Board and investor information rarely stays in one place. A pack may begin in an internal reporting system, move into a board portal, be exported as a PDF, reach external advisers and return with annotations. An investor update may be viewed online and then saved or screenshotted.
Security controls often protect each system separately. Traceability needs to follow the information across the whole workflow.
Map the distribution routes
List the ways sensitive governance material is actually used—not only the official process. Include:
- Authenticated board or investor portals.
- PDF packs sent directly to named recipients.
- Data-room access for transactions or fundraising.
- Images and charts shared for review.
- Downloads placed into internal document systems.
- Assistants and advisers acting for directors or investors.
This map reveals where identity is lost. A strong portal login does not remain attached to a screenshot, and an exported PDF may become indistinguishable from every other recipient's copy.
Protect authenticated views
Install the ExactMark SDK on sensitive signed-in pages. Give each account a stable opaque viewer reference and have the authenticated backend issue the matching short-lived signed token; unsigned sessions cannot be used for attribution.
Web Sessions then provide candidate identities when a screenshot from the portal is submitted to Evidence Lab. The SDK is designed not to capture the private page content itself.
Protect exported material by recipient
When a board pack, update, chart or supporting image must leave the application, use ExactMark Imprint to create a separate copy for each intended recipient.
Individual distribution is clearer than one attachment sent to a board-wide list. Where assistants or central governance teams legitimately manage files for others, record the real custody model rather than creating a misleading impression of direct personal control.
Include late additions and replacements
Board and transaction distributions change. A new adviser joins, a director requests an updated pack or a corrected forecast replaces the first version. Generate a new copy for the actual recipient and version rather than forwarding an existing marked output.
Keep a simple distribution record linking the meeting, version, recipient and delivery route. ExactMark provides source attribution, while your governance record explains why the person had the material.
Test before the sensitive event
Do not wait for results day or transaction signing to discover that a content security policy blocked the SDK or a PDF design performs poorly at the chosen signal strength.
Use representative content and controlled accounts to test:
- Web Session detection in the portal.
- A normal screenshot and a cropped or recompressed version.
- Imprint generation for the final PDF design.
- A file passed through the real email or data-room workflow.
- Evidence recovery against the intended source scope.
Record what “good” looks like so an incident team can recognise an unusual or inconclusive result.
Investigate with governance in mind
If material surfaces, preserve the artifact, location and timing. Review ExactMark findings alongside portal logs, distribution lists, version history and authorised onward sharing.
A likely source identifies the viewing session or recipient copy most consistent with the recovered signal. It does not by itself establish who performed an action or why. Board and investor incidents may require careful involvement from legal, regulatory, security and communications advisers before anyone is approached.
Keep accountability proportional
Traceability should protect legitimate governance, not obstruct it. Directors and investors still need timely, readable information. The best controls operate quietly: secure access, accurate identities, individual copies, limited retention and a clear response process.
ExactMark connects those controls across pages, images and documents. When sensitive material has to travel, its source does not have to disappear at the boundary of the first system.