Data Leak Prevention for Small Teams Without Enterprise DLP

What enterprise DLP does, and why it's a stretch for small teams

Enterprise DLP tools watch email, endpoints, cloud storage and network traffic, and block or flag data that looks sensitive (card numbers, ID numbers, labeled documents). They're useful when you have a security team to configure rules, review alerts and handle false positives.

For a small team that's usually too much: licenses and setup cost money, rules need constant tuning, and most of the files that actually hurt when they leak (a pricing deck, a draft contract, an unreleased design, a customer list) don't match any pattern a tool can spot. They're just files that went to the wrong person.

Layer 1: share less, with fewer people

Most leaks come from a file reaching more people than needed. This costs nothing:

• Decide what is sensitive. Five or ten categories are enough: financials, contracts, roadmap, customer data, unreleased creative work.
• Send to people, not to lists. Avoid reply-all and big group chats for sensitive files.
• Expire what you can. Remove shared links and folder access when a project ends.
• Separate the sensitive parts. Send the full numbers or the customer names only to those who need them.

Layer 2: control where files live

• Use a shared drive with real permissions instead of attachments flying around by email.
• Turn on two-factor authentication for email, storage and chat, and remove accounts of people who left.
• Review sharing settings a couple of times a year: "anyone with the link" is the quiet default behind many leaks.
• Use device protections such as screen lock and disk encryption on laptops and phones.

None of this stops a person who has legitimate access from taking a screenshot or forwarding a file. That's what the third layer is for.

Layer 3: make sensitive files traceable

Access controls end at the moment someone has a copy. Visible watermarks (a name across the page) help, but can be cropped or covered; see visible vs invisible watermarks.

With an invisible forensic watermark, each recipient gets a copy of the file with a different pattern written into it. If the file, or a screenshot of it, later shows up where it shouldn't, you upload it to Detect and Markedfile tells you which copy it matches. The recipient list stays on your side.

This works for images and PDFs on every plan, and for video on the Business and Enterprise plans (up to 10 minutes and 100 MB per video). It doesn't cover audio or plain text someone retyped.

How to set it up in an afternoon

1. List the 3 to 5 files or folders that would hurt most if they leaked, for example the investor deck, a draft contract, the price list or the next campaign.
2. Create one marked copy per recipient in Markedfile, with a recipient code you'll recognize later, and keep that list private.
3. Send each person their own copy through your normal channel.
4. Tell the team that copies are traceable. Many teams find that knowing this is the main deterrent.
5. If something leaks, upload what you found to Detect and read the result.

Files are processed in memory and are not stored. The Free plan covers 5 active files, detection for 6 months, and PDFs up to 10 pages. Starter ($9.99/month) allows PDFs up to 50 pages, Pro ($19.99/month) up to 100 pages, and the Business plan ($49.99/month, one shared workspace for the whole team) up to 500 pages. If you want to mark files from your own tools or workflows, Business and Enterprise include an API that also covers video (POST /api/v1/mark and /api/v1/detect, up to 10 min and 100 MB, MP4 download); see the docs. For how a PDF is traced, see how to trace a leaked PDF to the recipient, and for decks, the board and investor deck page.

What to do after a match

A match tells you which copy a file came from. It doesn't prove who shared it: the recipient may have forwarded it on purpose, a colleague may have had access, or an account may have been compromised.

• Start with a calm conversation with the person who received that copy.
• Check what leaked and how far it spread.
• Decide what changes: fewer recipients, sensitive parts sent separately, shorter-lived links.
• Don't accuse anyone based only on a match.

Where this approach has limits

• It doesn't prevent leaks. It only makes them traceable, and only for copies marked before they were sent.
• Detection is never guaranteed. Heavy editing, strong compression, retyping text or a very small crop can destroy a mark. Images and video frames under 96×96 px are rejected; everything else uses the same pattern. Images and video frames under 96×96 px are rejected; everything else uses the same pattern. For images, a crop of roughly 256 px of a detailed area is the approximate minimum, not a ceiling.
• PDF screenshots: The PDF mark is now invisible, and PDFs marked before this change aren't compatible, so re-mark them. A screenshot can be checked if it shows roughly 200 pt of a ticket, 160 pt of a photo, 320 pt of a slide, or the top half of a text page; dense text on its own isn't detected. A PDF screenshot is best effort and is not guaranteed.
• Retyped or paraphrased text isn't traced.
• It identifies a copy, not a person. Treat it as a lead.
• It doesn't replace compliance tools. If you must meet specific regulatory requirements for customer data, you may still need proper DLP or other controls.

FAQ

Do small teams need DLP at all? Not necessarily the enterprise kind. Sharing less, using real permissions and two-factor authentication prevent most accidental exposure.

What is the cheapest way to start? Layer 1 and layer 2 cost nothing. For layer 3, Markedfile has a Free plan with 5 active files.

Does an invisible watermark stop someone from leaking a file? No. It makes the copy traceable.

Does it work on screenshots? In many cases, yes, within the limits above; never guaranteed.

Can I mark files I already sent? No. Only copies marked before sending can be traced. Mark the current version and send it again if it matters.

Try Markedfile for your team · Read the API docs