Media asset protection and secure transfer
Studios, broadcasters, agencies and post houses move large files that are worth a lot before release: dailies, masters, scripts, audio stems and campaign assets. A leak can come from a shared folder with the wrong permissions, a stray download link or a screener sent to the wrong person. This group covers how our team limits who can reach media, marks copies so a leak can be traced, and moves large files without opening the network to the world.
What we do
- Shared storage ACL design
- Access review for vendors and freelancers
- Forensic watermark planning
- Secure large-file transfer
- Link expiry and download logging
- Leak response steps
- Studio requirement gap review
- Transfer scripting
Our team works with the MovieLabs production security specifications and the Trusted Partner Network content security program as reference material, with Samba and SMB shares, NFSv4 ACLs and TrueNAS for shared storage, with Signiant, IBM Aspera and MASV for large transfers, and with OpenSSH and rclone for scripted moves. For forensic watermarking we work with Friend MTS and Irdeto TraceMark integrations. We design share and group layouts, transfer rules, link expiry, access logging and a watermark plan that fits each delivery step.
This works alongside our secure file handling, cloud storage and identity groups, and links to our Cybersecurity and Managed IT services. Which studio or client security requirements apply is set by each contract and assessment, and this is not legal advice. These are tools our team has experience with, not partnerships, and not a statement that any tool makes a facility compliant with a program.
Leading platforms we work with
- MovieLabs
- Trusted Partner Network
- Friend MTS
- Irdeto TraceMark
- IBM Aspera
- Signiant
- MASV
- Samba
- TrueNAS
- OpenSSH
- rclone
- NexGuard
- Verimatrix
Platforms and practices
- Project-based share layout and group naming
- SMB and NFSv4 ACL review
- Least-privilege access for freelancers and vendors
- Time-limited external transfer links
- Per-recipient forensic watermark plan for screeners
- Watermark detection and leak response steps
- Encrypted transfer between sites and vendors
- Access and download logging with alerts
- Asset-in and asset-out checklist for each project
- Facility and workflow gap review against studio requirements
References
- MovieLabs: Production Security specifications and resources
- Trusted Partner Network
- Friend MTS (vendor page)
- Irdeto (vendor page)
- IBM Aspera (vendor page)
- Signiant (vendor page)
- MASV (vendor page)
- Samba documentation
- TrueNAS documentation
- Linux manual page: nfs4_acl(5)
- Microsoft Learn: SMB file server overview
- OpenSSH
- rclone
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Media asset protection and secure transfer for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreWhere this matters most
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageCan you check our setup against what a studio asks for?
We can run a gap review of your facility, storage, accounts, transfers and incident steps against published references such as the MovieLabs specifications and the Trusted Partner Network best practices, and give you a short list of fixes in order. What a studio requires is set by your contract and its assessors, and we make no claim that your company holds any program status.
Can we trace a leaked screener back to one person?
That is what per-recipient forensic watermarking is for: each copy carries a hidden code tied to the person or account that received it. It deters leaks and helps an investigation, but it does not stop copying, so it works alongside access control, expiring links and logs, not instead of them. We plan where in the delivery chain the marks go and write the steps for reading one after a leak.
How do freelancers get access without taking the files home?
Give them accounts you own: a named sponsor on staff, multifactor sign-in, a start and end date, and access only to the one project. For sensitive material we prefer a managed virtual workstation or a review portal so the files stay on your storage. Where files must be downloaded, require disk encryption and put the rules in the engagement paperwork.
How do we send very large files without opening the network?
Use a transfer tool built for it, such as Signiant, IBM Aspera, MASV or SFTP, with encrypted transfer, expiring links named to the recipient, checksums and logs. Nothing on your storage has to be reachable from the whole internet. We set the transfer rules, link expiry and logging, and script routine moves.