A PDF is not a picture of a document. It is a container, and the pages are only one of the things in it. The rest is metadata: small, invisible, written automatically, and read by anyone who thinks to look.
None of it is sinister. Every field exists for a reason and most were added helpfully. The problem is that nobody chose them and almost nobody knows they are there.
The Info dictionary
The oldest layer, and the one every reader shows under Document Properties. Six fields matter.
Author is usually your operating system account name, which is often your full legal name because that is what you typed when you set up the laptop. Title is frequently the original filename, including the part you renamed away — offer-v3-FINAL-lower.pdf becomes a title that travels with the document after you rename the file to something dignified.
Creator names the application the content came from and Producer names the thing that wrote the PDF. Together they describe your toolchain precisely: which word processor, which version, which platform. For a firm sending a proposal, that is a small disclosure about internal systems that nobody intended to make.
CreationDate and ModDate carry timestamps with UTC offsets — so they record not just when, but roughly where. A document a consultancy dated Monday morning, modified at 02:14 with a +05:30 offset, tells a story about who actually wrote it.
XMP — the second copy
Since the early 2000s there has been a parallel metadata system: an XMP packet, XML embedded in the file, holding much the same information and more besides.
This is the one people miss. Clearing the Info dictionary through a document-properties dialog frequently leaves the XMP packet untouched, so the author name you carefully deleted is still in the file, one layer down, in a format a text editor will show you.
XMP can also carry things the Info dictionary has no room for: a document identifier that persists across saves and links revisions of the same file together, rights statements, and whatever an editing tool decided to record about its own workflow.
Any removal worth trusting clears both. It is the single most common way a PDF is "cleaned" and is not.
The revisions still in the file
PDF supports incremental saving: rather than rewriting the file, an editor appends the changes to the end and adds a new cross-reference table. It is fast and it is safe against corruption.
It also means the previous version is still in the file, in full. A reader shows you the latest state because that is what the newest table points at. The earlier objects are sitting behind it, and recovering them requires no skill — a viewer told to read an older revision will simply display it.
This is how documents have leaked. Not by a clever attack; by someone editing a page and saving over it, and the file politely keeping both.
Redaction, and the black rectangle
The most expensive mistake in this whole area, and it keeps happening to organisations with lawyers.
Drawing a black rectangle over a name adds a black rectangle to the page. The text underneath is still text. Select the area and copy, and the name comes out. So does extracting the page — the rectangle is a drawing instruction that happens to be executed after the letters, and nothing about it removes them.
The same is true of a white box, a highlighter used at full opacity, and a shape pasted in from a drawing tool. Real redaction deletes the underlying content and then covers the space; there is no visual difference between doing it properly and doing it wrong, which is precisely why the wrong version survives review.
If you have no tool that redacts properly, the reliable fallback is to render the page to an image, mark the image, and rebuild the document. It destroys the text layer, which is the point.
The smaller ones
Form fields keep their values, and some producers keep earlier values too. Flattening writes the current answers onto the page and drops the fields.
Embedded files. A PDF can carry attachments. The spreadsheet a chart was generated from can ride along inside the report, complete, with no indication on any page.
Annotations and comments. Review notes are objects, not page content. A reader may hide them; they are in the file.
Images keep their own metadata. A photograph placed into a document carries its EXIF with it, which is to say its GPS coordinates and camera serial. Stripping the PDF's metadata does not touch what is inside the pictures.
How to look
Open Document Properties in any reader for the Info fields. That is the surface, and it is enough to catch the obvious.
For the rest, open the PDF in a plain text editor. Most of the file is binary, but XMP is XML and appears as readable text — search for xmp or your own name. It is crude and it works, and it is the fastest way to confirm that a tool actually removed what it claimed to.
To check for earlier revisions, search the file for %%EOF. More than one means the document was saved incrementally and there is history in it.
What to strip, and when
For anything leaving your organisation — clear the metadata, flatten the forms, and confirm the result rather than trusting the report. Two minutes.
For documents you keep, leave it alone. Creation dates and authorship are genuinely useful in an archive, and stripping your own records to feel tidy is how you lose the ability to tell which of four similar files is the real one.
The rule that covers most of it: metadata is a problem when a document crosses a boundary and an asset when it does not. Decide at the boundary.