Remove hidden metadata from PDFs, Word files and images

What the risk scorecard checks

Every upload is scored 1-100 across document properties, XMP packets, EXIF camera and GPS data, revision and comment history, embedded thumbnails, hidden layers and attached objects, so you can see the disclosure risk before you send anything.

Why metadata matters in UK practice

Metadata is a routine source of accidental disclosure: a filed PDF revealing the drafting solicitor's edit history, a photograph carrying the client's home coordinates, or a template exposing another client's name in its document properties.

Under the UK GDPR, an unintended disclosure of personal data hidden inside a file is still a personal data breach, and the ICO expects reportable incidents within 72 hours. Because metadata is invisible in the document body, it survives every review a human actually performs — proofreading, partner sign-off, a final read before service — which is why stripping it has to be a mechanical step rather than a judgement call.

The pattern repeats across sectors: a tender submission that names the competitor whose bid was used as the template, an HR letter whose revision history shows the salary figure before it was changed, a press release whose author field identifies an unannounced hire.

Basic clean vs Deep Forensic Wipe

A Basic clean strips the fields most people mean by “metadata”: document properties such as author, company, title and keywords, creation and modification timestamps, the producing application, and standard EXIF tags on images including GPS coordinates.

A Deep Forensic Wipe goes further, into the places a forensic examiner looks. It removes XMP packets, embedded and generated thumbnails that can preserve an earlier version of the page, hidden layers and optional content groups, tracked revision and comment history, attached and embedded objects, and residual custom properties written by document management systems.

The visible content of the document is untouched by either mode. Text stays selectable and searchable, images keep their resolution, and page count and layout do not change — so a wiped file can go straight to a portal, a client or a court without a second look.

Where it fits in a document workflow

Scrub last. Metadata is written every time a file is edited, converted or re-saved, so run the scrubber after conversion, redaction and signing rather than before — otherwise the tool that produced your final PDF stamps its own properties back in.

Pair it with permanent redaction when the document also contains text that must be removed rather than hidden, and with password protection when the file will travel by email. Scrubbing removes what you did not mean to send; redaction removes what you did send but must withhold; encryption controls who can open the result.

Every upload is processed over TLS, kept on UK/EU infrastructure, hard-deleted within 60 minutes, and never used to train AI models — which matters here more than anywhere, because the files people scrub are by definition the sensitive ones.

Frequently asked questions

What metadata is hidden in a PDF or Word file?

Typically author and company names, creation and modification timestamps, the software used, revision and comment history, XMP packets, embedded thumbnails and — in images — EXIF camera and GPS data.

What is the difference between a Basic clean and a Deep Forensic Wipe?

A Basic clean removes standard document properties and EXIF tags. A Deep Forensic Wipe also strips XMP packets, embedded thumbnails, hidden layers, revision history and attached objects.

Does removing metadata change how the document looks?

No. Only the hidden data is removed. Text stays selectable and searchable, images keep their resolution, and the page count, layout and formatting are unchanged.

Should I scrub metadata before or after converting a file?

After. Every conversion, edit and re-save writes fresh metadata, so scrubbing should be the final step before you send, file or upload the document.

Does removing EXIF data delete GPS location from photos?

Yes. GPS latitude and longitude, camera make and model, serial numbers and capture timestamps are all removed, so a photograph no longer discloses where and on what device it was taken.