Most document leaks are not sophisticated. They are a file sent to the wrong address, a link forwarded to someone it was never meant for, an attachment sitting in an inbox three years after it mattered, or a "confidential" PDF whose black boxes hid nothing. Securing a document is less about cryptography than about matching the method to the risk and closing the ordinary gaps.
Start by deciding what this actually is
Applying maximum security to everything is how people stop applying it at all. Three rough tiers:
Public. Brochures, published reports, price lists. No protection needed. Do not create friction here — it trains recipients to find workarounds.
Internal or commercially sensitive. Contracts, proposals, financial summaries, drafts. Damaging if it reaches a competitor or the press, but not catastrophic. Access control and a bit of care is proportionate.
Regulated or personal. Medical records, identity documents, payroll, client files, anything covered by GDPR or HIPAA. Here you may have legal obligations about how the document is transmitted, where it is stored, how long it is kept, and what happens if it goes astray. The stakes are not reputational, they are statutory.
The single most useful question: if this arrived at the wrong address tomorrow, what would happen? The answer sets the tier.
Fix the document before you fix the transmission
This is the step people skip, and it is the one that matters most. Encrypting a file that leaks its own contents accomplishes nothing.
Remove what should not be there. If you have obscured information with a black box, confirm it is actually gone — select the page text and paste it into a text editor. Covering is not removing. See how to redact text in a PDF.
Strip the metadata. Author name, organisation, software, timestamps, and sometimes the original filename travel with the file. exiftool clears them, as does Acrobat's Sanitise Document.
Check for hidden content. Cropped image areas, hidden layers, embedded attachments, bookmark titles, and the invisible OCR text layer under a scan all survive into the shared copy.
Send only what is needed. Extracting the three relevant pages beats sending a sixty-page document and asking the recipient to ignore the rest. See how to extract pages from a PDF.
Flatten it. For a signed or completed document, flattening merges annotations into the page so form values and signatures cannot be quietly altered. See how to flatten a PDF.
Choosing how to send it
Password-protected attachment. Simple, universally supported, works with any recipient. Encrypt with AES-256 and — this is the part that decides whether it works — send the password by a different channel. A password pasted below the attachment protects nothing at all. Text it, call, or use a password manager's sharing link. See how to password protect a PDF.
A permissioned share link. Google Drive, OneDrive, Dropbox, Box, or Tresorit, shared with named email addresses rather than "anyone with the link". Better than an attachment for ongoing access, because you can revoke it, see who opened it, set an expiry, and avoid copies accumulating in inboxes. This is the right default for business documents.
Encrypted email. S/MIME or PGP give genuine end-to-end protection, and are worth it if you exchange sensitive documents routinely with the same parties. Setup friction is real, which is why adoption is low.
A secure portal. Many sectors — legal, healthcare, finance — have purpose-built systems with audit trails and retention controls. If your organisation has one, use it; it exists because the compliance requirement exists.
What to avoid: public "anyone with the link" sharing, which is one forward away from the open internet; consumer file-transfer services for regulated data; and uploading a confidential document to an unknown web tool in order to process it. On that last point, in-browser tools like Docento.app sidestep the question entirely by never transmitting the file — see privacy in browser PDF editing.
The mistakes that actually cause leaks
Autocomplete picking the wrong recipient. Overwhelmingly the most common cause. Two identical surnames, one wrong click. Add recipients last, after the attachment, so a premature send goes nowhere. Enable a send delay in your mail client — a thirty-second undo window catches a startling proportion of these.
Reply-all with the attachment intact. A document sent to one person ends up with fifteen.
Forwarding a thread. The attachment near the bottom goes with it, invisibly.
Cc instead of Bcc. Not a document leak but a personal-data one, and a reportable breach in some jurisdictions.
The filename. redundancy-list-final.pdf discloses the subject before anyone opens it, and filenames appear in notification previews on lock screens.
Assuming view-only prevents copying. It does not. Screenshots exist, and anything rendered on a screen can be captured. View-only is a speed bump for the honest, not a control against the motivated.
After it has gone
Keep a record of what was sent, to whom, and when. For contracts and regulated material this is not administrative tidiness — it is what you will need if a dispute or an audit arrives.
Set an expiry. If you shared by link, revoke it when the need ends. Access granted indefinitely is access someone still has in three years, long after everyone has forgotten.
Confirm receipt for anything consequential, and follow up if it does not arrive. A document that silently failed to deliver and a document that went to the wrong person look identical from your end.
Have a plan for when it goes wrong. Know who to tell and how quickly. Under GDPR, some breaches must be reported to a supervisory authority within 72 hours, and that clock starts when you become aware, not when you finish investigating. Deciding this in advance beats improvising during the incident.
Related reading: are online PDF editors safe?, hidden data in PDFs explained, and document retention policies.
