Legal, advisory and other professional-service teams routinely distribute material whose value depends on controlled access: draft opinions, investigation reports, transaction documents, client records, expert material and internal strategy.
Confidentiality notices and access controls establish expectations. They do not necessarily identify which authorised copy became the source when material appears elsewhere.
Separate prevention from attribution
Strong authentication, least-privilege access, secure delivery and staff procedures remain the first line of protection. ExactMark addresses a narrower question: if an authorised view or recipient copy surfaces later, is there a signal connecting it to its source?
This distinction keeps expectations realistic. Attribution does not prevent copying, and it should not be treated as a guarantee of misconduct.
Protect the client portal
Where material is viewed inside an authenticated portal, give each account a stable random viewer reference that only your system can map to the person. After login, your backend must issue the matching short-lived signed token before that Web Session can be used for attribution.
The SDK applies a covert signal without capturing the underlying page content. Web Sessions retain an opaque viewer reference and minimal timing and device context; names, emails, raw account IDs and page paths stay out of ExactMark.
Protect documents leaving the portal
Exports and attachments require a different workflow. ExactMark Imprint creates a distinct image or PDF for each recipient, allowing returned material to be searched against retained recipient identities.
Use individual names where appropriate, generate outputs only from the approved final version and avoid distributing one marked copy to several unrelated people. If a document must be shared with a whole organisation, decide whether the accountable recipient is an individual custodian or a controlled organisational route and document that choice.
Preserve professional judgement
A technical match cannot explain every fact around a disclosure. The intended recipient may have delegated access, used an assistant, uploaded the file into an authorised client system or suffered an account compromise. A screenshot may have passed through several transformations before it was found.
Review:
- The confidence score and alternative candidates.
- The version and content of the surfaced material.
- Portal access and document-distribution records.
- Authorised onward-sharing arrangements.
- Account, mailbox or device security events.
- The chain of custody for the evidence itself.
Do not present automated attribution as a legal conclusion. Where a finding may affect employment, litigation, professional duties or client rights, obtain appropriate independent advice and follow a documented investigation process.
Handle privileged and sensitive material deliberately
Uploading evidence to any external processor may have confidentiality, privilege, contractual and data-protection implications. Organisations should assess the service, configure access and retention appropriately, and submit only material necessary for the investigation.
The original Imprint upload is processed to create the marked output rather than kept as a permanent source archive. Marked outputs and attribution records still require governance within the ExactMark workspace and the organisation's own systems.
Make accountability quiet and routine
A useful control fits existing professional work. Recipients should not need unusual software, and document presentation should remain appropriate for clients, courts, boards or counterparties.
ExactMark makes protection part of the ordinary portal and distribution workflow. The visible experience stays familiar; the copy no longer has to be anonymous. That is a practical improvement when sensitive advice must be shared but its route still matters.