Protecting PDFs with Safeguard PDF security: Encrypt & add DRM controls
Safeguard PDF Protection – protect PDF files from unauthorized use and misuse
Providing superior PDF protection to Adobe Acrobat password security (Adobe Acrobat Permissions can be easily removed), our DRM controls persistently protect PDF files and enable you to revoke PDFs at any time regardless of where they are located.
How to stop PDF sharing
Safeguard PDF Security and Enterprise PDF DRM provide PDF protection by using encryption, DRM, and licensing controls. These document controls stop PDF sharing and printing, protect against copying, prevent editing, and enable secure distribution of your PDF files.
Safeguard’s PDF protection provides many security features and in-built restrictions to protect PDF files. Most of the basic protection features are applied by default (stop PDF copying, editing, screenshots, etc.) where others you can change to suit your requirements (allow or stop PDF printing, enforce expiry, etc.). All of these security restrictions enable you to stop PDF files from being shared with unauthorized users, and control how they are used and how long they are used by authorized users. A list of these PDF restrictions are provided below.
Safeguard does not use passwords to protect PDF files since they can be easily shared or removed. Instead PDF files are protected using individual encryption keys that are securely and transparently relayed to authorized devices from a web server and stored encrypted in a keystore on the local device. The keystore is locked to individual devices so it cannot be copied and moved elsewhere.
Safeguard’s secure PDF Viewer is required to open protected PDF files. This can either be installed on a device (Windows, Mac, iOS, Android), run from a USB stick (completely offline zero installation solution), or accessed via a web browser (zero installation). When a user opens a protected PDF document the Viewer checks to see if the decryption key is available. If it is not present then the Viewer checks with the administration server to see if the user is authorized to view the protected PDF. If they are, the decryption key is transparently relayed to the client and the protected document opens. DRM controls are enforced by the Viewer software.
Stop PDF Printing
Safeguard stops printing of PDF documents by default so you do not have to apply any additional controls to stop a PDF being printed. As well as using Safeguard to stop PDF printing for specific (or all) documents, you can stop printing on a user basis – you can stop PDF printing for some users but allow printing for others using the same protected document (you only have to protect the document once for all users rather than on an individual basis). Documents can be protected with zero prints available (to stop PDF being printed) and then individual users can be granted print rights by altering the number of prints available.
If you allow printing, you can limit the number of prints each user can make in order to stop users distributing high quality copies of documents to others. You can also enforce black & white or grayscale printing of color documents. Document watermarking is recommended if you allow printing to discourage photocopies being made – see PDF watermarking below.
Safeguard’s PDF protection stops PDF print to file so that if printing is allowed, users cannot print to PDF files, XPS, or any other file format.
Stop PDF Copying / Protect PDF against copying & distribution
How can you stop PDF copying since anyone can easily copy a digital file?
The important issue is not whether you can stop a PDF being copied but whether the recipient of the copied file can use it. If you encrypt a PDF with a password you can give a copy of the PDF to another user along with the password and they can use the file. So the protection provided is worthless as a useful copy was made that could be used with others. Safeguard effectively stops PDF copying because a copy of the protected file is of no use to another user without the decryption key to open it. Decryption keys are stored encrypted in a keystore which is locked to the device it was registered on – so only authorized users can open protected PDF files.
Authorized users must be prevented from saving the PDF in unprotected format (so no editing or saving options should be made available) and unprotected files should never be stored on disk in temporary files where they could be easily recovered. For additional security the PDF Reader should prevent screen grabbing, and document owners should disable printing so photocopies cannot be made of printed documents.
So to stop a PDF being copied / protect PDF from copying you have to encrypt PDF files to stop unauthorized access, use licensing controls to lock documents to devices, and DRM controls to control document usage so documents cannot be easily shared.
To protect PDF files from content copying see the section entitled “Protect PDF against content & text copying”.
Preventing Saving PDF / Save As
Unlike Adobe Acrobat Reader, Safeguard’s PDF protection has no Save or Save As functionality in our secure PDF Viewer software. The only documents that can be copied are protected PDF files and they are useless to unauthorized recipients as they need the correct decryption keys to open them.
Because Save As options are not made available, Safeguard’s Secure PDF Viewers automatically stop PDF converting to Word and other file formats. Protected PDF files (PDC files) cannot be converted to Word using external applications as the files are encrypted and can only be processed by Safeguard Secure PDF Viewers.
Stop PDF Download
Stopping PDFs being downloaded is very similar to the stop PDF copying principle. People think that if you allow users to view protected PDF documents online then they are more secure because they cannot be manipulated on a device outside of the ‘secure environment’. You might want to think again. The way every browser works is by caching information to disk. And browser environments are possibly the least secure of all because if no software is installed on a device then you have no control over the actual environment (so stopping screen grabbing and printing to file drivers is not possible). See Secure Downloads for additional information on stopping downloads and copying.
Basically if you encrypt a PDF file and the user does not have the decryption key to use it then it does not matter if they can download it. They won’t be able to open it anyway. And if you apply DRM and licensing controls then authorized users (those given access) will be restricted as to what they can do with downloadable PDF files (for example not being able to share them with others). So the ability to download a PDF file does not make it any less secure – in fact, many online PDF Viewers that ‘prevent downloads’ are less secure since they decrypt PDF files on the server and deliver (download) them to the client in unprotected form.
With Safeguard’s Secure PDF Web Viewer protected PDF files are viewed in a browser environment. The Web Viewer downloads chunks of data into memory so there is no caching to disk in unprotected form.
Stop PDF from being Forwarded / Emailed
You cannot stop PDF files from being forwarded or emailed to others, but you can stop the recipients from using those files – see ‘Stop PDF Copying’ above. A Safeguard protected PDF file can be forwarded and emailed to another user but the recipient will not be able to view it unless the document owner has authorized them to use it.
If you are the document publisher, you can email protected PDF files to users knowing that if they fall into the wrong hands they cannot be opened. So if a protected PDF is accidentally forwarded to the wrong person they will not be able to use it. See also stop copying, downloading and emailing.
Stop PDF Editing / Lock PDF from editing
Adobe Acrobat has ‘security’ features built-in that enable you to stop PDF editing or modifying, stop printing, and saving. To enable these features in Acrobat you have to apply a permissions password to protect the PDF. The problem however is that the password you set (no matter how long) is completely useless and is no more effective than putting a watermark on the document that says ‘Please to not edit or copy this PDF’. This is because there are numerous free and paid for PDF password remover programs on the Internet that will remove Adobe Acrobat permissions passwords in seconds.
Safeguard stops PDF editing / modifying by default. There is no option that can be enabled in our Secure PDF Viewers for users to edit PDF files or copy/paste PDF content. By not allowing editing of PDF files you stop content copying / text copying.
Protect PDF against content & text copying
In some PDF protection products, if editing is disabled you can still highlight and copy text. Safeguard stops users from copying text and other content within a document – there is no copy paste option available and text cannot be highlighted for selection so it cannot be copied and pasted into other applications.
Many PDF DRM products claim to stop screenshots but if you look closely they mainly claim to prevent Windows print screen. Unfortunately there are many free screen grabbing applications available that users can download to easily bypass this restriction.
Safeguard stops screenshots being taken by common third party applications. It uses many different methods including a screen mask that is overlaid over the protected PDF document if the mouse cursor is moved to another active application. No PDF DRM product however can stop all screenshots (and of course users can just take photographs of the screen) so it is recommended that document publishers apply dynamic watermarks as a copying deterrent. If a user’s name and email are displayed on a screen shot then they will probably be less likely to share it with others (especially uploading it to the Internet where they can be easily identified).
Safeguard enables document publishers to expire PDF files so they can no longer be used after a certain amount of time. The following options are available:
- expire documents on a fixed date
- expire documents after a number of days
- expire documents after a number of views
- expire documents after a number of prints
These options can also be used together so that you can enter say a number of days/views/prints and a fixed date and whatever occurs first causes the document to expire. You might for example want a user to be able to use your documents for a 15 day trial period but those documents will expire on a fixed date regardless if the trial period is used or not.
Expiry dates can be changed on the administration system at any time and document publishers can increase the number of views/prints available for each user.
Revoke PDF Files
Being able to revoke PDF files is an important part of any document security solution. There may be times when the wrong document was published, a user has left your company, or you think a specific document has been compromised.
Safeguard enables you to revoke PDF files instantly (the document must be set to check with the administration system each time it is opened), or you can revoke users so all documents they have access to become inaccessible. If you have created PDF files that only check with the administration system every n days then PDF revocation will only take place once a check has occurred. With Safeguard, PDF files can be revoked no matter where they reside. You can also revoke access to multiple PDF files instantly and group documents into publications to make revocation easier for common groups of documents.
No DRM system is fool-proof. Even if screenshots are prevented, users can take photographs of the screen using a camera. Similarly, if printing is allowed, users can print and scan back in printed documents.
To discourage users making copies of protected documents, you can apply dynamic PDF watermarks to viewed and/or printed content. By using dynamic variables, you only have to protect a PDF once for all users (rather than watermarking and protecting each document individually for each user in Adobe Acrobat) as user data (name, company, email, date/time, etc.) is inserted at view/print time. Safeguard’s PDF protection lets you position dynamic PDF watermarks anywhere on the page (including custom locations), and choose your own font and color. You can use different watermarks for viewed and printed documents and both text and image watermarks are supported. PDF watermarks can be displayed behind content (so they are less obtrusive to the user) and you can choose not to display watermarks on the first page of a document if you have a cover image that you want to leave unmarked.
Lock PDFs to country locations, domains and IP addresses
In addition to Safeguard’s PDF protection of locking PDFs to devices so they cannot be used on other unauthorized devices, you can also lock PDFs to specific countries, a domain or an IP address range.
This is done at the user level or a global level (for all users). In this way you can easily restrict all users to viewing protected PDF files from say your office location in the US. This is particularly useful if users have laptops which they are allowed to take home – locked PDF files can then only be viewed at the office and not when the user is at home or at other locations where they could be shown to others.
Log PDF usage
Safeguard Enterprise PDF DRM lets you log PDF usage so you can see when users have viewed and/or printed your PDF files.
This is useful if you want to check whether a particular user has viewed a document yet especially if they claim to have not received it. Logging PDF files requires users to be connected to the Internet since a record has to be stored on a cloud server when a PDF file is viewed/printed. You may therefore only want to log PDF usage for specific documents otherwise users will have to be constantly online.
Secure PDF Hosting & Secure PDF Distribution
Locklizard provides secure PDF hosting with Web Publisher (protected PDF files are stored on a cloud server either hosted by Locklizard or yourselves) or you can distribute PDF files securely as you would any other file.
Many providers offering secure PDF hosting are not as secure as you may think. Most cloud-based PDF DRM systems for example offer ‘secure PDF hosting’ but protect your PDF documents online. Your unprotected PDF files are uploaded to a server where they are stored, encrypted and DRM controls applied, before being stored again in protected format. This may be fine for ebooks but what about sensitive and confidential company documents? Do you really want them sitting on a server in unprotected format for any length of time? Safeguard’s PDF protection cloud-based PDF DRM system generates secure PDF files locally (encryption and DRM controls applied) and then uploads them to a cloud server so they can be viewed by users in a browser. Your PDF files can never be compromised by server vulnerabilities as they are encrypted locally, uploaded via SSL, and stored encrypted on the server.
If you prefer to host secure PDF files yourself then you can distribute them just like any other file (email, USB, web site download, etc.). Safeguard generates PDC files (secure PDF format) that can only be opened with our secure PDF Viewers. It does not matter who has access to your secure PDF files because they are encrypted and can only be viewed by authorized users. So you can make them freely available via a web site for download without worrying about password access controls.
For completely offline secure PDF distribution you can protect PDF files to USB sticks using Safeguard PDF Portable. This enables you to distribute our secure PDF Windows Viewer, secure PDF documents, and a keystore on USB sticks for offline viewing. Additional protected PDF documents and decryption keys can be added at a later date by authorized users when they become available without the USB stick having to be returned to you.
The administration system (where you create users and authorized document usage) can be hosted by Locklizard or on your own servers. This is separate from protecting PDF files (locally on your computer) so you have greater control over secure PDF distribution of your documents and who has access to them.
Batch PDF Protect with command line
Safeguard enables you to batch protect PDF files using a command line tool. By using this PDF security tool multiple administrators can protect PDFs in a consistent manner, apply PDF protection quickly and simply to multiple folders, and schedule PDF protection based on certain events or a date/time. Using command line, administrators don’t have to learn what DRM security controls to apply – they just run a batch file.
Safeguard also enables you to automate administrative functions (adding users, assigning document access) using our ecommerce API. This enables companies to delegate admin controls by creating simple interfaces where specific functions are made available, or for automating user creation and document access after a purchase has been made online (e.g. a protected PDF ebook).
Download PDF protection software
Download PDF protection software that uses US Government strength encryption and digital rights management controls to copy protect PDF files without using insecure passwords or plugins.
Protect PDF files against copying, printing, editing, and unauthorized distribution. Lock PDF files to individual devices and locations so they cannot be shared.
Download a protected PDF sample document to preview Safeguard’s PDF protection and see our Secure PDF Viewer in action.