SharingPrivacy

How to find out who leaked your PDF

If a confidential PDF ends up where it should not, a personal copy for every recipient tells you whose copy it was. Here is how tracked sharing works and how to trace a leak.

· 6 min read

You send a pricing proposal to six people. A week later a competitor quotes your numbers back to you. Or a draft report appears in a group chat it was never meant for. When everyone received the same file, there is no way to tell whose copy got out.

The fix is simple in principle: never send the same file to two people. Give every recipient a copy with its own invisible code, and keep a record of who got which code.

Share a link, not the file

With Tracked Share you upload the PDF once and send a link. Each person who opens it enters their email and gets a personal copy. The copy looks identical, but carries a code hidden in the file and, if you want, printed very small in the bottom-right corner of every page.

If a recipient wants to pass it on, they get their own link to forward. The next person receives a new copy with a new code, so the chain stays visible: your original is A, the people you sent it to get Aa, Ab, and someone who received it from Aa gets Aa1.

Tracing a leaked copy

  1. Open Tracked Share and find the Trace a copy box.
  2. Drop the file you found. DocuTools finds the copy by its fingerprint, or by its hidden code if the file was edited or re-saved.
  3. For a paper copy, drop a sharp photo or a 300 dpi scan of the bottom-right corner, or simply type the small code printed there.
  4. You see the path, for example A → Ab → Ab1, with the email and time each copy was issued.
Sharing something confidential this week?Try Tracked Share

Be honest about the limits

  • Codes can be removed by someone determined: retyping the text, taking screenshots or printing to a new PDF strips the hidden code. The printed corner code survives paper and photocopies, but can be cut off.
  • Recipient emails are entered by the recipients and are not verified, so a trace tells you whose copy it was, not who is guilty.
  • Recipients are told before they download that their copy is personalised. In practice that alone stops most casual forwarding.

Tracking is a deterrent and a lead, not proof on its own. Combine it with access limits: set a download limit per person and an expiry date for the link.