Technology

The stack that protects Netflix streams, on your own cameras.

Built out of industry-grade protection schemes that ships on billions of devices — we repurposed these for business and personal use and added event-gated key release with a policy engine.

Foundations

A proven stack

Widevine, PlayReady, and FairPlay already ship on billions of devices. Modern cameras can run apps and encrypt encoded video on-device. LockedStream composes these proven components — the same ones that protect Netflix, the Apple App Store, and Amazon Kindle — and applies them to surveillance footage in a way that makes sense for business and personal use cases.

  • MPEG-CENC common encryption for interoperable, standards-based sealing of encoded video.
  • Hardware-backed DRM (Widevine / PlayReady / FairPlay) so keys live in a trusted execution environment, not in application memory.
  • Forensic watermarking heritage from MPEG content-security standards — traceability for released clips.
Architecture

From lens to authorized viewer

Footage is sealed the moment it's captured and only ever decrypted for an authorized recipient, on a verified event.

Camera / NVR Encrypt at capture key rotates · 5s ⟳ Sealed storage On-prem or cloud Admins see noise Policy engine Holds all keys AI event? Policy match? Release key ✓ Authorized viewer Right role · right clip ciphertext key req key + clip → signed audit trail
Design principles

Sealed by default, opened by policy

Encrypt at the edge

Video is sealed on the device that captures it. There is no window where plaintext sits unprotected on a network or disk.

Keys rotate every 5s

Even a partial compromise exposes only seconds of footage. There is no master key that unlocks everything.

Event-gated release

The policy engine holds keys back until an AI-verified event or explicit policy match — then releases only the relevant clips.

Hardware root of trust

Keys are handled in a trusted execution environment via Widevine, PlayReady, or FairPlay — not exposed to application code.

Signed audit trail

Every release is cryptographically signed with chain-of-custody metadata — exportable evidence that stands up in court.

Standards-first

Built on MPEG-CENC and mainstream DRM, so it interoperates instead of locking you into one vendor.

Heritage & IP

Eight years of R&D behind it

LockedStream is built on the work Scenera has done since 2018 — the company behind the NICE Alliance specification for intelligent camera interoperability, funded by the sensor makers who power cameras worldwide.

The event-gated, policy-based approach to sensor data is protected by three granted U.S. patents:

US 12,081,527US 11,245,676US 10,693,843

The entire protection stack already exists. We're composing it and pointing it at the content that actually matters — so privacy can be the default, not an upgrade.

Want the deep dive?

We'll walk your security and engineering teams through the architecture and a live deployment.