Watermarking Confidential Documents: How to Deter and Trace a Leak

Most leaks of company documents do not come from an elaborate hack. They happen when someone who is allowed to read a document passes it on, on purpose or by accident. Once the document shows up in a group chat or on social media, the first question is usually the same: whose copy is this?

This guide explains how visible and invisible watermarks work, what neither of them can do, and what you should have in place before a leak happens.

Why confidential documents leak

Four routes account for most cases.

• Forwarded attachments. A PDF or Word file goes out by email or chat and gets forwarded to people you never listed as recipients.
• Screenshots. A recipient opens the document on screen, takes a screenshot and shares the image without ever holding the original file.
• Photos of a screen. Someone photographs the monitor with a phone. It is crude, but it leaves nothing behind in any system.
• Shared links. A link to the document is sent on, and anyone holding it can open the document if the link has no restrictions.

A leak is hard to trace because the leaked copy is usually identical to the copy every other recipient holds. If ten people received exactly the same file, nothing points to any one of them. Tracing only becomes possible when each recipient holds a copy that can be told apart.

Visible watermarks

A visible watermark is text printed on the page, usually the reader's name, email and the time of access. It is often set at an angle and repeated across the page, so readers know their activity is recorded.

What it deters

The effect is mostly psychological. People tend to think twice before sharing a screenshot that carries their own name and email. A visible watermark also makes a leaked page point at its source immediately, with no analysis needed, as long as the watermark is still intact in the image that circulates.

Why it is easy to remove

The weakness is just as plain. Someone can crop the image until the marked area is gone, cover it with a block of colour or erase it in a photo editor. A watermark near the edge of the page falls to a simple crop. A person who plans to leak a document and understands the risk will do this first.

When it is enough

A visible watermark is adequate for documents of moderate risk, such as internal meeting material, drafts under discussion, or documents that many people in the organisation read. Its job is to remind readers, and it does that well. For documents where a leak would do serious damage, such as a vendor agreement, financial data or an acquisition plan, you need a second layer.

Invisible (forensic) watermarks

An invisible or forensic watermark places a hidden mark inside the file. The reader does not see it, and the document looks like any other copy. The idea is simple: every recipient gets a copy with a unique mark, and the system records whose mark it is.

Picture sending the same document to five people, with a slightly different hidden marker in each copy. The marker does not change what the document says. If one copy leaks, you read the marker, match it against the records, and learn who the copy was issued to and when.

The mark belongs to the copy and not to the content, so it travels with the file wherever it is forwarded. With a screenshot, the mark can only be read from the part of the page that appears in the image. The result therefore depends on how much body text is still visible and how clear the image is.

An invisible watermark does not stop anyone from leaking a document. Its purpose is to make a leak traceable afterwards, and knowing that it exists often makes people more careful.

The limits you should know

This technology has limits, and it is better to know them before you rely on it.

Two points deserve emphasis. First, a photo of a screen generally cannot be traced with an invisible watermark, so the visible watermark and access control still matter for closing that gap. Second, once an image has been heavily recompressed, less of the mark survives, and the result may be a "likely match" or "inconclusive" instead of a confirmed answer. If you depend on a particular channel, test it with your own documents first.

Combining the layers

No single measure closes every gap, so the sensible approach is to combine several.

1. Access control. Limit who can open each document. A person who cannot open a document cannot leak it.
2. Expiring view-only links. Share through links that have an expiry date, can be revoked and are protected by a password or a one-time code, and avoid attachments.
3. Visible watermark on preview. Readers who only need to read should view the document in a preview that carries their identity, without downloading the file.
4. Invisible mark on downloads. Every file that does leave the system carries a mark for its recipient.
5. Audit trail. A record of who opened, downloaded and shared a document helps you narrow down the list of possibilities.
6. A classification policy. Decide which documents are Public, Internal or Confidential, and set the treatment for each class, for example that Confidential documents cannot be downloaded or must always be marked.

The classification policy is often skipped, yet it decides which documents get the other layers. Without it, teams either mark everything or mark nothing.

What to do when a leak happens

1. Preserve the leaked copy. Keep the original file or image, the URL or message where it was found, and the time you found it. Do not edit it or save it again through another app, because extra compression reduces what is left of the mark.
2. Check the mark. If you use invisible watermarks, submit the copy to the verification tool and read the result. Treat a "likely" result as a lead that still needs checking.
3. Check the audit trail. Compare the result with the access records: who opened the document, when and from which device. A mark that agrees with consistent access records is much stronger than either one alone.
4. Involve HR and legal. Tracing shows whose copy leaked, and it does not prove who leaked it. That person's account may have been used by someone else, or the copy may have been forwarded by a third party. Decide on any follow-up together with HR and legal.

How Obscura helps

Obscura provides several of these layers in one system. Share links can expire and be revoked, and they can be protected with a password, an email one-time code or an allow-list. Every link also has an access log. A document's classification decides what may be shared, and it can block downloads while still letting people read.

Recipients read the document in a secure preview that shows a visible watermark with their name, email and the time of viewing. The invisible mark is not in the preview. It goes on downloads, share-link downloads and issued copies, through the Watermarking module, which is licensed separately. Marking is off by default until an administrator switches it on.

Each marked copy is recorded in an issuance ledger with its recipient, document, version and channel. The ledger also holds the time of issue, the IP address and the device. A copy that you find can be uploaded to the verification console as a PDF, JPG, PNG or WebP file, and the console answers Confirmed, Likely or Inconclusive. Only users with the investigate permission can run a trace.

The limits are the same as described above. A clear screenshot with about two paragraphs of body text can be traced, photos of a screen are not supported, and the effect of each social media app's recompression has not been measured.

More detail is on the pages for document watermarking and security and architecture, and sharing is described on the capabilities page.

Short checklist

• Classify your documents and set the treatment for each class.
• Limit access to the people who need to read.
• Share through expiring, revocable links instead of attachments.
• Use a visible watermark for documents read in a preview.
• Use an invisible watermark for files that must be downloaded.
• Switch on the audit trail and make sure someone reviews it.
• Prepare a leak procedure: preserve the copy, check the mark, check the audit trail and involve HR and legal.
• Test tracing on your own documents before you rely on it.