Store once. Process deliberately. Play retained revisions.

Upload and process a stored video

Upload your file in PipeBox using its normal direct-to-storage transfer. Once published, open the file’s action menu and choose Process video. You can also enter an authorized bucket and object key in the Video library.

Choose a linked infrastructure payer, retention period, processing cap and transfer allowance, then explicitly accept the charges. The controller pins the current object version and digest. Replacing or deleting the source before it is read fails the job; it never silently processes a replacement.

The fixed preset accepts a single progressive 8-bit SDR H.264 video track, square pixels, 16:9, from 360p to 1080p and up to 60 input fps, with optional audio. It produces non-upscaled 1080p / 720p / 480p / 360p renditions as applicable, 30 fps H.264, AAC audio, static HLS and DASH, a fast-start MP4, and a thumbnail. No custom FFmpeg command, remote URL, HDR, rotation or arbitrary repository code is executed.

Input is bounded to 2 GiB and 60 minutes; output to 4 GiB, 2 GiB per file and 4,096 files. Processing stops at the earlier of the paid time cap or two worker-hours. These are maximum bounds, not a guarantee that every input finishes within them.

Verification and private playback

The worker uploads each declared output through narrowly scoped authorization, reads it back in at most 32 MiB ranges, checks SHA-256 and BLAKE3, and publishes readiness only after the complete package is verified. Storage ETags are opaque multipart tokens, not MD5 checksums.

Open a retained revision and use Open preview. The player and download links read from Pipe Storage through your current dashboard session. They continue working after the worker or Live lease stops. No signed storage credential is exposed to the browser. There are no public sharing links or anonymous playback in this release.

Team membership, session validity, revocation and retention are rechecked during playback. Revoke playback denies new reads; it cannot recall bytes already downloaded or buffered. The same applies to leaving a team.

Opt-in Live recording

Open a Live stream’s Recording tab. Recording is off by default and requires a qualified primary input. Set retention, maximum duration and a per-recording transfer allowance, and explicitly enable it before the next broadcast. Reconnecting a publisher may create a new recording with a new allowance.

The node stream-copies its qualified primary input into finalized six-second MPEG-TS chunks and journals their upload acknowledgements. A final HLS manifest is written last. This is a recording from recorder readiness, not a promise to capture frames sent before that point. Raw recordings are HLS; create an explicitly funded processing revision to obtain an ABR package, DASH, MP4 and a thumbnail.

Capture never blocks Live admission. A recording limit, full spool or transfer cap stops recording while the broadcast continues. Only confirmed finalized chunks are included, and partial recordings are marked incomplete. Network failures leave a recoverable journal rather than a false ready result. Recovery is bounded; recordings that cannot reconcile require operator attention.

New policy terms apply to the next recording. Disabling also stops active capture. Recording is not Live DVR, LL-HLS recording, synchronized redundant-input archival or seamless origin failover.

Costs, cancellation and retention

VOD processing has its own displayed rate version in USDC per measured worker-hour, charged once per job rather than per rendition. Processing credit is reserved first; unused credit is released only after a final stopped-worker receipt. The existing Live pilot’s zero transcoding surcharge does not imply free batch video processing.

The transfer allowance is a conservative admission cap for source downloads, retries, replicated writes and verification. The storage gateway alone bills actual storage transfers; the allowance is not a second charge. Playback and downloads use separate existing storage transfer billing, outside the processing job’s cap. Use infrastructure credit, not inference credit.

Cancel queued jobs for immediate release of their unspent processing reservation. Active jobs stop within their authorization lease and then settle measured usage. If a worker disappears, the reservation stays held until it recovers or an operator reconciles it. Explicit retries create a new paid job and immutable output revision.

Retention is 1–365 days. Playback ends at expiry; background cleanup retires only registry-managed output objects, after active work has stopped. Original uploads are never deleted by video cleanup. Incomplete recordings and failed-job outputs are also covered. Revoking playback does not immediately erase retained output or refund incurred charges.