Dynamic Watermarking

Watermarking is a deterrent control. When an investor views or downloads a document from your data room, Waafir stamps it with information that ties that copy to that specific person, so a leaked file points straight back to who had access. It does not stop a determined leak the way encryption stops an interceptor; it makes casual sharing risky and accountable, which is usually the control you need.

What the stamp actually looks like depends on the file format. PDFs and images carry a visible burn-in on every page. Word and PowerPoint files are delivered to investors as watermarked PDFs. Spreadsheets are handled differently — the trace is real, but it is explicitly a soft deterrent, for the reasons explained below.

What gets stamped

The watermark carries identifying details about the person viewing or downloading the document — the information that makes a leaked copy traceable to an individual rather than anonymous. Because it is tied to the viewer, two investors looking at the same document see two different watermarks, each pointing at them.

The watermark is applied at the moment of access. A document is not pre-stamped with one fixed mark; each view and each download carries the watermark for that viewer at that time, so the trace is specific.

How it works for each file type

PDFs and images — visible burn-in

PDFs and image files (PNG, JPEG, WebP) get a diagonal, semi-transparent watermark stamped across every page of the document. The watermark is embedded in the file content itself, not added as a viewer overlay, so it travels with any copy — including printouts. Removing it would require re-creating the file from scratch.

Two layers: cached identity + per-request dynamic

The watermark is composed of two layers that are applied separately so the in-app view feels instant while the download stays fully burned in:

• Identity layer (name, email, and any custom text your organisation configures) is stable for a given viewer and file, so Waafir burns it once and caches the result. Every later view of the same document by the same person reuses that cached rendition instead of re-stamping the file — the expensive step is paid one time, not on every open. The cache is keyed on the source file's content, so re-uploading or re-converting the document automatically produces a fresh burn (a stale identity stamp on an old page count is never served).
• Dynamic layer (the viewer's IP address and the access timestamp) changes on every request, so it is added on top per request: as a viewer overlay while reading in-app, and as a second burn-in pass on download. The downloaded file — the copy that can leave the platform — therefore always carries the IP and timestamp burned in, tamper-proof, exactly as before. The in-app overlay is only a deterrent on a screen that a screenshot could capture regardless.

Both layers are drawn from a single configured field set that is split into identity and dynamic parts, so the burn and the on-screen overlay always agree on which fields each one owns — a field is never dropped from both or stamped twice.

Word and PowerPoint — converted to watermarked PDF

When an investor downloads a Word (.docx, .doc) or PowerPoint (.pptx, .ppt) file, Waafir converts it to a PDF first, then applies the same diagonal burn-in described above. The investor receives a watermarked PDF named <original>.pdf rather than the original Office file.

This is a deliberate trade-off. A Word document with a header/footer watermark can usually be edited to remove that watermark; a PDF burn-in cannot. Most investors are previewing the document anyway — sending a PDF preserves the content and reading experience while making the trace durable. Deal-team members continue to download original Office files unless your organisation has switched on server-side watermarking for them.

Spreadsheets — a soft, removable deterrent

Spreadsheets are the one format where Waafir does not apply burn-in.

The reason is product: a spreadsheet's value to a recipient is its formulas, filters, links between cells, and editability. Converting an Excel workbook to a PDF (the way Word and PowerPoint are handled) destroys all of that — the recipient gets a static image of numbers, not a working model. For financial models and cap tables in particular, that is rarely what the operator actually wants the investor to receive.

So for spreadsheets, Waafir uses a lighter touch:

• The filename carries the recipient's identifying details — pipeline_investor@example.com_2026-05-19.xlsx.
• A worksheet named _Waafir_Watermark is added inside the workbook, containing the recipient's identity, IP address, and the download timestamp. The sheet is visible to anyone who opens the workbook, alongside the original tabs.

The sheet is added as a package part rather than by rewriting the workbook, so everything else in the file is delivered exactly as it was uploaded — charts, images, cell formatting, pivot tables, conditional formatting, data validation, macros, and any sheet or workbook protection.

This is explicitly a removable deterrent. A motivated recipient who knows to look can rename the file and delete the _Waafir_Watermark sheet. We think the right framing is: the spreadsheet watermark identifies the recipient to anyone they share the file with, and to anyone who later opens the file casually. It does not guarantee a forensic trace against a determined adversary.

If a particular spreadsheet's contents are sensitive enough that you want the harder guarantee, the right pattern is redaction or permissions — remove what shouldn't be shared, or don't share the file with that audience at all. Watermarking, for spreadsheets, is the soft layer on top of those harder controls.

Files Waafir will not modify

Some documents carry a control that the watermark itself would break. Waafir does not break it. These arrive exactly as they were uploaded, with the recipient's identity in the filename and no change to the file:

• Password-protected workbooks and PDFs. A file locked with a password Waafir does not hold cannot be opened, so it cannot be marked — and it is delivered still locked, rather than failing to download.
• Digitally signed workbooks. Adding a sheet would invalidate the signature, which reads as tampering to the recipient.
• Workbooks that forbid structural changes (Excel's "protect workbook structure"). The workbook states that sheets may not be added; Waafir honours that rather than working around it.
• Legacy .xls binaries. The older Excel format is not a package a sheet can be added to, and it is served as .xls rather than silently converted.

A permissions-restricted PDF — one that opens without a password but restricts printing or editing — is the common exception: it is watermarked normally and handed back with its restrictions intact.

When one of these files is included in a bulk download, the ZIP carries a _WAAFIR_UNWATERMARKED_FILES.txt entry naming it and saying why, so whoever ends up holding the archive can tell which copies carry a content mark and which carry only the filename one.

Files Waafir will not serve unmarked

The rule above has a hard edge: if Waafir cannot mark a file and cannot confirm it is one of the cases above, it does not hand the file over. The download fails with a clear error, and in a bulk download the file is left out of the ZIP and named in _WAAFIR_EXCLUDED_FILES.txt. An unmarked copy leaving the platform under a watermarked filename is the outcome this avoids.

That happens when a workbook cannot be read: it is corrupt, it is not really a spreadsheet, or its internal structure is far outside anything Excel produces — unreadably large, nested thousands of levels deep, or written in a text encoding Waafir cannot decode. Real workbooks do not look like this; files built to overload the service do. Refusing them quickly and by name is also what keeps one such file from affecting anyone else's downloads.

Other formats — filename only

For file types Waafir can neither burn-in nor structurally tag (zip archives, video, etc.), the filename suffix is the only watermark applied. The recipient identity travels with the file, but the file contents are unchanged.

What a recipient sees

From the recipient's side, the document is fully readable — the watermark is an overlay that deters sharing, not a redaction that hides content. They see the document with their own identifying mark on it, in both the in-browser viewer and any copy they download.

For PDFs, images, Word, and PowerPoint, no version of the document reaches an investor without a content-level mark on it — except the password-protected files described under Files Waafir will not modify, which arrive still protected and unmarked. For spreadsheets, the mark is structural rather than content-level — see the soft-deterrent framing above.

Why it works as a deterrent

People are far less likely to forward a document when their own name is visibly on every page, or when their email is in the filename of the attachment, or when a tab inside their spreadsheet records who they are. The value is behavioural: the watermark changes the decision the recipient makes before they share, and it changes what you can do afterwards if they share anyway. A leaked watermarked document is not an anonymous breach — it is evidence pointing at a specific person who had specific access.

When it matters

• Sharing sensitive materials with a wide investor list, where you cannot vet every recipient individually but want every recipient to know their copy is traceable.
• Highly confidential documents — term sheets, financials, anything whose unauthorised circulation would damage the deal.
• Any situation where accountability is the control you need, rather than preventing access outright. For that, use permissions and redaction.

How it fits with the rest of the platform

Watermarking is one layer of Waafir's document security, not the whole of it. It works alongside:

• Permissions — who can reach a document at all.
• Redaction — removing content a recipient should never see, rather than only marking who saw it.

Use them together: permissions decide who gets in, redaction decides what they can see, and watermarking makes whatever they do see traceable back to them. For spreadsheets in particular, treat watermarking as a complement to permissions and redaction, not a replacement.