PDF Privacy Scan

Scan a PDF for what it still carries — then fix it in the same place

A PDF you are about to send often knows more than the page shows: who wrote it, which company owns it, what a colleague wrote in the margin, an earlier draft still embedded inside, an invisible watermark tracking the copy. Most privacy scanners hand you a report and stop there. This one closes the loop.

Basic scanning runs locally in your browser. No upload required for standard checks.

What a privacy scan actually looks for

"Hidden data" in a PDF is not one thing. It is six different places a document can remember, and they survive saving, converting and emailing.

Metadata

Author, company and software

The document properties hold the author name, the organisation field, the creating application and full creation/modification timestamps. A contract sent to a counterparty can reveal your internal file paths and who drafted it.

Comments

Internal review notes

Annotations and comments are stored as separate objects. People routinely strip the visible text and forget the review thread — which is exactly the part that says "do we really want to commit to this clause?"

Invisible text

White-on-white and off-page content

Text rendered in the background colour, or positioned outside the visible page box, is invisible to the eye but still selectable, searchable and extractable by any parser.

Embedded files

Earlier drafts riding along

A PDF can contain attachments and previous versions as embedded objects. You send the final file; the recipient can open the version you decided against.

Watermarks

Visible and dark watermarks

Some watermarks are drawn as content-stream text objects you can remove. Others are forensic or "dark" markings — low-contrast, per-copy identifiers embedded for traceability. The scan distinguishes them.

Revisions

Deleted-but-present content

Text that was struck out or deleted during editing frequently remains in the structure underneath. Visually gone, technically still there.

Why "found" is not "fixed"

This is the part most scanners leave to you. A report that says "this file contains 14 pieces of hidden data" is useful for about ten seconds — until you need to do something about it.

Scan-only tools

You get a list. Then you open a second tool to remove metadata, a third to redact text, a fourth to add your own annotation, and a fifth to convert the file. Every hand-off is another upload, another copy left on another server, and another chance to send the wrong version.

One continuous workflow

Scan, see exactly what was found, remove it at object level, annotate what needs explaining, and export a clean file with a record of what was done. The document never leaves the workspace between steps.

Step 1

Scan

Upload or drop the file. Standard checks run in your browser; the scan reports metadata, comments, hidden objects, embedded files and watermarks.

Step 2

Remove or redact

Delete what should not travel — permanently, at object level, not by painting a black rectangle over the text.

Step 3

Annotate

Add the notes that do need to travel: review comments, approval marks, redaction reasons.

Step 4

Export verified

Export to PDF or another format, then re-parse the result to confirm the removals actually held.

How to scan a PDF before you share it

Four minutes, and it catches the things people get fired over.

Run a privacy scan

Questions people ask

Is a privacy scan the same as removing metadata?

No. Metadata is one of six places a PDF can hold information. A scan also covers comments, invisible text, embedded files, revision remnants and watermarks. Removing metadata alone leaves the other five exposed.

Does the file get uploaded?

Standard checks — metadata, comments, hidden objects, embedded files — run locally in your browser. Only features that genuinely need server-side processing (such as AI-based image watermark removal) send the file, and that is stated before you confirm.

What is a dark watermark?

A low-contrast or per-copy marking embedded for traceability rather than branding. It is often invisible on screen but recoverable from the file structure. Detecting it requires inspecting the content stream and object tree, not looking at the rendered page.

Why not just use a black box over sensitive text?

Because the text stays in the file. Anyone can select it, copy it or extract it. Proper redaction removes the underlying text object so nothing remains to recover.

Can I scan a document I received, not just one I made?

Yes, and it is worth doing. Documents received from counterparties carry their own metadata, and files that reach you through a chain often still contain earlier drafts.

What formats can I export to after cleaning?

PDF as the primary output, with conversion to Word, Excel, image and plain text where you need to hand off an editable or flattened version.

Check the file before it leaves

Scan, redact, annotate and export in one place — and verify the result instead of assuming it.

Start with a free scan