Vault - screeners, dailies, DIT pipeline

The Vault is Grace's secure media delivery surface. Three sub-modules:

  • Screeners - magic-link delivery of cuts / assemblies / pitch reels to producers, financiers, festivals.
  • Dailies - per-day raw camera captures delivered to the editor + post team.
  • DIT pipeline - set-side media card tracking + offload management.

During the free open beta the Vault is available to every organization at no cost. (At general availability the Vault will be a Studio-tier feature.)

The first time you open each Vault sub-module, Grace runs a short in-app spotlight tour that points out the main controls. You can replay any tour from the gear menu's "Show guide".

Screeners

/dashboard/vault/screeners.

Screeners

A screener is a cut you want a specific person (producer / financier / festival) to be able to view, but not download. Each screener has:

  • File - the video file. Uploaded directly from your browser to secure cloud storage.
  • Title + description - what this cut is.

Watermarks are applied automatically to every screener during recipient playback. They are fixed, not a per-screener setting (see below).

Sharing a screener

Open a screener, then in the Shares section click Share with... (it toggles to Cancel). Enter the recipient's name + email, choose an expiry from the EXPIRES IN selector (48 hours / 7 days / 30 days / 90 days), and optionally add a personal message. Grace then generates:

  • A magic-link URL.
  • A 6-digit access code that expires after 10 minutes.
  • An email from the Vault sender with the link.

The recipient flow:

  1. Click link, land on the Vault viewer.
  2. Request a code, Grace emails the 6-digit code to the registered email.
  3. Enter the code, unlocks the session. The session lasts 24 hours and refreshes itself as long as you're active.
  4. View the screener. Watermarks visible at all times.

Watermarks (deterrent tier)

This is deterrent-tier protection, not DRM. OBS can still capture the screen, but the captured copy carries identifying watermarks:

  • Bottom-right corner - recipient email + share ID short + UTC timestamp, refreshed every 30s.
  • Large diagonal - same info, wandering every 8 seconds across the frame.

Both layers can't be hidden via DevTools (without breaking the page entirely).

A stronger tier, server-side watermark burn-in plus air-gapped review, is on the roadmap.

Device kick

Each time a viewer enters a fresh code, the previous device's playback stream is invalidated. So if the recipient shares their viewer link with someone else, only the most recent device can keep watching.

Forensic log

Every interaction is logged: code request, play start, seeks, device change, exit. Producers can audit who watched what when.

Dailies

/dashboard/vault/dailies.

Dailies

One dailies package per shoot day. Inside, multiple clips, one per source camera setup or per A/B camera split.

Per-clip flow

DIT uploads each clip directly from the browser. Files over ~100 MiB switch to chunked, parallel (multipart) upload with per-part retry, so multi-GB dailies upload reliably; the per-clip ceiling is 5 TiB. Clips stay producer-internal until you mark the package as delivered. On delivery, Grace converts each clip into a magic-link-protected screener so the editor / post team can stream it under the same security as everything else in the Vault. The clips never appear in your main screeners list, they live in the dailies surface only.

What recipients see

The editor or VFX team can be granted access to a dailies package the same way as screeners, magic link + email code. They see a list of clips and can stream each one. Same watermarks.

DIT pipeline

/dashboard/vault/dit.

DIT pipeline

DIT (Data Imaging Technician) workflow for tracking media cards from set offload to verified.

Each card row carries:

  • Shoot day + camera - A001 / B001 / etc., from camera A or B.
  • Format - ProRes 4444 XQ / RAW 6K / etc.
  • Capacity + used - GB on the card.
  • Master + backup drive paths - where the card was offloaded to.
  • Checksum method + status - you record which checksum tool you used and tick master-copy-OK and backup-copy-OK once you have confirmed both copies match. Grace tracks the state, it does not compute the checksum.
  • Status - hot (still recording), then offloading, offloaded, verified, cleared.

Status flow

  1. Hot - card is in the camera, currently recording. Don't pull.
  2. Offloading - card pulled from camera; in the process of being copied to master + backup drives.
  3. Offloaded - both copies done.
  4. Verified - you have confirmed both copies match the source. Card can now be reformatted and returned to set.
  5. Cleared - card is back in rotation.

Files per card

The file manifest per card - name, size, duration, checksum, optional scene/take reference - is populated by the DIT drawer's "+ Add Files" flow (paste a list of filenames from Resolve's offload report). This flow only records a text manifest of filenames. The actual clip bytes are uploaded through the dailies clip upload path (which is what gets delivered to the Vault); the "+ Add Files" manifest and the uploaded clips are two separate things.

Storage

Screeners, dailies clips, and creative assets all draw from a single per-organization storage pool. During the free beta every org gets the Studio-tier pool of 300 GB. Grace checks the pool before each upload; if an upload would exceed it, the upload is blocked with a prompt to free up space (or add storage). Deleting a screener or clip returns its bytes to the pool.

Vault security in depth

See Vault security reference for:

  • Token format + entropy budget
  • Session cookie signing
  • Device kick mechanics
  • Watermark layers
  • Range-only stream enforcement
  • Forensic log shape

Next

  • Editor log - what happens once you've got dailies clips linked to circled takes.
  • Wrap + delivery - final delivery handoff at end of show.