Send a PDF stamped with each viewer's email.

Per-viewer watermarking overlays each viewer's own identity — their email address and a timestamp — onto every page of a document at the moment they open it. Instead of one identical file passed around, you share a single link, and the page each person sees is rendered with their email and the time they viewed it. That is what makes a leak attributable instead of anonymous: the copy itself names who it was issued to and when.

This is the opposite of a static watermark — a faded “CONFIDENTIAL” baked into a PDF once. A static stamp is the same text for everyone, so when a slide surfaces on a competitor's desk you know it leaked but not from whom, and free tools strip a PDF-layer stamp in seconds. A per-viewer dynamic watermark is generated in real time, unique per viewer, rendered on every page, and tied to your access log. On Peony, the watermark is composited server-side into every rendered frame before it reaches the browser — the original file never leaves Peony's servers, so a viewer can never strip what their browser never received.

The two effects, in order of value: first deterrence — a reader who sees their own email on every page is far less likely to forward, screenshot, or print for someone else; then attribution — if a page does escape, you read the email off the leaked image and match it to a session. Dynamic per-viewer watermarking is a Peony Data Room capability at $52/admin/month ($75 monthly). Business at $30/admin/month adds Simple NDA gating, screenshot protection, and AI document Q&A — but not watermarks — and even the free tier covers page-by-page analytics and password protection. Peony serves 6,800+ customers across fundraising, M&A, private funds, commercial real estate, and professional services.

A static “CONFIDENTIAL” stamp fails at the exact moment you need it, for three structural reasons. It is the same text for everyone — “Company Confidential” tells a lawyer nothing about which of forty investors forwarded a deck. It gives you no attribution — if the file surfaces on a competitor's desk you know it leaked, but not from whom. And it is easy to remove — most static watermarks are a layer in the PDF that free tools like QPDF strip in seconds, and cropping a screenshot often removes a corner-placed stamp entirely.

Making per-recipient copies by hand does not fix this either: it stops scaling past about three recipients, and one mislabeled export undoes the whole exercise. Per-viewer dynamic watermarking solves all three problems at once — the overlay is unique per viewer, it carries the leaking viewer's email for attribution, and because it is baked into the rendered frame there is no layer to strip. That is why teams sharing anything sensitive externally treat static stamps as theater and per-viewer watermarks as the real accountability layer. For the head-to-head on how the major tools render watermarks, see the dynamic watermarking guide.

On every page: the viewer's verified email address and a UTC timestamp to the second. That is the default payload, and it is the minimum that makes a leak attributable. You can add a document or deal identifier, optionally the viewer's IP address if your counsel wants stronger forensic detail, and an optional confidentiality line such as “Confidential — Do Not Distribute.” On Peony Data Room ($52/admin/month) the payload is configurable per room and per document.

Placement matters as much as content. The overlay renders diagonally at roughly 30-60% opacity — dark enough to read, light enough not to obscure the underlying page during honest review — and it repeats across the page and appears on every page, not just the cover. Diagonal, repeated placement is what lets the watermark survive a crop or a partial screenshot: there is no clean corner to cut off. Because the email is pulled from the identity-bound link, the identity on the page is the identity that actually opened it.

Here is the attribution effect in practice. A founder shares a deck with a pool of investors, and weeks later a near-identical slide surfaces in a portfolio company's deck — same chart, same competitive matrix, slightly different colors. Because per-viewer watermarks were on, the leaked image carries the forwarding investor's email rendered diagonally across the slide. The founder reads the email, filters the access log by it, finds the session whose timestamp matches the watermark, and now has the chain of custody: who opened the deck, when, from what IP, and which pages they viewed. They revoke that viewer's access to the rest of the room in one click, present the watermark plus the log to the fund's general partner, and get a remediation — no litigation required.

If the first version had gone out without watermarks, the move is to turn them on for the redistribution: rewatermark a tightened version, send it to the cleared list only, and treat any second leak as the test — the watermark then names the leaker exactly. The full 5-phase recovery sequence — contain, identify, rewatermark, redistribute, prevent — is in how to recover from a leaked pitch deck, and the founder-side proactive setup is in how to watermark a pitch deck with each investor's email.