Security

Is Cloud-Based AI Color Grading Safe for Unreleased Films? Why Offline Processing Matters

Uploading frames of an unreleased film to an online service is a decision with contractual weight. Sometimes it is allowed, sometimes it is not. Here is how to find out, what to ask a vendor, and where offline processing helps.

In short

  • Cloud AI grading usually means sending frames, proxies or project data to someone else's servers. That is a disclosure of unreleased material.
  • Whether it is allowed depends on your contracts and the production's security requirements. These vary; read them, do not assume.
  • Offline processing keeps footage on your machine. It removes one class of risk, not every risk.

What actually leaves your machine

"Cloud AI grading" can mean very different things. Before using a tool, find out exactly what it sends:

  • Full frames or proxies uploaded for analysis, sometimes the whole clip.
  • Thumbnails or small stills, which still show the film's content.
  • Project data: clip names, scene names, timecode, metadata, sometimes notes. Clip names alone can reveal a title, a cast member or a plot point.
  • Your corrections, which some services may keep to improve their models.
  • Account and usage data, as with any online service.

Some tools process everything locally and only check a license online. Others upload every frame they analyze. Marketing pages do not always say which, so read the documentation and the privacy terms.

What production security rules say

There is no single rule. Requirements come from several places:

  • Your contract with the production or post house, and any NDA you signed.
  • The production's or distributor's security requirements, which differ between studios, streamers and projects.
  • Industry frameworks. The Motion Picture Association's Content Security Best Practices are assessed through the Trusted Partner Network (TPN). In 2022 the MPA announced version 5.0 of these best practices. It is organized around 64 best practices and adds application and cloud security.

Some productions allow approved cloud services, some require vendors to be assessed, and some do not allow unreleased picture to leave the facility. Policies vary. The only safe answer for a specific project comes from the people responsible for its security.

Questions to ask any cloud vendor

  1. Exactly what is uploaded: full frames, proxies, thumbnails, metadata?
  2. Where is it processed and stored, and in which countries?
  3. How long is it kept, and how is deletion confirmed?
  4. Is any of it used to train or improve models? Can you opt out?
  5. Who can access it: employees, subcontractors, other services?
  6. Is it encrypted in transit and at rest?
  7. Has the service been assessed under a framework your client recognises, such as TPN?
  8. What happens if the service is breached, and how would you be told?

If the answers are unclear, assume the footage leaves your control.

Why offline processing matters

A tool that processes footage on your own machine removes the upload question entirely. The frames do not leave the computer to be graded, so:

  • there is no third party holding copies of unreleased picture;
  • the tool can be used in facilities and suites with restricted or no internet access;
  • you do not need a vendor's security assessment for the picture itself;
  • it keeps working when a connection is slow or down.

Be clear about what offline does not mean:

  • The product may still have online parts: registration, license checks, updates, crash or feedback reports. Ask what each one sends.
  • Your machine still has to be secure. Offline processing does not protect footage on an unencrypted drive.
  • Scripts and plug-ins inside your grading software can reach the network. Blackmagic's scripting README warns about running scripts from unknown origins and allowing access from outside the application.

How AutoBalance handles this

AutoBalance's grading engine runs on the colorist's Mac. It reads the clips and writes to the Resolve project. It does not upload frames or use an external grading service. The product is not entirely offline, and we say so:

  • Registration for the private beta happens on this website.
  • The tester report is optional and off until the tester agrees. It sends a short row of numbers about the runs, never footage, frames, clip names, project names or file paths. Testers can switch it off at any time.
  • Feedback can be exported as a file and emailed, by the tester's choice.

The details are on the homepage and in the Privacy Notice.

FAQ

Do studios ban cloud color grading?

There is no universal ban. Some productions allow approved services, others restrict any upload of unreleased picture. Check the requirements of each project.

Is sending only thumbnails safe?

Thumbnails still show the content of the film. Treat them as picture, and check that the contract allows it.

What is TPN?

The Trusted Partner Network is the program through which vendors are assessed against the MPA's Content Security Best Practices.

Does offline AI grading need an internet connection at all?

The processing does not. Products may still use the internet for registration, licensing, updates or optional reports. Ask the vendor.

Sources

  1. Motion Picture Association: Trusted Partner Network updates MPA Content Security Best Practices (25 October 2022)
  2. Trusted Partner Network (TPN)
  3. Blackmagic Design: DaVinci Resolve Scripting README (security note on scripts and external access), installed with Resolve 21.1.2

Product names belong to their owners. Features change between releases; check the current documentation for your version.