An enterprise video platform, with the security line drawn honestly
An enterprise video platform for internal comms and training: signed URLs, geo-fencing, per-title access rules and honest security limits.
Flicknexs serves enterprise video by gating each title with plan, purchase and country rules, signing every playback link with a time-to-live, overlaying a brand logo in the player and logging the devices each account uses, while DRM encryption and referer locking are delivery-layer arrangements rather than shipped switches.
Trusted by industry leaders
50+ OTT platforms powered by Flicknexs
Quick answer: An enterprise video platform stores, protects and delivers video for a large organization: all-hands recordings, training libraries, town halls and regulated content that must reach the right people and no one else. On Flicknexs the protections that ship in the platform code are signed playback URLs with a time-to-live, country geo-fencing, per-title access rules, a brand logo watermark and device logging, all driven from the admin and enforced the same way across web, Android, iOS, Android TV and Fire TV. Referer protection and DRM encryption are arranged at the delivery layer on request. Single sign-on, an identity or forensic watermark, and formal compliance certification are not part of the platform today; the page below says plainly what to do instead.
Flicknexs provides enterprise video platform as part of its white-label OTT platform. Flicknexs serves enterprise video by gating each title with plan, purchase and country rules, signing every playback link with a time-to-live, overlaying a brand logo in the player and logging the devices each account uses, while DRM encryption and referer locking are delivery-layer arrangements rather than shipped switches.
Why "enterprise video platform" is a checklist you have to read line by line
The phrase "enterprise video platform" is used to sell two very different things: a place to host internal video, and a security posture that a risk, legal or compliance reviewer will sign off on. Those are not the same purchase. A tool can host an all-hands recording perfectly and still fail the reviewer's first question, which is usually "who exactly can watch this, how do we prove it, and what happens when someone leaves". The value of an honest page is that it answers those questions with what the code actually does, not with a wall of security words that unravel in procurement.
Flicknexs treats enterprise protection as a set of separate layers that each solve a different problem and each carry a different cost. Entitlement decides who is allowed to watch a title. Signed URLs decide how long a granted playback link stays valid. Geo-fencing decides which countries a title plays in. The logo watermark decides what a screen recording carries away. Device logging decides how you notice one account behaving like ten. Reading them as separate layers is the only way to tell a reviewer which of their requirements is met by a shipped switch, which is met by a delivery-layer arrangement, and which you will meet with your own process because the platform does not.
The technical standard behind the delivery is HTTP Live Streaming, defined in RFC 8216, which is why every title is packaged as an adaptive-bitrate HLS master playlist that the player steps up and down as the network changes. That matters for enterprise scale because a town hall watched from a head office on fiber and a warehouse on a phone hotspot are the same title served the same way, with the player, not the platform, choosing the rendition each viewer can sustain.
What protects an enterprise title on Flicknexs, layer by layer
Six of these eight rows are in the platform code today and switch on from the admin. The seventh, referer protection, and the eighth, DRM encryption, are delivery-layer arrangements requested for an engagement rather than toggles you flip yourself. Nothing in this list is single sign-on or a compliance certificate, because neither of those is in the platform; the sections below say what to do about that.
Per-title access rules
Every video, series episode or audio item carries its own plan, purchase and rental rules, checked before a stream URL is ever issued. For internal content the rule is usually a plan that only staff accounts hold.
Signed playback URLs
A storage setting turns on signed playback URLs with a time-to-live, so a link copied out of a training portal stops working once the window passes.
Geo-fencing
Block or allow countries for the whole platform and per title, checked from the request IP at the moment of playback.
Multiple user profiles
An account can carry multiple viewer profiles for separate viewing histories. Profiles are not PIN-protected and are not an identity or role system.
Logo watermark
The player overlays your brand logo with a chosen position, opacity and click-through link. It is a brand mark, not a per-viewer identifier.
Device and platform logging
Analytics records the devices and platforms each account uses for playback, so an account playing on far more screens than a person could shows up in the report.
Referer protection on request
Hotlink protection at the delivery layer rejects playback requests from domains that are not on an approved allow-list, arranged on request and maintained as a list.
DRM on request
Widevine, FairPlay and PlayReady are arranged through the delivery layer as part of an enterprise engagement, not shipped as a switch in the platform code.
Source: Flicknexs platform documentation and architecture specification, 2026-09-03.
How access control works on an enterprise title, request by request
Access control on Flicknexs is a decision the platform makes before any playback URL exists, then a set of checks the delivery layer applies to the request. These items describe what happens between a staff member pressing play and the video starting, so you can map each step to a line in your reviewer's checklist.
Entitlement is decided before a URL is issued
Every title carries an access rule set in the admin: free, plan-gated, purchase or rental. For an internal library the rule is a plan that only staff accounts hold, so a viewer without that plan never receives a stream URL at all. The gate is checked server-side, not hidden in the player, which is the distinction a reviewer cares about.
The playback link is signed and time-limited
With the signed-URL flag on in storage settings, each playback URL carries a signature and a time-to-live. A link lifted from a training page and pasted elsewhere plays only until the window closes, then returns a refusal. You choose the window; a short one is safer, a longer one survives a paused viewer.
The country is checked from the request IP
If geo-fencing is on, the platform looks up the viewer country from the request IP and refuses playback outside the allowed territory. This is a country-level check, applied the same way on every app; it is not a per-platform or per-network rule, and it can be defeated by a VPN, which the limits section states plainly.
Referer protection filters where the player runs
When referer protection has been requested, the delivery layer rejects requests whose referer is not on the approved allow-list, so the player only works on the intranet pages and apps you sanctioned. This is the layer that keeps an internal title from being embedded on an outside site.
The watermark marks what leaves the screen
The player overlays your brand logo at the position and opacity you set. If a viewer screen-records a confidential briefing, the recording carries your mark. It does not carry the viewer's name or a hidden identifier, so it deters casual leaks and signals ownership rather than naming the leaker.
DRM encryption is arranged separately when a title requires it
The platform code does not include a license server, key management or a decryption handshake. When a title genuinely needs encryption, Widevine, FairPlay and PlayReady are arranged through the delivery layer for the specific titles and apps that require them, as part of an enterprise engagement.
How to stand up a protected internal library in the Flicknexs admin
Work through these five steps on a test title first. Each one is reversible from the same screen, so you can prove the gate to a reviewer on a throwaway title before you load real content. Start from the requirement, not the admin, because the list style should follow the policy.
- 1
Write down the access policy before you touch a setting
List who may watch (staff only, one department, one region), how long a granted link should stay valid, and which titles are sensitive enough to need encryption or referer locking. This document is what you will map each admin switch to, and it is what the reviewer signs off on.
- 2
Create the staff-only plan and set the per-title rule
Set up the plan that only internal accounts hold, then open each title and set its access rule to that plan. Confirm on a test account without the plan that playback is refused, so you have proven entitlement is server-side before anything real is loaded.
- 3
Turn on signed URLs and choose a time-to-live
Open Settings, then Storage, and switch the signed-URL flag on. Pick a window long enough to survive a realistic pause but short enough that a leaked link expires quickly. Test by copying a link, waiting past the window in a private browser, and confirming it refuses.
- 4
Set country rules and upload the watermark
If content is region-restricted, open Settings, then Geo-fencing, and enter a platform allow or block list that matches the policy, with per-title lists for any title with a narrower rule. Then open Settings, then Player, and upload your logo watermark with a position and opacity you can see on a dark scene.
- 5
Request referer protection and, where required, DRM
Two protections live at the delivery layer. Request referer protection and hand over every intranet domain and app that must embed the player. For the specific titles whose policy requires encryption, list them and the apps they must play on, and request DRM scoping for that set.
Single sign-on, identity and compliance: what is not in the platform, and what to do
This is the section a security reviewer turns to first, and the honest answers here save a renegotiation later. None of the items below is a shipped feature today; each one has a workable path that does not pretend otherwise.
There is no built-in SSO, SAML, OKTA or Active Directory integration
Accounts are created and authenticated in the platform's own user system. There is no SAML or OpenID Connect connector, no OKTA or Active Directory sync, and no SCIM provisioning in the platform code. In practice, enterprises run internal access through a dedicated staff plan and a controlled account-creation process, and treat provisioning and deprovisioning as an operational task rather than an automatic directory sync. If hard SSO is a non-negotiable, say so in evaluation so it is scoped as a custom engagement rather than assumed.
There is no per-viewer identity or forensic watermark
The watermark is your brand logo, not a stamp carrying the viewer's name or a hidden identifier. If your requirement is to trace a specific leaker from a captured frame, the platform does not do that today; the logo watermark deters and marks ownership, and device logging plus a tight access rule are the tools you have for accountability.
There is no compliance certification or audit-log export
Flicknexs does not hold or claim SOC 2, ISO 27001, HIPAA or GDPR certification, and the platform does not ship a formal audit-log export. Treat the protections here as controls you apply, not as a certificate you inherit. If your program needs certified attestations, raise it early so the responsibilities are written down; do not read any switch on this page as a compliance credential.
Profiles are convenience, not a role or permission system
Multiple profiles under one account separate viewing history; they are not PIN-locked and do not grant or restrict access. Access control is the per-title rule and the plan a viewer holds, not the profile they picked. Design your policy around the plan and the title rule, not around profiles.
Delivery is a single-CDN, HLS-only, 1440p arrangement
Packaging is adaptive HLS with a master playlist, not DASH, and there is no multi-CDN or token-authenticated manifest layer to claim. Transcoding tops out at 1440p, so a program that mandates true 4K masters is out of scope. These are delivery facts a technical reviewer will verify, so they belong on the page.
A large organization running all-hands and compliance training
A worked example for a company of several thousand staff across a head office and regional sites, running quarterly all-hands recordings, a standing compliance-training library, and occasional region-restricted material. It works through the layers the way a real security review would.
The company records its all-hands and training at 1080p, so the 1440p ceiling never bites, and every title is packaged as adaptive HLS. It creates one staff plan that only issued internal accounts hold, and sets every internal title to that plan. A contractor account without the plan is refused a stream URL, which the security team verifies on a test account before any real recording is loaded. Entitlement, not obscurity, is doing the work, and it is checked before a link exists.
Signed URLs are turned on with a time-to-live sized to a long training session, so a learner who pauses and resumes an hour later still plays, but a link forwarded into an outside chat expires before it spreads. The player watermark carries the company logo at low opacity in a corner; when a manager screen-records a confidential briefing to review offline, the recording carries the mark, which deters wider sharing even though it does not name the person who recorded it. The team accepts that limit knowingly, and pairs it with device logging: the analytics report is checked for any staff account playing on far more devices than a person plausibly uses, which is how a shared credential surfaces.
For a region-restricted compliance module that may only be shown to staff in two countries, the company sets a per-title country allow-list on top of the platform rules, and accepts that a determined viewer on a VPN could defeat the country check, so it does not rely on geo-fencing alone for anything that truly cannot leave a region. When the legal team asks for encryption on one set of regulated recordings, the company does not switch anything on itself; it lists those specific titles and the apps they must play on, and requests DRM scoping and referer protection for that set through the delivery layer. Single sign-on is raised in the same conversation: because the platform has no SAML connector, the company scopes provisioning as an operational process owned by IT, and writes that decision into the security sign-off rather than assuming a directory sync that does not exist.
Pre-launch checklist for an enterprise deployment
Run this list on a staging title, with your security reviewer watching, before real internal content goes live.
- A staff-only plan exists and every internal title is set to it, and a test account without the plan is refused a stream URL, proving entitlement is server-side.
- The signed-URL flag is on in storage settings, and a copied link pasted into a private browser after the time-to-live returns a refusal, not a stream.
- Geo-fencing matches the policy for any region-restricted title, with per-title country lists where a title is narrower than the platform rule.
- The team has accepted in writing that geo-fencing is a country-level IP check and can be defeated by a VPN, so nothing that truly cannot leave a region relies on it alone.
- The player logo watermark is visible in a compressed screen recording of a dark scene at your chosen opacity, and everyone knows it is a brand mark, not a per-viewer identifier.
- Referer protection has been requested and every intranet domain and app that embeds the player is on the approved allow-list.
- Titles whose policy requires encryption are listed, with the apps that must play them, and DRM scoping has been requested for that set through the delivery layer.
- The security sign-off records that there is no built-in SSO, SAML or directory sync, and names the operational process that owns account provisioning and deprovisioning instead.
- The sign-off also records that Flicknexs holds no SOC 2, ISO 27001, HIPAA or GDPR certification, and that the protections here are controls you apply, not a certificate you inherit.
- Support and IT staff know how to read the logged devices report and what to do when one account shows more devices than a person could plausibly use.
How enterprise protection scales across the device apps and holds under load
Enterprise video is not a separate product; it rides along with the apps you ship and the delivery the whole platform uses, which is what lets one title reach every screen under the same rules.
The standard layers behave the same across web, Android, iOS, Android TV and Fire TV, because entitlement, signing and the country check are decided by the platform before a stream URL is issued, and every app receives that same decision. Samsung TV, LG TV, Roku and Apple TV apps are paid add-ons rather than part of the base plans, so if a town hall must reach staff on those specific living-room devices, that reach is a plan decision made in advance, not an afterthought. The adaptive HLS packaging is what makes a title watched from a head office on fiber and a regional site on a phone hotspot the same title served the same way, with the player choosing the rendition each viewer can sustain up to the 1440p ceiling.
On the reliability side, delivery is a single-CDN adaptive-HLS arrangement, and the honest framing is that scale here means the same delivery path the whole platform uses, not a bespoke multi-CDN posture you can claim to a reviewer. For an internal all-hands, that path is enough because the load is your own staff, not an open public spike. Where a title genuinely needs a stronger delivery or encryption posture, that is the delivery-layer engagement described above, scoped to the titles that need it, rather than a switch that quietly changes how the whole estate is served.
Which plan includes enterprise video
Standard layers
Per-title access rules, signed URLs, geo-fencing, multiple profiles, device logging and the player logo watermark are part of every plan and cost nothing extra; there is no separate enterprise-security line item on our pricing page.
Pricing & billing
F4 Enterprise includes 2 TB of storage and 20 TB of bandwidth monthly and adds dedicated support to everything in F3; Samsung, LG, Roku and Apple TV apps are add-ons on any plan. See our pricing page for current plan and pricing details. That is the tier where an enterprise deployment normally sits, because it carries the widest storage and bandwidth and is the plan under which DRM and referer scoping are usually arranged.
Annual savings
TV apps are available as add-ons on any plan, allowing you to expand your reach to more devices; see our pricing page for current plan and pricing details. So if a town hall must reach staff on those living-room devices, budget the add-on alongside the base plan.
Plan detail 4
Plans are flat fees and Flicknexs takes no commission on your revenue; payment-gateway fees are between you and your gateway. See our pricing page for current plan and pricing details. For an internal library with no revenue attached, that means the cost is the flat plan, not a share of anything.
Plan detail 5
Yearly billing on F1 to F4 costs less per month than monthly billing; see our pricing page for current plan and pricing details. Whichever plan you choose, you get the protections that are in the platform code, while DRM and referer protection are delivery-layer arrangements quoted for your specific title set.
Conclusion: what to do next
Already on Flicknexs
If you already run on Flicknexs, open storage settings and confirm the signed-URL flag is on, then check that every internal title is set to a staff-only plan and that geo-fencing matches your region policy.
Choosing a platform
If you are evaluating, hand every vendor the same list: which protections are in the product today, which are arranged on request, and which are not available, and ask each one to answer SSO, forensic watermark and compliance certification with a yes, a "on request", or a plain no.
Before a rights call
Before the security review, read the companion pages so the delivery facts are settled: the DRM page covers what encryption is and is not, and the video hosting page covers packaging, the 1440p ceiling and the HLS-only delivery.
Frequently Asked Questions
Everything you need to know about enterprise video on Flicknexs.
Not today. There is no SAML or OpenID Connect connector, no OKTA or Active Directory sync, and no SCIM provisioning in the platform code. Accounts live in the platform's own user system. Enterprises typically run internal access through a dedicated staff plan and a controlled provisioning process; if hard SSO is a requirement, raise it in evaluation so it is scoped as a custom engagement rather than assumed.
No. Flicknexs does not hold or claim SOC 2, ISO 27001, HIPAA or GDPR certification, and the platform does not ship a formal audit-log export. Treat the protections on this page as controls you apply, not a certificate you inherit. If your program needs certified attestations, raise it early so responsibilities are documented.
DRM is not built into the platform code; there is no license server or key management in the product. Widevine, FairPlay and PlayReady are arranged through the delivery layer on request, for the specific titles and apps that require encryption, as part of an enterprise engagement. The standard protections you get are signed URLs, geo-fencing, per-title access rules and the logo watermark.
Yes. Set up a plan that only issued staff accounts hold and set each internal title to that plan. The entitlement check runs server-side before a stream URL is issued, so a viewer without the plan never receives a playback link. This is the primary access-control layer for internal content.
No. The watermark is your brand logo with a chosen position and opacity, not a per-viewer forensic mark carrying a name or hidden identifier. It deters casual sharing and marks ownership. For accountability you pair it with a tight access rule and the device log, which surfaces an account playing on more screens than one person plausibly uses.
Geo-fencing looks up the viewer country from the request IP at playback and refuses countries outside your allow-list, platform-wide and per title. It is a country-level check applied the same way on every app. It is not a per-platform or per-network rule, and a determined viewer on a VPN can defeat it, so do not rely on it alone for anything that truly cannot leave a region.
On-premises deployment and dedicated single-tenant hosting are not something the platform claims on this page. Delivery is a single-CDN adaptive-HLS arrangement shared by the platform. If your program mandates on-prem or dedicated tenancy, treat it as out of scope here and confirm it directly rather than assuming it.
When the signed-URL flag is on, each playback URL carries a signature and a time-to-live. A link copied out of a training portal plays only until the window closes, then returns a refusal. You choose the window: short enough that a forwarded link expires before it spreads, long enough to survive a paused viewer.
Web, Android, iOS, Android TV and Fire TV apps are part of the platform and receive the same access decision. Samsung TV, LG TV, Roku and Apple TV apps are paid add-ons. So if a town hall must reach staff on those specific living-room devices, budget the add-on in advance; the base plans do not include them.
Yes, that is how scoping normally works. You list the specific titles whose policy requires encryption, and the apps they must play on, and request DRM scoping for that set through the delivery layer. The rest of the library keeps the standard protections. Encryption is arranged per engagement, not switched on library-wide from the admin.
Transcoding tops out at 1440p and packaging is adaptive-bitrate HLS with a master playlist, not DASH. The player steps renditions up and down with the network. If your program mandates true 4K masters or DASH, this is not the platform for that requirement, and it is better to know before the review than after.
Device and platform analytics log the devices each account uses for playback. An account playing on far more screens than a person plausibly uses shows up in the report, which is the signal that a credential is being shared. Pair the report with a support process so IT knows what to do when one account looks over-used.