Request For Product (RFP): Download Page Protection

I have the following site arrangement:
Main domain hosted on HostGator:

• ITvideoTutor.info, contains an individual thank-you-download page within its own folder for each product. Indexing is turned off site-wide. An index.php file redirects back to each product's add-on domain's squeeze page if a user attempts to view contents of the the thank-you-download-page's folder itself.

Products are stored securely on Amazon S3:

Each product is a large zip file of 400 MB and up containing video training. The download pages use the s3.php script to connect securely to the product file on Amazon S3. The product file ACL on Aamazon S3 is set so that the product is NOT readable by everyone. In other words, it can only be accessed via the secure link on the download page. A unique link is regenerated each time the download page is accessed and is only valid for 15 minutes (or whatever time I set). The only way to access the product is through this unique, time-limited link. This eliminates both product and bandwidth theft that would originate from users sharing the download link. Thus, the critical issue now is to protect the thank-you-download page itself.

Add-on domains, one for each product squeeze page:

• cpanelvideotutor.com
• amazons3securityvideotutor.com
• wordpressvideotutor.com
• etc.

Each add-on domain contains a squeeze page that uses PayPal to process payments. After successful payment, purchaser is returned to the correct thank-you-download page on main domain. These download pages are not currently protected other than by random-character-sequence names, indexing turned off site-wide, and index.php redirection to product's squeeze page. (I know, security by obscurity is not good.)



I am making a Request For Product for either an existing or newly created product to protect my download pages in this senario. The product should give each purchaser access to a uniqely coded URL to access the thank-you-download page for the product that they have just purchased. They will reach this page automatically when returning from PayPal. The user can bookmark this page. Access to this page will expire after a configurable number of hours or days. After expiration, upon attempting to access this page, the user will be redirected to a page which directs them to our support helpdesk system (which is already in place as an implementation of osTicket). Probably, the simpler the solution the better. At this time I do not need automatic integration with an autoresponder, etc.



Here are my questions:

COMPATIBILITY - Is your product compatible with this site arrangement. Specifically, that the products are stored off-site on Amazon S3 and that there is a main domain for thank-you-download pages and an add-on domain for each squeeze page?

SCALABILITY - Will your product scale to handle many add-on domains and thank-you-download pages?

MAINTAINABILITY - How easy is it to protect newly added products, i.e., can I do this myself or does it require another consulting expense? How easy is it to drop discontinued products?

FUNCTIONALITY - Will purchasers be able to make purchases that mix and match across the product line yet only have access to the products that they have purchased?

I look forward to your proposal.

Eugene Murray