Written for Mexico. This analysis applies to Mexican federal tax law — ISR (income tax), IVA (VAT) and SAT rules — and cites Mexican statutes. Amounts are in Mexican pesos (MXN).
Every company shares, every week, documents that shouldn't circulate: contracts under negotiation, financial statements, payrolls, proposals, interpretations, information for due diligence. And it almost always does so in the worst possible way — a "clean" PDF attached to an email, which on a single forward reaches someone who should never have seen it. There is no button to un-send, but there is an orderly way to share that genuinely reduces the risk. It's three layers, and each one covers what the others don't.
The problem: you hit send and lose control
It's worth saying plainly: the moment a document leaves your computer, the copy stops being yours. Whoever receives it can save it, print it, forward it or upload it wherever they like. No tool changes that underlying reality; what changes is how costly misuse becomes and how traceable it is when it happens. That's where the three layers work: they don't promise a document that's "bulletproof" — that doesn't exist — but one people think twice before circulating, and one that leaves a trail if they do.
Layer 1 — A watermark with the recipient's name
The first layer is the cheapest and the one with the most effect per peso spent: printing the name of whoever receives it across every page, "for the exclusive use of [name]". It deters, because the recipient knows their name travels with the file; and it makes the document traceable, because if you deliver a different copy to each person and one turns up leaked, the printed name reveals which delivery it came from. You can add it in a minute, free and without uploading the file to any server, with our PDF watermark tool; the step-by-step is in how to watermark a PDF with the name of whoever receives it. It's deterrence and traceability — not encryption — and that's why it's the first layer, not the only one.
Layer 2 — Read-only delivery, no download
The second layer attacks the other flank: how the document arrives. Instead of attaching it to an email — where a downloadable copy stays forever — you share it in read-only mode, with download, printing and copying disabled, through a private link sent to a specific email address and, preferably, with an expiration date. That way the document can be consulted, but not "owned"; and if you revoke access, you stop feeding new copies. Services like the cloud storage you already use allow this configuration. The golden rule: the link travels privately and is never posted on a public page — a "secret" but open link gets forwarded and indexed just like any other.
Layer 3 — The confidentiality agreement, which gives it teeth
The first two layers are technical; this one is what provides consequences. A confidentiality agreement (or the equivalent clause inside a contract) defines what information is confidential, what it may be used for, for how long, and what happens if it's breached. It doesn't physically prevent a leak — no signed page does — but it turns misuse into a breach with legal effects, and that prospect is, by far, the greatest deterrent of all. The watermark and the name on every page, moreover, make that agreement enforceable in practice: it's far easier to press a claim when the leaked copy states who it had been delivered to. The layers reinforce each other: the pixels deter and trace, the signed paper penalizes.
The case of sensitive tax documents
Where this stops being theory is with high-value tax and financial information: financial statements, a tax dossier, materiality files, or the interpretations through which a firm shares its technical reading. That's how we circulate ours at Strategium: each interpretation reaches its recipient marked with their name, in a read-only version and by a private channel, as a confidential input for making a decision. An honest note to close the topic: none of these layers protects you from a legal request. Tax secrecy requires the authority to keep your information confidential (art. 69 CFF, the federal tax code), but it doesn't stop the SAT (Mexico's tax administration), in the exercise of its audit powers, from requiring documents from you — and there the watermark is irrelevant. These measures manage circulation between private parties; before the authority, what protects you is that the document is well made, not that it's hidden.
Frequently asked questions
Does stamping 'CONFIDENTIAL' on the document do anything?
Little on its own: a generic stamp gets ignored because it holds no one accountable. The version that does work is a watermark with the recipient's name on every page: it deters, because it puts whoever receives it on the hook, and it lets you trace the origin of a leak. It's the same label, with teeth.
Is a password-protected PDF enough?
It helps little in this scenario: the open password is shared alongside the file — or is easily removed — and, once opened, it doesn't stop the document from being forwarded. It protects against someone who intercepts the file, not against someone who already has legitimate access and decides to circulate it. That's why it's better to combine layers than to trust a single one.
What is a confidentiality agreement and when do I need one?
It's an agreement — standalone or as a clause within a contract — that defines what information is confidential, what it may be used for, and what the consequences of a breach are. You need it whenever you share sensitive business information with third parties: suppliers, potential partners, advisors, counterparties in a due-diligence process. It doesn't prevent the leak, but it turns it into a sanctionable breach, which is the strongest deterrent.
And what if the authority asks me for the document?
No watermark or read-only delivery protects you from an official request. Tax secrecy (art. 69 CFF) requires the SAT to keep your information confidential from third parties, but it doesn't stop it from requiring documents from you in the exercise of its audit powers. These measures manage circulation between private parties; before the authority, what protects you is that the document is properly supported.
Want to organize how your confidential information circulates?
Watermarks, read-only deliveries, confidentiality agreements and the judgment of which document is shared, with whom and how. At Strategium we apply it every day with interpretations, files and due diligence. One session and you walk out with the protocol built for your operation.