Leak-Traceable Contracts: Watermarking for Law Firms

Why legal documents leak

A draft agreement, a term sheet or a due diligence folder rarely stays with one reader. It goes to the client, the client's co-founders or board, the other side's counsel, a bank, an expert, an assistant. Each of them can forward it, paste a clause into a chat or take a photo of a screen.

When a draft turns up with a journalist, a competitor or the counterparty before it should, the firm usually has a list of everyone who received it and no way to narrow it down, because all the copies were identical.

What the usual options can and can't do

• NDAs and confidentiality clauses set expectations and give you something to point to, but they don't show which copy was shared.
• Virtual data rooms control who can open files and log access. They help while the document stays inside the room; once someone downloads a file, takes a screenshot or photographs the screen, the log stops. Visible watermarks inside a data room can also be cropped out. See visible vs invisible watermarks.
• Password-protected PDFs limit who opens a file but not what they do with it afterwards.
• File metadata disappears when a document is re-saved, printed to PDF or screenshotted.

The approach: one invisibly marked PDF per recipient

An invisible forensic watermark is a pattern written into the pages of a PDF that isn't meant to be visible at normal reading size. If each recipient gets a copy with a different pattern, each copy has its own label. If the document later appears somewhere it shouldn't, you upload what you found and Markedfile reports which copy it matches.

It doesn't stop anyone from sharing. It makes sharing traceable, and knowing that copies are individually marked tends to make people more careful. Many firms would also want to mention this in their engagement terms or in the cover note.

How to set it up

1. Finalize the document. Mark the version you're about to send, after the last edit. Changing the file afterwards means marking it again.
2. Create one marked copy per recipient. Upload the PDF to Markedfile and create a copy for each client contact, counterparty, bank or expert. Use a neutral label you'll recognize later, such as a recipient code, and keep that list private.
3. Send each recipient their own copy through your usual channel: email, secure link, messaging app.
4. If something leaks, get the version that was found: the file, or a screenshot or photo of it.
5. Upload it to Detect. Markedfile reports which recipient's copy it matches.

There's also a short page for a related case: mark a board or investor deck.

Files are processed in memory and are not stored. The Free plan covers 5 active files, detection for 6 months, and PDFs up to 10 pages. Longer documents need a paid plan: Starter ($9.99/month) allows PDFs up to 50 pages, Pro ($19.99/month) up to 100 pages, and the Business plan ($49.99/month, one shared workspace for the whole team) up to 500 pages. If your firm wants to mark documents from its own document management or workflow tools, Business and Enterprise include an API that also covers video (POST /api/v1/mark and /api/v1/detect, up to 10 min and 100 MB, MP4 download); see the docs. Because these are often sensitive files, review the plan, privacy and security details with your own compliance requirements before using any tool with client documents.

What to do after a match

A match tells you which copy a file came from. It doesn't prove who shared it: the recipient may have forwarded it on purpose, a colleague or assistant may have had access, or an inbox may have been compromised.

• Start with a measured conversation with the recipient or the client contact, showing what you found and where.
• Check what leaked. A single clause is different from a full draft with names and numbers.
• Decide what changes. For example, narrowing the distribution list, sending sensitive schedules separately, or reminding recipients that copies are individually traceable.
• Don't accuse anyone based only on a match, and don't treat it as proof on its own. If a dispute follows, ask the lawyers handling it how a result like this could or couldn't be used.

Where this approach has limits

• Only marked copies can be traced. A draft that was already sent unmarked can't be matched later. If the current version matters, mark it and send it again.
• Detection is never guaranteed. Heavy editing, strong compression, retyping the text or a very small crop can destroy a mark. Images and video frames under 96×96 px are rejected; everything else uses the same pattern. For images, a crop of roughly 256 px of a detailed area is the approximate minimum, not a ceiling.
• PDF screenshots: The PDF mark is now invisible, and PDFs marked before this change aren't compatible, so re-mark them. A screenshot can be checked if it shows roughly 200 pt of a ticket, 160 pt of a photo, 320 pt of a slide, or the top half of a text page; dense text on its own isn't detected. A PDF screenshot is best effort and is not guaranteed.
• Retyped or paraphrased text isn't traced. If someone copies the words into a new document, there is no mark to find. That is a different problem from a leaked file or screenshot.
• Page limits apply by plan, as above.
• It identifies a copy, not a person. Treat it as a lead.

FAQ

Can I stop a recipient from forwarding a contract draft? Not technically. You can make forwarding traceable.

Does the mark change how the document looks or its legal content? It's designed to be invisible at normal reading size and doesn't change the text. Compare the original and the marked copy on a screen you trust before sending, and keep your original file.

Does it work if someone prints the document and photographs it? It can in some cases, but detection from a photo of a printout is less reliable than from a file or a screenshot. Treat it as best effort.

Is a match proof I can use in a dispute? Treat it as a lead, not as proof. Ask your own counsel how to handle it if a dispute is likely.

Do I need a separate copy for every person at the client? It's the most precise option. If that's too many, use one copy per organization or per team.

What if I already sent the draft without a mark? That copy can't be traced. Mark it and send the new version if it's worth it.

Try Markedfile for your team · Read the API docs