A finished cinema package — a DCP — routinely runs 40 to 300 GB. It's not one file but a folder tree with a strict internal anatomy: ASSETMAP, PKL, CPL, VOLINDEX, and the MXF assets they cross-reference. Consumer file-sharing chokes on it, email obviously can't carry it, and the traditional fallback — hard drives through customs — trades bandwidth for weeks and import paperwork.
We run this pipeline in production for an international festival's submission cycle — 300+ clients worldwide deliver through it — so what follows isn't theory. It's the six stages every delivery goes through, and what breaks when a stage is missing.
Stage 1 — Identity
Before a byte moves you need to know who's sending, for which film, without minting hundreds of accounts. An emailed one-time code does it: the producer proves control of the email on file, gets a scoped session, and never holds a password that can leak. Skip this stage and you'll spend the cycle matching mystery uploads to titles by filename archaeology.
Stage 2 — Ingest
The upload has to survive reality: hotel wi-fi, overnight sessions, a 300 GB single file. That means chunked, resumable transfer — a dropped connection resumes from the last uploaded part, not from zero — folder trees preserved exactly, and an import path for material that already lives at some link. If your producers' worst-case restart is "start over," your deadline week will be support week.
Stage 3 — Quality control, on arrival
The most expensive discovery in festival operations is a broken DCP found at projection time. QC has to happen the moment material lands: structure validated (ASSETMAP, PKL, CPL, cross-references), codecs probed, audio and subtitles checked — a pass / warning / fail verdict with a report someone can read, and a resubmission request when it fails. Automatically, per delivery, not "when someone gets to it."
Stage 4 — The catalog
Every festival has a tracking spreadsheet; the question is who updates it. If the answer is "a person, from memory," the sheet and the storage will disagree by week two — and "what's missing?" becomes a message thread. In our pipeline the spreadsheet the team already lives in updates itself: status, links and dates written back on every event. The sheet stayed; its maintenance didn't.
Stage 5 — Landing on your own storage
Cloud ingest is a waypoint, not a home. A sync agent pulls finished sessions down to the festival's own machines overnight — every file verified against its checksum (SHA-256), re-fetched on mismatch. A 42 GB master checksums in about three minutes; what you get for it is the sentence "the copy in the projection room is bit-identical to what the producer sent," which is the sentence that lets everyone sleep.
Stage 6 — Distribution
Receiving is half the cycle: the same films must reach cinemas. Each venue gets an invitation scoped to its own films, downloads its projection copy through verified links — and when a film is replaced late (it's always replaced late), everyone who already took the old version gets told. Without this stage, version control at twenty venues is a phone tree.
Security is not a feature — it's the deal itself
Everything above is logistics. This part is trust: a producer uploading an unreleased film is handing you the one asset their next two years depend on. A pre-release leak isn't an incident report — it's a market-value event. Which is why the studios' trade association (the MPA) runs TPN — the Trusted Partner Network — an assessment program that audits content-security practices across the media supply chain, and why partners from outside the industry point at SOC 2, the general-purpose equivalent.
Here's the honest way to read those badges: a certification is an audit of controls — it's the controls that protect the film. Whether or not a delivery partner carries the stamp, ask them to show the controls themselves:
- Scoped access — every person and venue sees only their own films, never the library.
- Identity without passwords to leak — one-time codes, expiry, attempt lockout.
- No single-person deletion — destructive actions need a second factor in someone else's hands.
- Integrity end to end — checksums on every file, verified again at every landing.
- Retention as policy — content deleted on schedule after confirmed delivery, backups nightly, and an audit trail that remembers who did what.
That list is how the system we run is built — architecture mapped to MPA content-security practices, designed certifiable from day one: controls first, badge when the operation warrants it. A partner who can show you the controls is worth more than one who can only show you the logo. A partner who can show neither shouldn't hold your films.
The parts nobody lists in the brochure
- Deletion needs two people. Purging content should require a second emailed code — a submission cycle is not the place for one bad click.
- Retention is a policy, not an accident. Content deletes automatically after confirmed delivery; backups run nightly; an audit log remembers who did what.
- Editors don't need the keys. A trailer editor gets a portal scoped to trailers — not the festival's whole library.
All of this is one system in production — the architecture, limits and numbers are in the Submit Portal case study, including the honest comparison with the transfer tools (Aspera, Signiant, MASV, WeTransfer) and where each one genuinely wins. And if your own cycle currently runs on a spreadsheet, WhatsApp and faith: we wrote the guide for that too.