Running Your Own DRM License Server vs. Buying Managed: A Cost Breakdown Across 6 Providers

Last year, an engineering lead at a mid-market SaaS company priced out DRM the way most teams do.

They pulled up EZDRM's pricing page, saw $99.99 a month for Widevine, checked their AWS bill for a MediaConvert estimate, and figured self-hosting would save a few hundred dollars a month over a managed vendor.

18 months later, that team had shipped no DRM at all. The FairPlay certificate process alone had eaten six weeks of a sprint they didn't have spare.

This is the trap almost every DRM cost comparison walks straight into. The license server fee is the easiest number to find, so it becomes the number everyone compares. It is also close to the least important number in the decision.

This article breaks down the real cost of running your own DRM license server against six named managed providers, with sourced 2026 pricing on both sides, plus where platform-included options like Gumlet and VdoCipher fit into that same math.

Key Takeaways

• The license server fee is a small share of what self-hosted DRM actually costs. At 50,000 monthly licenses, a standalone license server such as EZDRM or castLabs runs $99 to $299 a month, while AWS transcoding, packaging, and a fractional share of a senior engineer's time push total self-hosted spend into four figures monthly. The license fee alone rarely clears 10% of that total.
• Six managed providers, EZDRM, castLabs, DoveRunner, Axinom, Bunny MediaCage, and AWS Marketplace Cloud DRM, publish base fees ranging from $99 to $300 a month before any per-license charges.
• Self-hosting means building six separate components, not one. The license server is usually the cheapest of the six.
• Three DRM systems do not triple your encryption cost. CENC and CMAF encrypt content once. Only license delivery stays DRM-specific.
• Widevine and FairPlay alone cover the overwhelming majority of a browser-first SaaS audience. PlayReady matters mainly for native Windows apps, Xbox, and specific smart TV platforms.
• A documented break-even zone exists where self-hosting gets cheaper, but it sits at a volume most SaaS video use cases will not reach without dedicated infrastructure headcount already in place.

What is a DRM License Request, and What Are You Actually Paying For?

A DRM license request is what happens the instant a viewer's device asks for permission to decrypt a piece of protected video.

Digital Rights Management (DRM) wraps your video in encryption at the packaging stage, and every time someone presses play, their device's Content Decryption Module sends a request to a license server asking for the key. The server checks whether that request is authorized, and if it is, hands back a license containing the decryption key and the playback rules attached to it.

One playback on one device usually equals one license request. But "usually" is doing real work in that sentence. Switch from Chrome to your phone mid-session and you generate a second request.

Bunny's own MediaCage documentation confirms that multi-key configurations can issue a separate license for the video track and a separate one for each audio track, meaning a single HD playback with a translated audio track can bill as two license requests, not one.

This matters because license count is not the same thing as subscriber count or view count. Budget from the license number, never from the subscriber number.

Self-Hosted DRM: The Six Components You're Actually Building

Ask a vendor's sales rep what "self-hosting DRM" means and you'll get a one-line answer: run your own license server. Ask an engineer who has actually shipped it, and the answer gets longer fast.

A production multi-DRM stack has six moving parts, and the license server is only one of them:

• Content encoding and packaging pipeline, encrypting video into CENC-compliant CMAF or DASH before any license server has anything to protect.
• Widevine license server, handling key delivery for Chrome, Android, Edge, and most smart TV platforms.
• Apple FairPlay Key Security Module (KSM), a server-side component Apple requires you to run yourself, per Apple's own FairPlay Streaming documentation.
• PlayReady license server, only if you need native Windows apps, Xbox, or specific smart TV ecosystems covered.
• CDN and storage infrastructure at whatever traffic volume you're actually serving.
• Player-side DRM integration, built separately for web, Android, and iOS.

The license server itself, the piece every pricing comparison leads with, is typically the cheapest line item on that list once you count everything else.

Widevine and FairPlay are both free to license, per Google's and Apple's own developer documentation. Free to license is not the same as free to run.

Do not price self-hosted DRM off the license server fee alone. Every build-vs-buy comparison that gets this wrong makes the same mistake: it treats the cheapest, most visible line item as the whole bill.

Six Managed DRM Providers, Priced Side-by-Side

Most cost comparisons stop after naming two or three vendors, and some inflate the count by listing a company under two different brand names. PallyCon and DoveRunner are a common example: PallyCon was INKA Entworks' DRM product, and the company rebranded its entire lineup to DoveRunner in March 2025. They are on the same pricing page today, not two competitors.

The table below names six managed DRM providers with pricing pulled directly from each provider's own current pages.

No two providers meter usage the same way. EZDRM and castLabs bill per license request. DoveRunner and Axinom both offer a choice between MAL (Monthly Active Licenses) and MAU (Monthly Active Users), a coincidence of two independent companies converging on the same billing flexibility, not the same billing plan. Bunny bills per license but per device and key, which is why its effective rate runs higher than the sticker $0.005 once multi-key billing kicks in.

Decision rule: Calculate your actual expected license volume, including device-switch overhead and multi-key doubling if your provider bills that way, before comparing sticker rates. A $99 base fee with per-key billing can cost more at real volume than a $299 base fee with per-request billing.

An audience with a small number of highly active viewers tends to cost less under MAU pricing, since you're billed per person regardless of replay count. An audience with many viewers watching briefly tends to cost less under MAL pricing, since you're billed per request.

DoveRunner's own published example shows 20,000 MAUs landing at $1,239 total on its Standard plan: $299 for the first 1,000 users, plus tiered per-user overage for the rest. Neither model is inherently cheaper; the one that wins depends on your viewing pattern.

Where DRM Bundled into Video Hosting Fits

Every provider in the table above sells DRM as a standalone, metered product. A separate category skips that model entirely and folds DRM into the video hosting plan itself, billed as part of the same invoice that covers encoding, storage, and delivery rather than as a per-license line item.

Three names come up most often when B2B SaaS and EdTech teams shortlist this category: Gumlet, VdoCipher, and Bunny Stream, each pricing it a slightly different way.

Why does this category exist at all?

Because the six providers in the table above are all solving the same narrow problem, license issuance, while a production video stack needs five other components regardless of which DRM vendor sits in the middle.

Folding DRM into the hosting bill doesn't just simplify invoicing. It removes an entire category of integration work: no separate SDK to wire in, no second vendor's uptime to monitor, no reconciling two support queues when a playback failure could be a DRM issue or a CDN issue and nobody's sure which.

That tradeoff matters most for teams who answered 'no dedicated video infrastructure engineers on payroll' in the Decision Matrix further down this article.

For that team, the standalone providers above are still the right choice once volume or compliance requirements demand it. Below that threshold, the question isn't which per-license rate is lowest. It's whether a second vendor relationship is worth the integration and monitoring overhead it adds.

1. Gumlet

Gumlet is an all-in-one video hosting, security, marketing, and delivery platform, priced around plan tiers rather than bandwidth alone, with video DRM available as an add-on covering Widevine and FairPlay across its hosting plans, alongside dynamic watermarking, signed URLs, and geo-blocking under one video protection umbrella.

The add-on model matters more than it sounds. Rather than gating DRM behind a specific plan tier, it's available on top of whichever plan a team's bandwidth and storage needs actually call for, which avoids a common failure mode: overpaying for a higher tier solely to unlock protection features a team doesn't otherwise need yet.

For a team that has already ruled out PlayReady because its audience is browser-first, that two-DRM scope lines up with what most B2B SaaS video actually needs.

Offline license support for both Widevine and FairPlay comes bundled at the same add-on price, which standalone per-license providers often treat as a separate, higher-tier feature.

2. VdoCipher

VdoCipher is a notable video hosting option for course platforms and EdTech. Its Starter plan runs $149 a year for 1,000 GB of bandwidth and 100 GB of storage, per its own pricing page, with Widevine and FairPlay DRM, dynamic watermarking, and secure embedding included at that flat rate rather than metered per license.

Pricing goes all the way up to $4,999 a year for 50 TB of annual bandwidth and 2 TB of annual storage.

3. Bunny Stream

Bunny Stream, the hosting product from the same company behind Bunny MediaCage in the table above, includes basic DRM protection, token authentication, and its player free with usage-based storage and CDN billing starting near $1 a month.

That's a genuinely different product from MediaCage Enterprise: Bunny Stream's included DRM covers standard protection at no extra line item, while MediaCage is the standalone multi-DRM add-on billed per license, the one already priced out earlier in this article.

Worth noting for teams comparing all three: Only Gumlet and VdoCipher in this section include DRM at no incremental license-count cost across their published tiers; Bunny Stream's included protection is more limited in scope than the MediaCage Enterprise product it's often confused with, which is exactly the distinction the next paragraph covers.

All three carry the same tradeoff bandwidth- or plan-based hosting always carries: cost scales with data transferred or plan tier, not with license requests issued, so a catalog with large file sizes or high-resolution delivery can consume bandwidth faster than a lighter, high-frequency-viewing SaaS product would.

A team with unusually low bandwidth and high license-request volume, many short plays from the same small file, may still do better on castLabs' or Bunny MediaCage's per-request pricing than on a bandwidth-metered plan.

The decision rule here: If your team would rather manage one hosting invoice than reconcile a separate DRM bill against a separate CDN bill every month, price the bundled options first, then check them against the per-license table above at your actual bandwidth and license volume before assuming either model wins by default.

The DRM Ownership Ledger: Self-Hosted vs. Managed on the Same Rows

Most build-vs-buy comparisons put self-hosted and managed costs in two separate tables, or one blended number per side.

That makes them impossible to compare honestly, since the categories don't line up. Here is the same structure applied to both paths, with self-hosted figures built from AWS's published MediaConvert and MediaPackage rates and current senior backend engineering compensation data.

Where self-hosted cost actually concentrates is the engineering labor row, not the license row. That single row alone, at $1,250 to $3,125 a month even on the conservative end, can exceed the entire monthly bill of any of the six managed providers above.

The categories most spreadsheets miss start before a single line of code ships. Apple's Developer Program enrollment requires a D-U-N-S number, a business entity check, and typically a multi-day approval window before Apple releases the FairPlay Streaming deployment package, the prerequisite for touching FairPlay at all. Teams that haven't enrolled discover this dependency in week one of a sprint they'd already scoped as two weeks.

Google's own Widevine documentation confirms CDM versions get deprecated periodically, which can force a content-catalog repackaging project on a self-hosted stack. Add device regression testing and on-call incident response on top, and the license server fee turns out to be a small fraction of the real number.

The question worth asking your own team isn't "what does DRM cost?" It's "who owns fixing it the day Google deprecates a Widevine CDM version we depend on?" If nobody can answer that in one sentence, you don't have a self-hosted cost estimate. You have a guess.

Worked Cost Comparison at Three License-Volume Tiers

At every tier here, engineering labor, not the license fee, is what keeps self-hosted costs above managed. Google's own retirement of its free Widevine Cloud License Service, effective April 13, 2027, adds a second reason the crossover point sits so high: teams self-hosting below that volume are now also absorbing a mandatory migration project that managed providers and platform-included options don't pass on to their customers.

Below several million monthly license requests, and without dedicated video infrastructure engineers already on payroll, that combination of ongoing labor cost and unplanned migration work rarely pencils out.

If you're running product demos, gated documentation, or in-app onboarding video for a SaaS product, that threshold rarely applies to you, and building toward a crossover point you're unlikely to reach adds engineering cost with no corresponding savings.

Do You Need Widevine, FairPlay, and PlayReady, or Can You Ship Fewer?

For a browser-first B2B SaaS audience, Widevine and FairPlay cover the devices that matter. Widevine handles Chrome, Edge, Android, and most smart TV platforms. FairPlay is required specifically for Safari, iOS, and macOS, since Widevine doesn't reach Apple's ecosystem.

PlayReady becomes relevant mainly for native Windows applications, Xbox, and smart TV platforms that fall outside Widevine's coverage, none of which describes a video demo or onboarding flow running inside a web app.

Multi-DRM does not mean re-encrypting content once per DRM system. CENC, Common Encryption standardized as ISO/IEC 23001-7, encrypts a video asset once using a single key, and CMAF packages that single encrypted asset into a container all three DRM systems can read.

What changes per system isn't the video file, it's the small metadata wrapper telling each Content Decryption Module which key ID to request. A Widevine CDM, a FairPlay KSM, and a PlayReady license server are reading the same encrypted bytes and asking three different servers for permission to decrypt them.

That's why the operational cost of a third DRM system isn't a third encoding pipeline, it's a third certificate to renew, a third license server to monitor, and a third device matrix to test against.

Don't add PlayReady by default because a competitor's stack includes it. Add it when a named platform, Xbox, a specific smart TV ecosystem, a native Windows app, actually requires it. Every DRM system you add is another certificate cycle and another line in your provider's per-DRM pricing.

What "Managed" Actually Covers, and What Still Sits on Your Team

Every provider in the table above handles license issuance infrastructure, key delivery, scaling, and the license server's own uptime. That's what the base fee buys. What stays yours regardless of provider:

• User authentication and session management
• Entitlement logic: which authenticated user gets access to which content
• Token or session-security implementation on your own application layer
• Player-side DRM integration and security
• Protection of your own API credentials and provider secrets

Decision rule: Before signing with any managed provider, ask directly which of these five responsibilities their platform actually handles versus which remain on your team. A vendor who can't answer precisely is selling you a license server, not a security solution.

The Decision Matrix

The disqualifier: If your team doesn't already have dedicated video infrastructure engineers on payroll, and your compliance requirements are standard rather than studio-level, self-hosting is the wrong answer at almost any volume covered here. That's the conclusion the sourced numbers above actually support, not a hedge.

Which Path Actually Makes Sense

Run these numbers against your own volume, and the pattern holds regardless of which provider you'd shortlist: below the 5 million monthly license threshold, and without dedicated video infrastructure engineers already on staff, the managed or platform-included path wins on cost, time to production, and who's awake at 2 a.m. when something breaks.

Among the per-license providers, the right pick depends on metering preference. Teams with predictable, high-retention audiences often do better on MAU-based billing from DoveRunner or Axinom.

Teams with spiky traffic tend to prefer castLabs' per-request tiering. EZDRM remains the most transparent starting point for published pricing without a sales call, and Bunny's flat $99 base is attractive at low volume, provided you've checked whether your content triggers its multi-key billing.

For a team that would rather not operate a separate DRM relationship at all, Gumlet's multi-DRM implementation folds Widevine and FairPlay into the hosting plan, alongside the packaging, storage, and CDN layers a standalone license server never touches.

That won't beat a per-license provider at every volume, and it won't suit a platform already running dedicated DRM infrastructure at scale. For a team evaluating this decision for the first time, it's worth pricing against the per-license table above before signing anything.