BASALT · JOURNAL
What to strip from a PDF before you email it outside the firm
The document is finished, the black boxes are in place, and it is about to leave the building as an attachment. This is the checklist for how to remove sensitive information from PDF before sending files to a client, an opposing party, or a regulator. It covers the carriers that survive a normal export and that nobody looks at, in the order they are cheapest to check.
The document information dictionary
Every PDF can carry a trailer dictionary with /Author, /Title, /Subject, /Keywords, /Creator, and /Producer. When Office writes a PDF through Save As or Export, /Author is populated from the Office installation's user name, /Creator names the application, and the company name from the Office license frequently ends up in the XMP packet alongside it.
So a brief exported on a paralegal's machine goes out naming the paralegal, and a document built from a template made for another client can carry that client's name in /Title, because the title comes from the document property rather than the file name. Read it before you send:
exiftool -a -u -g1 outbound.pdfLook at every field, not just author. /Producer reveals your toolchain, which is informative in a dispute about how a file was made. The removal side is in removing PDF metadata on a Mac.
The XMP packet and the original file path
XMP is an XML metadata block embedded in the file, a superset of the information dictionary rather than a copy of it. It commonly holds a document identifier, an instance identifier, and a history array recording derivation from earlier files.
The identifier links this file to its ancestors, which is enough for a receiving party to establish that two documents produced in different formats share a source, or that a produced exhibit descends from a draft you did not produce.
The full path of the source document can also survive, depending on how the PDF was generated. A path like /Users/jdoe/Matters/Acme/DRAFT_position_v7.pdf discloses the matter name, the internal draft count, and your own assessment, without a word of the text being read.
Comments, annotations, and tracked-change residue
Annotations are objects attached to a page and carry text in more than one place. The /Contents string holds the comment body, /T holds the author's name, and markup annotations carry an appearance stream that draws the same text onto the page.
Exporting from Word with markup displayed converts comment balloons into annotations or into plain text drawn on the page, and both survive. Accepting all changes in the source removes the revision history but does not always remove comments, and a document that went through several rounds can hold review notes that read as candid internal assessment. Deleting an annotation in a viewer removes it from the current revision, not from the file, if the viewer saves by appending.
Form field values and hidden layers
Values entered into a form live in AcroForm field dictionaries, in /V for the value and /DV for the default, not in the page content. A widget covered by a black rectangle keeps its value, and a form filled with test data during template development keeps that too.
Flattening draws those values into the page content and removes the interactive widgets, which is a presentation change: strings in a dictionary become text on the page. Flattening is not a cleaning step.
Optional content groups let a producer assign content to a layer that can be switched off. Draft stamps and internal-only annotations use this, and content in a group that is off renders nowhere and extracts normally. More in hidden layers in PDFs.
Embedded attachments
A PDF can carry whole files inside it as embedded file streams, intentionally with data appendices and unintentionally when a source document contained a linked or embedded object.
pdfdetach -list outbound.pdfAn embedded spreadsheet inside a produced PDF discloses the underlying data with no page for anyone to review. This is the check with the worst downside and the lowest cost.
Prior generations from incremental saves
PDF supports incremental updates. A revision is appended to the end of the file with its own cross-reference section, and the earlier bytes stay where they were, so a viewer shows the newest revision while the file still contains the version before your edits. If a redaction, a comment deletion, or a metadata edit was saved that way, the pre-edit state is physically present in what you are about to attach.
grep -c "%%EOF" outbound.pdfMore than one means more than one revision exists. Signatures legitimately append, but an outbound redacted document should be a single generation. Extracting and reading earlier revisions is covered in how to check whether a PDF was really redacted.
The file name
The file name is metadata you send in the clear. It appears in the recipient's mail client before the document is opened and gets indexed by their document system, and Acme_settlement_do_not_produce_v9_FINAL_PL_comments.pdf tells a story. Rename outbound files to describe the content neutrally rather than its history.
A checklist to remove sensitive information from PDF before sending
Run these on the final file, not the draft. Extract the text with pdftotext -layout and again with -raw, since the two reconstruct reading order differently, and search both for the terms that were supposed to be gone. Then decompress the object structure and grep it:
qpdf --qdf --object-streams=disable outbound.pdf expanded.pdf
grep -a -i "acme" expanded.pdfRead the metadata with exiftool -a -u -g1, list attachments with pdfdetach -list, count %%EOF markers, and if anything visual was redacted extract the images with pdfimages -all to confirm the pixels are gone rather than covered. Then rename the file, and only then attach it. For filings there are additional items in the checklist before filing, and a walkthrough of reading structure is in how to inspect what is inside a PDF.
Frequently asked questions
How do I remove sensitive information from a PDF before sending it?
Strip the document information dictionary and XMP packet, remove annotations and their author fields, clear form field values, delete embedded attachments, remove hidden optional content, and write the result as a single generation. Then verify with exiftool, pdfdetach -list, a pdftotext extraction, and a grep over a qpdf --qdf expansion before attaching anything.
Does Save As PDF from Word remove my name from the file?
No, it usually adds it. Office populates the PDF author field from the user name configured in the Office installation and the creator field from the application, and the licensed company name often appears in the XMP packet. A document exported by one person on behalf of a team goes out naming that person unless the metadata is stripped afterward.
Do comments and tracked changes survive a PDF export?
They can, in two ways. Comments can become PDF annotations that keep their body text in /Contents and the reviewer name in /T, and if markup was displayed at export time the balloons can be drawn onto the page as ordinary text. Accepting changes in the source removes the revision history but does not reliably remove comments.
How do I check if a PDF has embedded files?
Run pdfdetach -list file.pdf from Terminal after installing Poppler. It lists every embedded file stream in the document, which is where a spreadsheet, a source document, or a linked object ends up when a PDF is produced from a file that contained one. An embedded attachment discloses the underlying data with no page for anyone to review.
Is flattening a PDF enough to make it safe to send?
No. Flattening draws form field values and annotation appearances into the page content and removes the interactive objects, which changes where the information lives rather than removing it. Metadata, embedded attachments, hidden layers, and earlier revisions in the file are untouched by flattening.
What does more than one %%EOF marker mean in a PDF?
It means the file contains multiple revisions saved as incremental updates, with the earlier bytes still present. Viewers show only the newest revision, so a document can look edited while containing the state before the edit. Signing legitimately appends a revision, but a redacted outbound file should be written as a single generation.
Can the recipient see the original file path of my document?
Sometimes, yes. Depending on how the PDF was produced, the full path of the source file can be recorded in the metadata, which discloses your folder structure, the matter name, and often a draft version count. Check for path-like strings in the exiftool output and in a decompressed copy of the file before sending.
Should I rename a PDF before emailing it?
Yes. The file name is visible in the recipient's mail client before the document is opened and gets indexed by their systems, and names carrying internal status, version counts, or candid shorthand disclose more than most people intend. Rename outbound files to describe the content rather than its history.
Doing it in Basalt
Basalt has an Inspector that reports what a document still carries before you send it: metadata, XMP, embedded files, hidden layers, annotations, OCR layers, JavaScript, and saved generations. Applying a redaction strips metadata, XMP, attachments, hidden layers, and stale thumbnails in the same operation and writes the result as one generation to a new file, so there is no earlier revision to recover and no separate cleanup pass to forget. The original is never modified, and a verifier re-opens the written bytes with an independent parser to prove the content is gone before anything is saved. The engine has no network entitlement, enforced by macOS at the code signature level, so nothing is uploaded. It is $29 once, lifetime, up to three Macs, free for 24 hours.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.