Data Leak Prevention for Small Teams Without Enterprise DLP

What enterprise DLP does, and why it's a stretch for small teams

Enterprise DLP tools watch email, endpoints, cloud storage and network traffic, and block or flag data that looks sensitive (card numbers, ID numbers, labeled documents). They're useful when you have a security team to configure rules, review alerts and handle false positives.

For a small team that's usually too much: licenses and setup cost money, rules need constant tuning, and most of the files that actually hurt when they leak (a pricing deck, a draft contract, an unreleased design, a customer list) don't match any pattern a tool can spot. They're just files that went to the wrong person.

Layer 1: share less, with fewer people

Most leaks come from a file reaching more people than needed. This costs nothing:

• Decide what is sensitive. Five or ten categories are enough: financials, contracts, roadmap, customer data, unreleased creative work.
• Send to people, not to lists. Avoid reply-all and big group chats for sensitive files.
• Expire what you can. Remove shared links and folder access when a project ends.
• Separate the sensitive parts. Send the full numbers or the customer names only to those who need them.

Layer 2: control where files live

• Use a shared drive with real permissions instead of attachments flying around by email.
• Turn on two-factor authentication for email, storage and chat, and remove accounts of people who left.
• Review sharing settings a couple of times a year: "anyone with the link" is the quiet default behind many leaks.
• Use device protections such as screen lock and disk encryption on laptops and phones.

None of this stops a person who has legitimate access from taking a screenshot or forwarding a file. That's what the third layer is for.

Layer 3: make sensitive files traceable

Access controls end at the moment someone has a copy. Visible watermarks (a name across the page) help, but can be cropped or covered; see visible vs invisible watermarks.

With an invisible forensic watermark, each recipient gets a copy of the file with a different pattern written into it. If the file later shows up where it shouldn't, you upload it to Detect and Markedfile tells you which copy it matches. A screenshot of an image can match when enough of the mark survives. A screenshot of a PDF is best effort and is not guaranteed. The recipient list stays on your side.

This works for images and PDFs. It doesn't cover video, audio or plain text someone retyped.

How to set it up in an afternoon

1. List the 3 to 5 files or folders that would hurt most if they leaked, for example the investor deck, a draft contract, the price list or the next campaign.
2. Create one marked copy per recipient in Markedfile, with a recipient code you'll recognize later, and keep that list private.
3. Send each person their own copy through your normal channel.
4. Tell the team that copies are traceable. Many teams find that knowing this is the main deterrent.
5. If something leaks, upload what you found to Detect and read the result.

Files are processed in memory and are not stored. The Free plan covers 5 active files, detection for 6 months, and PDFs up to 10 pages. Pro ($9.99/month) allows PDFs up to 50 pages, Unlimited ($19.99/month) up to 100 pages, and the Enterprise plan ($49.99/month, one shared workspace for the whole team) up to 500 pages. If you want to mark files from your own tools or workflows, the Enterprise plan includes POST /api/v1/mark and POST /api/v1/detect; see the docs. For how a PDF is traced, see how to trace a leaked PDF to the recipient, and for decks, the board and investor deck page.

What to do after a match

A match tells you which copy a file came from. It doesn't prove who shared it: the recipient may have forwarded it on purpose, a colleague may have had access, or an account may have been compromised.

• Start with a calm conversation with the person who received that copy.
• Check what leaked and how far it spread.
• Decide what changes: fewer recipients, sensitive parts sent separately, shorter-lived links.
• Don't accuse anyone based only on a match.

Where this approach has limits

• It doesn't prevent leaks. It only makes them traceable, and only for copies marked before they were sent.
• Detection is never guaranteed. Heavy editing, strong compression, retyping text or a very small crop can destroy a mark. Images smaller than 96×96 pixels are not accepted. Older patterns are not detected, so those files have to be marked again. For images, a crop of about 256 px of a detailed photo or diagram is the approximate minimum, not a ceiling. A heavily compressed or heavily textured copy can still miss.
• PDF screenshots: upload the PDF file when you have it. A screenshot or photo of a page is best effort and is not guaranteed while that detection is being improved. A crop of only a barcode or QR code is not detected. Files marked with an older pattern need to be marked again.
• Retyped or paraphrased text isn't traced.
• It identifies a copy, not a person. Treat it as a lead.
• It doesn't replace compliance tools. If you must meet specific regulatory requirements for customer data, you may still need proper DLP or other controls.

FAQ

Do small teams need DLP at all? Not necessarily the enterprise kind. Sharing less, using real permissions and two-factor authentication prevent most accidental exposure.

What is the cheapest way to start? Layer 1 and layer 2 cost nothing. For layer 3, Markedfile has a Free plan with 5 active files.

Does an invisible watermark stop someone from leaking a file? No. It makes the copy traceable.

Does it work on screenshots? For an image, often, when enough of the mark survives, and never guaranteed. For a PDF, a screenshot is best effort while that detection is being improved. Upload the PDF when you can.

Can I mark files I already sent? No. Only copies marked before sending can be traced. Mark the current version and send it again if it matters.

Try Markedfile for your team · Read the API docs