Security and trust # Security and privacy, stated plainly Buyers of video infrastructure ask the same three questions: how is the content protected, where does the viewer data go, and what can the vendor actually prove. This page answers them directly, including the parts we do not have. Bradmax is a player SDK. We protect content through the DRM systems your studio already requires, and we keep viewer analytics first-party and anonymous by default. ## Content protection ### Multi-DRM Widevine, PlayReady and FairPlay, plus ClearKey for testing. The player reads the protection metadata in the manifest, picks the system the device supports, and negotiates the licence. ### Your licence service EZDRM, KeyOS (BuyDRM), DRMToday (castLabs) and Cloud DRM are supported, and the default provider can be pointed at your own licence endpoint. ### Robustness levels The player respects the robustness level a studio requires, so decrypted video is not routed to recordable outputs where the device supports that restriction. ### Screen-capture protection A plugin blocks screen capture on macOS through the Widevine path, for content where a recording is the threat rather than a download. ## Data protection ### First-party analytics Bradmax Analytics runs on our own platform, not inside a third-party ad or analytics network. ### Anonymous by default No profiling, no cross-site tracking, no advertising identifiers. The data tells you how playback performed, not who watched. ### GDPR posture We act as a data processor under our privacy policy, and the analytics infrastructure is EU-based. You stay the controller of your audience data. ### No Google Analytics by default We do not run Google Analytics on your traffic unless you ask for it. GA4 support exists and is opt-in. ## Delivery and access Player assets and DRM licence requests are served over HTTPS. Protected playback authenticates to your licence service with the credentials you configure, and access control for the manifest stays in your delivery layer, where it belongs. That split matters: the player is the playback and DRM layer, not a CDN or an access-management system. We make the handshake reliable; you keep control of who is allowed to request the stream. ## Security posture at a glance | Area | What Bradmax does | | --- | --- | | Content encryption | Widevine, PlayReady and FairPlay (ClearKey for testing) | | Licence services | EZDRM, KeyOS, DRMToday, Cloud DRM or your own endpoint | | Analytics | First-party and anonymous; no profiling; GA4 optional | | Data location | EU-based infrastructure; data processing per the privacy policy | | Transport | HTTPS for player assets and DRM licence requests | | Access control | Handled in your delivery layer, not inside the player | ## What we do not claim We are not SOC 2 certified and we are not ISO 27001 certified, and we do not pretend otherwise. If your procurement process requires either, we would rather say so up front than stall the conversation or imply a badge we do not hold. The same rule applies everywhere on this site. We publish a support and SLA page with the commitments a small team can honour, and this page states the security posture as it is. A vendor that overstates here is a vendor you cannot trust elsewhere. ## How DRM support grows We add DRM systems and licence services as customers need them, because the player already carries the plumbing. Recent additions include the DRMToday (castLabs) licence provider and a screen-capture protection plugin for macOS. When a new licence service or DRM variant is required, it is a change inside the player, not a rebuild. The same configuration object describes the licence endpoints, so adding a provider does not change how you embed or configure playback. ## Go deeper - [Multi-DRM playback](https://bradmax.com/site/en/multi-drm) - [Support and SLA](https://bradmax.com/site/en/support) - [Terms and Conditions & Privacy Policy](https://bradmax.com/site/en/privacy-policy) - [DRM documentation](https://bradmax.com/static/player-doc/drm/index.html) - [Start free](https://bradmax.com/site/en/signup) ## Frequently asked questions ### Are you SOC 2 or ISO 27001 certified? No. Bradmax is a small team and we have not gone through SOC 2 or ISO 27001 certification. We say so plainly rather than imply otherwise. If a certification is a hard requirement for your procurement, we will tell you early so you can decide. ### Where is viewer data stored? Bradmax Analytics is first-party and runs on our own platform, on EU-based infrastructure. We act as a data processor under our privacy policy. We do not profile viewers, and we do not sell or share their data. ### Do you use Google Analytics? Not by default. Our analytics are first-party and anonymous. GA4 support exists if you want it, but it is opt-in and off unless you enable it. ### Which DRM systems are supported? Widevine, PlayReady and FairPlay, plus ClearKey for testing, across web, mobile and Smart TV. The licence service can be EZDRM, KeyOS (BuyDRM), DRMToday (castLabs), Cloud DRM or your own endpoint. ### Do you sell or share viewer data? No. The analytics exist for you. We do not sell data and we do not use it for advertising. ### Is playback encrypted in transit? Player assets and DRM licence requests are served over HTTPS. The content itself is encrypted by your DRM packaging, and the player handles the licence handshake with the credentials you configure. ## Sources and method - [Bradmax DRM documentation](https://bradmax.com/static/player-doc/drm/index.html) Supported DRM systems, licence providers and configuration - [Bradmax privacy policy](https://bradmax.com/site/en/privacy-policy) How personal data is processed and the rights of data subjects - [Bradmax support and SLA](https://bradmax.com/site/en/support) Availability target and response and repair times ### Ask us the security questions Send your procurement or security questionnaire. We answer with specifics, including the things we do not have, so you can judge the fit before you invest time in a pilot.