The viewer & DRM
A SuperFile is never handed to the browser as a plain document. Its pages, images and video are packaged as encrypted streams and displayed by the SuperSecure viewer, which obtains a key for each open from SuperDRM under the owner's policy. This page explains what that gives you on each platform, honestly.
#How an open works
- The viewer asks the SuperSecure API for the file. The API checks the share list and returns the stream manifest plus a short-lived licence token.
- The browser's content decryption module (CDM) builds a challenge; the viewer posts it to the licence endpoint.
- SuperDRM verifies the token, opens the content key from its vault, applies the policy (hardware required, HDCP, duration), meters the request, and returns a licence bound to that device.
- The CDM decrypts inside the platform's protected path. The viewer never sees the key.
Unsharing changes the answer at step 3; a licence is short-lived, so an open tab goes dark at its next key request.
#Key systems by platform
| Platform | Key system | Security level | Screen capture |
|---|---|---|---|
| Chrome, Edge, Firefox on Windows / Linux | Widevine | L3 (software) unless the device has an L1 path | Not blanked by the CDM; the owner can require hardware (hw) and these clients are then refused |
| Chrome, Firefox on macOS | Widevine | L3, but macOS blanks protected media in capture | Blanked |
| Safari on macOS, iOS, iPadOS, visionOS, tvOS | FairPlay | Hardware (Secure Enclave path) | Blanked; HDCP enforced on external displays |
| Android, Chrome OS | Widevine | L1 on most devices | Blanked |
| Fallback | Clear Key | Software only | Not blanked; only used where the owner's policy allows software playback |
What "hardware secured" means on the client: the CDM decrypts inside a trusted execution environment and frames travel a secure output path, so screen capture and screen sharing show black and HDCP is required on external displays. SuperDRM records the level actually granted (L1, L3, hw, sw) on every licence, and the owner's policy can refuse anything below hardware.
#Policies an owner can set
- Hardware required — refuse software CDMs entirely (the safest setting for sensitive documents; some Windows and Linux browsers will not open the file).
- HDCP — none, type 0 or type 1 on FairPlay devices.
- Persistence and duration — whether a licence may be cached for offline viewing, and for how long.
- Attested devices — for managed fleets, release keys only to devices that prove their boot image; see Attested devices.
#Company logos and branding
A file can carry your company mark in the viewer. Whether the logo itself is DRM-protected is a per-company setting (auto, on, off).
#Offline
The viewer keeps an encrypted cache so a file you have opened recently keeps working through a dropped connection, within the licence's persistence window. The cache is wiped on sign-out.
Updated September 2026