You Probably Already Did.
That NDA you signed? Worthless if your stack is betraying you.
You didn’t leak anything. You didn’t post it online. You didn’t even share it.
But your default tools did.
When Trust Isn’t Enough
A creator I know (let’s call her M) was working under a tight NDA with a software startup. High stakes branding project. She kept it quiet, followed protocol, didn’t even tell her spouse.
But she used Google Docs.
She dropped drafts into a shared folder. Her Figma boards synced to the cloud. Zoom calls with the CEO. Standard stuff.
Until it wasn’t.
Six weeks later, parts of her deck showed up modified, repackaged in a competitor’s pitch. The client was furious. She was dropped. Reputation dented. No recourse.
How?
The client’s internal team traced metadata from a supposedly “confidential” asset back to a third party tool scraping open preview links. Not her fault. But still her responsibility.
What Happens When You Trust the Cloud
Google. Dropbox. Zoom. Adobe. These aren’t neutral platforms. They’re businesses built on data.
Yes, most of them say they don’t use your private documents to train AI models unless you opt in. But here’s the catch:
- Logs and telemetry still flow back: what you open, when, and how.
- Default sharing settings can expose files: a “share link” can make content public to crawlers.
- Metadata rides along: authorship, device info, timestamps, sometimes even GPS tags.
NDAs are written for human breaches, but most leaks today are structural. Invisible. You didn’t technically break the NDA, yet the system you trusted might have done it for you.
3 Ways You’re Already Risking NDAs Without Realizing
1. Cloud Sync by Default
Every time you save, that file goes to someone else’s server. Even local edits on Google Docs are stored offsite.
2. Metadata in Your Files
Your name. Your location. Your device. Hidden in PDFs, images, audio files. Strip it or leak it.
3. Auto AI Indexing and Sharing Previews
Share a doc link without login required? That’s not private. Crawlers and even AI data harvesters have been caught scooping these up.
A Safer Workflow for Client Projects
You don’t need to live in a bunker. You just need to stop trusting defaults.
Here’s a cleaner stack:
Start Local
Work offline in LibreOffice, Obsidian, or text editors. Encrypt folders using VeraCrypt or Picocrypt.
Encrypt Before Sending
Use picocrypt with a strong passphrase. Or gpg. Or age. Do not skip this step.
Send Via Wormhole or Onionshare
These tools create time limited, encrypted links. They don’t store the files permanently. They don’t leak.
Strip Metadata
Use ExifTool, MAT2, or gpdf. Automate it if you can.
Educate the Client
Tell them why you’re sending encrypted zips. Offer a one liner: “I use secure transfer methods to protect both our interests.”
You’re not being paranoid. You’re being responsible.
What To Say to Clients Who “Don’t Get It”
Some clients will resist. They’re used to Google Drive.
Here’s the play:
“I take IP protection seriously. That includes yours. I use encrypted file delivery to make sure your assets stay private, even from my tools.”
Frame it as their protection. Because it is.
If they still push back and insist on weaker methods? Use their system, but log the refusal. Keep the paper trail. If there’s ever a leak, you’ll need proof you pushed for better security.
You didn’t break the NDA.
The system you trusted did.
Claw it back.
-GHOST
Written by GHOST, creator of the Untraceable Digital Dissident project.
This is part of the Untraceable Digital Dissident series — tactical privacy for creators and rebels.
Explore more privacy tactics at untraceabledigitaldissident.com.
Recent Articles
- Decoy Accounts, Decoy Data, Decoy Devices.
- Backup Plans for Your Comms, Data, and Identity
- Hardening Your Home Against Digital and Physical Intrusion
- The Day You Ditch Your Phone Shouldn’t Be the First Time.
- REVIEW: SLNT Faraday Bags: Field Tested, Signal Killed
Content Intergerty:
- Hash: 957213b6ce51e088efa11dc063cc65fcfff4781c8f86d9ddc439e025436b53e9 Would-You-Violate-a-Client-NDA-Without-Knowing-It?
- Timestamp: npub1gxsss485j5yvwe7yffp48ddxr7qhshmzl9f8fvzrphltaj5zqaps8xkyrv 7/1/25, 8:24 AM (nostr:nevent1qvzqqqqqqypzqsdppp20f9ggcanugjjr2w66v8up0p0k972jwjcyxr07hm9gyp6rqyt8wumn8ghj7un9d3shjtnddaehgu3wwp6kytcpzdmhxue69uhk7enxvd5xz6tw9ec82c30qythwumn8ghj7un9d3shjtnswf5k6ctv9ehx2ap0qqsg9egt6greql8ahrf3vjvm0rnhzmt8cm7mhm5nnggdnzc6vxvrpmgherp3d)