How ICU works.
One title prepared once, not once per viewer
Most people imagine per-viewer watermarking as "stamp each stream with the viewer's name". That would mean re-encoding the video for every viewer, which is why it costs what it costs.
ICU prepares each title once, as a mosaic of short, nearly identical pieces. To anyone watching, every piece is the same picture and the same sound; the differences between them are marks in the picture that a viewer cannot see and a machine can read.
Each viewer gets their own combination
When a member presses play, the edge assembles the stream from the mosaic in a combination computed from the title and that member's account number. Member 18 231 gets one arrangement; member 18 232 gets another. A feature-length title holds far more pieces than are needed to tell every account on earth apart.
The same combination is used when the member downloads the file, because the download is assembled from the same pieces. A clip download carries the part of the combination that covers the clip.
Reading it back
A leaked copy, whether a re-encode, a screen recording or a phone pointed at a TV, still carries the mark in ordinary cases. ICU Trace reads the combination of pieces back from the footage and searches your member list for the one account whose arrangement contains that run. The mark also carries the title number, so Trace knows which title it is looking at before it looks for the member.
Trace reports a match and the odds of that match being a coincidence, computed from how much of the combination it read and how many accounts it compared.
How much leaked footage is needed
Roughly two minutes of continuous footage. That much, read against a hundred thousand accounts at every position of a one-hour title, gives an expected false-match count of about 0.0003. Longer clips make it stronger; shorter clips are reported with their real odds rather than a guess.
What it does not do
ICU does not stop anyone from copying. It tells you, after the fact, which account the copy came from, so you can close it, charge it back, send the takedown with the account attached, or hand the evidence to counsel.
That last point is where this differs from the usual enforcement route. Copyright suits in this industry are filed against IP addresses harvested from torrent swarms; the defendant is whoever pays for the internet connection, and the first argument in every such case is that someone else used it. An ICU trace ends at an account that paid for the title. Behind the account is a transaction: a card, a name, a billing address, a date. Counsel starts with a buyer, not with a subpoena to an ISP.
It is designed to survive ordinary copying, not every attack. Someone who mixes copies from two different accounts defeats any per-viewer watermark, ours included. What that costs the attacker is two paying accounts and a perfect mix; an imperfect one points at both. The honest limits are on the FAQ page.
FAQ→H.264/AAC, delivered as HLS. HEVC on the roadmap.
Served from an edge network; the per-viewer work per request is negligible, which is why there is no per-play fee. Progressive MP4 for downloads is assembled on the fly with the same per-viewer combination; byte ranges and clip excerpts are supported.
The per-viewer combination is derived from a key that never leaves the delivery and trace environment. Account identifiers are opaque integers; no member PII is needed or stored by ICU.
Grows with the catalogue, not with the audience: a fixed overhead per title, no per-session artefacts. One quality level per title today; multi-bitrate ladders are roadmap.
The ICU Mark encoder runs on your own render machine (Windows today; chunked, resumable, verifies its output before upload) or as a managed job on ours. Output goes through a gateway straight into object storage.
Unchanged. Your site and members area can run anywhere (your own servers, any cloud, any hosting platform); ICU only needs your backend to mint a playback token and your player to load our URL.
Any HLS-capable player. Integration is a tokenised playback URL minted by your backend with the account id; token signing uses a shared secret you rotate.
Upload the leaked file. Trace aligns it with the title in time and in the frame, reads the combination and names the account automatically, with a report you can hand to counsel. Difficult captures go to an analyst. Try it on demo.icu.ltd.
Cloudflare Workers and R2. Storage can live in your own Cloudflare account with ICU bound to it, so your masters never sit under a third party's control.