What protects an Alva-hosted video today
Alva Courses never gives the browser a permanent address for your video. Each time a student opens a lesson, the storefront player asks your store for a fresh, signed link to that one video, and the video delivery service serves the file only while that link is valid. Three layers sit on top of that.
1. Signed links that expire after two hours
A link is issued only through your store's own app proxy, and only after Alva Courses has checked that the request comes from a recognised student who is enrolled in the course and allowed to open that lesson. (A free course is open to any visitor, so its videos are too.) The link is valid for two hours. The player renews it quietly a few minutes before it expires, so a long lesson is never interrupted. A link that leaves the player dies within two hours, and nobody without access to the course can obtain a new one. In current browsers, an Alva-hosted video address pasted into a tab or opened from a forwarded link is refused with the message This video plays inside your course. rather than played.
2. A hidden download button
The storefront player is the browser's own video player with the download button that some browsers add to the controls switched off. Students see play, pause, volume, the seek bar and fullscreen as usual, and nothing that saves the file.
3. No right-click save menu
Since the November 2026 update, the player blocks the browser's right-click menu on every lesson video and audio block, whether the file is hosted by Alva or uploaded through Shopify Files. The menu that offered Save video as and Copy video address no longer opens on desktop browsers. The long-press menu in Chrome on Android is the same browser menu, so it should be blocked in the same way, though we have not tested every mobile browser. The native controls, keyboard shortcuts and fullscreen work exactly as before. The menu's picture-in-picture and loop options go with it. A video uploaded through Shopify Files gets the same menu block, but it is served from Shopify's CDN at a permanent public address, so the expiring-link layer does not apply to it.
What it stops and what it does not
The protection is aimed at link sharing and at the casual save. It is not aimed at a student who is willing to work for a copy, and no video host should tell you otherwise.
| A student tries to… | What happens |
|---|---|
| Right-click the player to save the video or copy its address | The menu does not open on lesson videos and audio. |
| Click a download button in the player | There is none. |
| Paste a video address copied with developer tools into a browser tab, or send it to a friend | In current browsers the address is refused with This video plays inside your course. Download tools and command-line clients can still fetch it until the link expires, at most two hours after it was issued. After that it is dead, and only a student with access inside your store can obtain a new one. |
| Use browser developer tools, a download extension or a command-line tool | Not stopped. The file can be saved while the link is valid. |
| Record the screen | Not stopped. No web video service, DRM included, fully prevents this. |
What no web video service can prevent
A video that plays in a browser without DRM is a file the browser has received, so a student who can watch it can keep it. Developer tools show the address of the file and offer to save it, browser extensions and command-line tools download it, and a screen recorder captures whatever plays.
DRM services make the first two routes much harder, at a real cost in price and setup, and still cannot stop someone recording the screen or pointing a phone at it. Alva Video Hosting discourages casual saving. It is not copy protection, and no honest video host will promise you that.
Where VdoCipher fits
VdoCipher is a separate, paid video service that encrypts each video and plays it through a DRM player, which closes the usual save-the-file routes. Alva Courses can embed a VdoCipher video in a lesson: you paste the embed code from your own VdoCipher account into a VdoCipher block. The block is available on request rather than switched on for every store. Email courses@alvaapps.com if your content justifies it. Even with DRM, screen recording remains possible.
Practical steps that matter more
What keeps paid video paid is mostly outside the player. Four steps do more than any technical block.
- Set a course deadline and end access when it passes. A deadline is tracked for you; it ends access on its own only when Alva support has switched on deadline enforcement for your store (off by default). Otherwise end access yourself by unenrolling the student, through a full refund or with a Shopify Flow workflow. A student whose access has ended cannot obtain a fresh video link. See Set a course deadline.
- Approve enrolments manually for high-value courses, so you decide who gets in before any video link is issued. See Approve purchases before students get access.
- Put your name, logo or store address in the footage when you record, or address the student by name in a live session. A copy that advertises you is a far smaller loss than an anonymous one.
- Write plain terms of use on the product page and in the first lesson: personal use only, no sharing, and what happens to access if the terms are broken. A rule students have read is one they can be held to.
Common questions
Can students download my hosted videos?
Not through the player. The download button is hidden, the right-click save menu is blocked on lesson videos and audio, and a video link expires two hours after it is issued. A student who uses developer tools, a download extension or a screen recorder can still keep a copy. Alva Video Hosting discourages casual saving; it is not copy protection.
Why can I still save the video with developer tools?
Because the browser has to receive the file to play it, and developer tools show everything the browser receives. Hiding that would take DRM, which is what VdoCipher provides, and even DRM cannot fully stop screen recording. Alva Video Hosting makes saving inconvenient rather than impossible.
Does the right-click block work on phones?
On desktop browsers, yes. In Chrome on Android the long-press menu is the same browser menu, so it should be blocked in the same way, though we have not tested every mobile browser. As far as we know, Safari on iPhone offers no save option on a long-press over a video, so nothing changes there.
Do I need VdoCipher?
Most stores do not. VdoCipher is a paid DRM service that closes the save-the-file routes at extra cost and setup, and it still cannot fully stop screen recording. It is available on request for stores whose content justifies it. For most courses, a deadline, manual approval and clear terms protect revenue better than a harder player.
See also
Was this helpful?
Last updated 2026-11-02