What your PDF is quietly carrying

The visible pages of a PDF are the part everyone reviews. The rest of the file is what causes surprises: a draft author's name on a tender response, an internal file path in the title field, or a comment thread that was never supposed to leave the building.

Document properties

Every PDF has a metadata dictionary, and most producing applications fill it in automatically:

• Author — often the operating system account name of whoever exported it.
• Title and subject — frequently the source filename, including internal project codenames or full directory paths.
• Creator and producer — the applications and versions used, which is a small but real fingerprint of your environment.
• Creation and modification timestamps — including time zone, which hints at where and when the document was produced.
• Keywords and custom fields — template systems sometimes leave workflow identifiers behind here.

None of this is hidden in any meaningful sense. Any reader can show document properties in a couple of clicks.

Content that does not appear on screen

Beyond properties, several page-level structures carry information that a visual review will not catch:

Structure	Why it matters
Invisible recognition text	A searchable scan stores a text layer over the image; it is copyable even though nothing appears to be selectable
Annotations and comments	Review notes, sticky comments, and highlight text remain attached to pages
Form field values	Filled values persist in the field objects even after a visual "clear"
Embedded attachments	Spreadsheets and source files can be attached inside the PDF
Bookmarks and destinations	Outline titles can describe sections that were later removed
Links	Outbound URLs may contain tracking parameters or internal hostnames
Earlier revisions	Incremental saves can retain content from before an edit

Audit before you share

Reviewing all of this manually is tedious, which is why it rarely happens. The privacy risk scanner enumerates metadata, invisible text, attachments, links, forms, scripts, layers, signature state, and revision risk for a specific file so the review takes a minute instead of an afternoon.

Treat the audit as routine. A habit applied to every external release catches the documents you would not have flagged as sensitive, which is precisely where accidental disclosure happens.

Clearing what you find

Different findings need different treatment:

• Metadata fields should be cleared or replaced with a neutral value. Replacing "J. Smith, Legal" with an organisation name is usually better than leaving the field blank, because empty fields draw attention.
• Annotations and form values are removed by flattening the document, which converts interactive content into static page content.
• Values printed on the page need genuine redaction; clearing metadata does nothing about text that is visibly on the page.
• Attachments must be removed explicitly. They do not disappear when the page that references them is deleted.

Confirm the file you are sending

Once the file is cleaned, confirm that the copy leaving your hands is the copy you cleaned. Version confusion is a mundane but frequent failure: the cleaned document sits in a downloads folder while the original is still attached to a draft email.

A content hash makes this unambiguous. Take the fingerprint of the file you intend to send, record it alongside the release, and compare it later if anyone questions which version was distributed. It costs seconds and settles arguments that would otherwise be unanswerable.

A pre-release checklist

• Open document properties and review author, title, subject, and keywords.
• Scan for invisible text, annotations, attachments, scripts, and links.
• Flatten interactive content when the recipient does not need to fill it in.
• Redact any sensitive values that are visible on the page.
• Record a fingerprint of the exact file you are releasing.