running when a drive dies. A backup is a separate copy, on separate media, in a separate place.
Credentials and logins
Most leaks start with an account, not with a clever attack.
Individual accounts and roles
Role-based access to NAS and editing systems. Editors see the projects they are assigned, and freelancers do not get the whole NAS.
Multi-factor authentication
Turned on for every remote access tool we set up, so a stolen password is not enough.
Removing access
A written process for removing access when someone leaves, and idle remote sessions end automatically.
Logs
Remote sessions are logged with time, IP address and user. Assessors usually ask for access logs.
Your accounts, in your name
Equipment and cloud accounts are set up in your name, and we hand over documentation and admin credentials. For websites, the domain is registered in your name and you receive all logins at handoff.
When something goes wrong
A lost drive, a link sent to the wrong person or a suspected leak needs a plan that people have read before the bad day.
A written plan
We help vendors write a short incident response plan: roles, what counts as an incident, a contact sheet, the first hour, client notification, recovery and a review afterward.
The first hour
Write down the time and what you saw, tell the incident lead, contain it, preserve evidence and pause sharing for the title involved.
Telling the client
Say what you know, what you do not, what you have done and when you will update. Do not guess about cause.
Planned changes
Segmentation and access changes can affect how people connect, so we plan them, test first and apply them outside busy hours.
What we do not do
- We do not certify anyone, and we do not guarantee outcomes.
- We do not perform the TPN assessment. An independent, TPN-accredited assessor does that.
- We do not claim that a watermark prevents a leak. It deters and helps trace the source, and you still need access controls and a response plan.
- We do not leave the NAS or workstations open to the internet on the remote setups we build.
- We do not recommend shared logins, shared review links, or sending a link and its passphrase together. We avoid SMS for either one.
- We do not put an alias and the real title of a high-security project in the same message.
- We do not hold your accounts. Equipment and cloud accounts go in your name.
- We do not claim a TPN Shield or any certification for Clouds Agency anywhere on this site.
TPN, stated accurately
The Trusted Partner Network (TPN) is a content security program wholly owned by the Motion Picture Association. Studios and streamers often ask vendors for a TPN status before sending unreleased material, and TPN is voluntary.
TPN Shields (Blue, Silver, Gold and Gold Star) show where a facility stands against the MPA content security best practices. TPN says a Shield is not an approval, a certification or a pass or fail, and each content owner decides what it requires.
We help you get ready: a gap assessment, the fixes, the written policies and coordination with the assessor. An independent, TPN-accredited assessor does the assessment. Nothing on this page claims that Clouds Agency holds a Shield or any certification.
TPN guides and helpTPN readiness serviceTPN certification guide
Ask us what you would ask any vendor
If you plan to send us unreleased material, use our own list: questions to ask a vendor about content security. It applies to us as much as to anyone, and a vendor that has thought about the answers puts them in writing. Project terms such as who may access your media and how incidents are reported belong in the agreement.
Related reading: watermarking, screeners and review links and the incident response plan outline. For how data from this website is handled, see our privacy policy.
Questions people ask
Does Clouds Agency hold a TPN Shield or a certification?
This site makes no claim that we do. TPN says its Shields are not an approval, a certification or a pass or fail. We help studios and vendors get ready for an assessment, and an independent, TPN-accredited assessor does the assessment.
What are the TPN Shields?
TPN has four: Blue (self-assessed), Silver (assessed by a TPN-accredited assessor, with a remediation plan submitted), Gold (all Best Practice gaps closed and reviewed by TPN) and Gold Star (Additional Recommendations closed too). Each content owner decides what it requires, so ask each client what they expect.
How do you share cuts for review?
With one link per person, an expiry on every link, downloads off unless the client wants them, a review proxy instead of the master and the passphrase sent by a different route than the link. We ask the client first, because some require their own platform or specific watermarking.
How are backups handled?
We design a 3-2-1 plan: three copies of your data, on two kinds of media, with one copy offsite. We test restores on a regular schedule, write down the result and set up alerts for failed jobs, low capacity and drive health.
What happens if something goes wrong?
A written incident response plan says who does what: contain it, preserve evidence, stop sharing the content, tell the client what you know and agree on updates. We help vendors write that plan, and we recommend a one-hour practice exercise once a year.
Who owns the accounts, policies and documentation?
You do. Equipment and cloud accounts are set up in your name, and policies and assessment notes belong to your facility. Ownership and usage terms for creative work are written into the agreement before work starts.
Have a security question before you send anything?
Tell us what you handle and who is asking. A person on our team replies within one business day.