# PDF Security Checklist for Sensitive Files — free download from DollarWise (dollarwise.xyz)

The checks are grouped by stage because most leaks happen at handoffs: creation (real redaction, not paint-over), sharing (links, passwords, expiry), storage (encryption, access), and disposal (deletion that actually deletes). Work through them before a file leaves your hands, not after.

BEFORE SHARING (1-7)
Redact with a real redaction tool — never cover text with black boxes or images.
After redacting, search the PDF for the hidden terms to confirm they are gone.
Remove metadata: author, title, and hidden revision history can leak names and dates.
Check every page, including headers, footers, and scanned-image layers.
Confirm the file contains only the pages the recipient needs.
Flatten form fields so filled values cannot be edited or reset.
Verify the file opens correctly after redaction — broken files invite re-sends of the original.
SHARING (8-13)
Password-protect with a strong, unique password — never the company name or “123456”.
Send the password through a different channel than the file.
Share via a link that expires, not an open attachment in an email.
Confirm the recipient's address before sending — autocomplete causes more leaks than hackers.
Set view-only access where editing is not needed.
Note what was shared, with whom, and when, in one place.
STORAGE AND DISPOSAL (14-20)
Store sensitive PDFs in an encrypted folder or drive, not on the desktop.
Limit access to named people, not “everyone with the link.”
Review access lists quarterly and remove people who no longer need access.
Back up encrypted copies; an unencrypted backup defeats the whole system.
Delete local copies after the work is done, including downloads and temp files.
Empty the trash after deleting — files in trash are still files.
When a device leaves service, wipe its storage rather than just deleting files.

Free to use, share, and adapt. More free resources at dollarwise.xyz.