The leak you cannot see
None of the metadata dictionary shows on the page, and most of it survives ordinary exports. The author field gets people in trouble; custom fields are worse.
What the check reads
The metadata dictionary
Title, author, subject, keywords, creator, producer, and creation and modification dates — plus any custom key, where a matter number or client ID can hide. XMP packets are reported separately.
Embedded files
A PDF can carry an attachment inside it, and attachments survive every export that only touches page content. The bytes are scanned on the main thread, so even a large file is checked without a full parse.
A verification pass, not a promise
The check reports every presence — author, custom key, dates, XMP, embedded file — with the value. Strip metadata at the output step, then verify the strip took. Before you send, not after.
Send clean files
Run the metadata pass on any PDF in seconds, fully local. Free on one file up to 25 pages.