Sign-in and SSO
- Single sign-on with Microsoft Entra ID over OpenID Connect. Your Admins set it up from the admin's security settings.
- Staff can also sign in with an emailed link or a password. An Admin can turn those off once SSO works, and Clerkcast won't let them lock everyone out doing it.
- No self-registration. Staff accounts are created ahead of time, and an SSO sign-in links only to an existing account with the same verified email.
- Each town signs in on its own address (
videos.yourtown.gov/admin). There's no shared sign-in page across towns.
Roles
| Role | Can |
|---|---|
| Admin | Everything an Editor can do, plus settings, branding, users and roles, single sign-on and emergency stream key revoke. |
| Editor | Schedules and runs meetings, uploads and edits video, manages channels, documents and the archive, and sees the compliance report. |
| Captioner | Works the caption queue and caption requests, and sees only the videos those involve. |
Permissions are checked on the server for every action, and a role change or a disabled account takes effect right away.
Sensitive settings and stream keys
- Sudo mode. Changing users, roles and sign-in settings asks the Admin to have signed in recently.
- Encrypted secrets. Stream keys, SSO credentials and the YouTube and Zoom caption addresses are encrypted where they're stored.
- Stream keys stay hidden until someone with permission reveals one, and every reveal is recorded. A leaked key can be revoked immediately, even mid-meeting.
- Private until you publish. A meeting's preview is never reachable by the public, and video is delivered over signed links.
The audit trail
Changes to your videos, captions, channels, settings and users are recorded with who made them and when. Named events cover what reviewers usually ask about: publishing, caption edits and verifications, archive decisions, requests, stream key reveals and sign-in settings. The history can't be edited, and it's kept as long as your organization exists.
Hosting
Clerkcast runs in data centers in the United States. Your video, captions and records are stored there.
Your network
- No software to install beyond the encoder you already use, or none at all if you stream from a browser.
- Outbound streaming on port 1935, or port 443 if you use RTMPS.
- A few DNS records to put your video site on your own address, such as
videos.yourtown.gov: one for the address and the ones that prove it's yours for the HTTPS certificate, which Clerkcast provides.
Your data and the end of a term
- Export at any time: your video, captions, documents, a metadata spreadsheet and the audit history.
- A grace period. If a term ends, your public site stays up for a grace period (90 days unless agreed otherwise) before it's turned off.
- Nothing is deleted by itself. Ending a term doesn't delete anything. Removing your data takes a deliberate step on our side, and only after your export has been delivered.