Nocturne Trace

What actually leaks

H/Advisors Abernathy’s sixth annual report, published 29 January 2026, found that 42% of US $1bn+ M&A deals announced in 2025 leaked before announcement — the highest since tracking began, up from 31% in 2024 and 24% in 2023.

Almost every control sold against this watches one channel. DLP inspects egress, rights management encrypts and revokes, a data room logs every view. All of them describe a file crossing a boundary a computer can see, all of them are useful, and none of them sees the leaks that actually happen.

Someone holds a phone up to a screen in a meeting room. Someone prints a page and scans it at home. Someone pastes a memo into a chatbot and forwards the summary. Verizon’s 2026 DBIR indicates source code is the single most common category uploaded to unauthorised AI tools: the behaviour is routine now.

The market has one commercial answer to the first of those channels — EchoMark Screen, launched 1 July 2026, Windows only — and none at all to the third. Every marking scheme here assumes the leaked artifact is a copy of the document; that held for twenty years and no longer reliably does. Trace prevents none of this. It changes what a leak costs the person who does it, and what you can establish afterwards.

The three marking layers

The document layer lives in the file structure: object ordering, resource placement and compression decisions arranged differently per recipient. It survives forwarding, re-saving and copying between drives; a re-render or a print destroys it. It is the first thing to look for, because it answers fast.

The page layer lives in the document as rendered: per-recipient adjustments to spacing, line-break positions and low-amplitude luminance structure, below the threshold at which a reader notices and above the one at which a 200 dpi scan destroys them. This is what survives print-then-scan and an angled photograph of a screen. It needs a reasonable fraction of a page — a cropped thumbnail of one paragraph is not enough — and skew, glare and blur degrade it gradually rather than all at once, which is why the result is a figure.

The text layer is the per-recipient arrangement of the wording: which of several equivalent formulations is used, where a sentence boundary falls, the ordering of a list whose order carries no meaning. It is the only layer that survives retyping, translation or a model, and the only one with a governance cost, so you constrain it rather than us. Defined terms, figures and legal formulations are locked, and where nothing may vary the layer is simply off.

The layers are independent by construction, and that is the whole robustness argument. A conversion that strips one usually leaves the others, and two layers agreeing on the same recipient is materially stronger than either alone.

Why an LLM rewrite is the interesting case

Consider the leak that gives a general counsel most trouble in 2026. A memo goes to eleven recipients; three weeks later a publication runs a piece plainly built on it — same figures, same argument, same unusual assumptions — sharing not one byte with anything you issued. A hash is useless, the document layer went with the file structure, and what left was prose a person was entitled to read.

The text layer partially survives this, because a model rewriting a document preserves more of its input than people assume. Proper nouns and figures carry through, the order of the argument carries through, and in passages kept close to the source so do sentence boundaries. Eleven recipients narrow to two or three.

Partially — not reliably, and not always. A three-paragraph summary of forty pages leaves nothing, a translation into German and back leaves almost nothing, and aggressive rewriting leaves a signal too weak to separate candidates. Trace reports the surviving span in words and a confidence figure that falls with it, and returns an empty set when the honest answer is that it cannot tell.

We would rather be explicit about the science than sell around it. Regeneration and diffusion-purification attacks — Zhao et al. 2024, and 2026 work including the Modulated Diffusion Attack and “When Denoising Becomes Unsigning” — provably strip surface-level invisible marks, and “Stable Signature is Unstable” showed that fine-tuning a decoder removes model-level marks. Anyone offering you an unbreakable watermark in 2026 has not read that literature or is relying on you not having. Our answer is redundancy across layers and a figure that degrades.

What the confidence figure means and how to read it

Every vendor here ships a confidence score, and very few will say what it is the probability of, which makes the number decorative. Ours is the probability that the leading candidate produced this artifact rather than any other copy on the register, or than a chance arrangement.

That has a consequence worth sitting with: the figure is conditional on the register being complete. Against eleven issued copies, a strong match is strong. Against eleven where a twelfth went out by email outside Trace, it is confident about the wrong population and will name someone with conviction. Trace reports the denominator it used, and checking it is an investigator’s first job.

Three results, and how to describe each to someone who will not read the derivation. A figure of 0.97 across two agreeing layers against a register of twelve is something you can act on. A figure of 0.62 from the text layer alone, with 430 surviving words, against a register of three hundred, is a direction of enquiry and should be reported in those words. A set of four with no separation is a finding that four people cannot be told apart — and it still removes 296.

trace.explain_match exists so that neither an agent nor a person has to take the number on trust. Repeating a confidence figure without its derivation is the commonest way an investigation reaches a wrong conclusion confidently.

The techniques we deliberately do not use

Trace does not use zero-width or homoglyph Unicode marking. It is the cheapest way to put a per-recipient identifier into text, it is widely used, and it is a bad idea for two independent reasons.

The first is that it does not work where it matters. Platforms strip zero-width characters as a matter of routine — messaging clients, ticketing systems, CMS sanitisers, plenty of email paths. A mark carried that way is removed by the ordinary journey a document takes through a company, before any adversary does anything, and you will believe you have coverage that you do not.

The second is that it damages the document. Homoglyph substitution produces text that looks identical and is not: it hashes differently, sorts differently, fails exact-match search, and breaks exports and audit trails. A document that does not match itself is a poor exhibit in the process you bought this for.

Nor is a visible tiled overlay the forensic layer; it is cropped out in seconds and its real function is deterrence. Trace will add one for that reason and will not call it attribution. We also do not encrypt documents or control what a recipient may do with them — that is enterprise rights management, and Seclore, Fasoo and Microsoft Purview do it properly.

And we do not claim C2PA support. C2PA covers PDF and Office as containers and is being standardised as ISO 22144, but its hard binding fails on any re-encode, screenshot or naive re-save — precisely the events Trace is built around — and most platforms strip credentials on upload. When verification infrastructure catches up with signing infrastructure we will revisit it.

What an investigation looks like in practice

The work happens before the leak, and it decides whether any of the rest is available to you. Every copy leaves through mark_document against a registered recipient, out of a data room, an email gateway or your own application. A document distributed outside that path is not attributable later.

On day one of an incident you have an artifact in whatever form reality handed you: a screenshot forwarded by a journalist, a photograph of a printout, four paragraphs quoted in an article. Everything is hashed on intake and held unmodified, because the first question asked will be whether the thing you analysed is the thing you received.

Minutes later you have one of three shapes. A leading candidate with clear separation. A set with no separation, which gives you a group and not a person. Or an empty set, meaning no recoverable mark — never marked, or destroyed by the channel. All three are answers and only one of them is a name.

What happens next is not a software question, but the software should be built for it. The UK FCA’s Primary Market Bulletin 54, published 14 March 2025, raised concerns about insiders and advisers leaking inside information on live deals, and expects a leak investigation to be conducted quickly by independent experts, with working papers retained and available to the FCA on request. The same bulletin records that fines for improper disclosure are not capped at the top. The pack is designed to be those working papers, which is why it states what it cannot establish — including the absence of case law testing this class of evidence.

There is a clock on all of this. DORA gives a financial entity four hours from classifying an incident as major to send its initial notification, and no more than twenty-four hours from becoming aware of it; NIS2 requires a 24-hour early warning and a 72-hour report. That is no longer a deadline ahead of you: Germany’s implementing act has been in force since 6 December 2025 with no transition period, and at the end of May 2026 roughly 18,500 of about 29,500 entities in scope had registered with the BSI, against a deadline already extended once to 31 July 2026. Inside those windows, being able to name the copy is the difference between reporting an incident and reporting an absence of knowledge. The DORA clock covers major ICT-related incidents, not every leaked document — but a leak that reaches a live deal is the case regulators ask about first.

What the largest deployments oblige us to

At the top of this market the price is not set by the software, and the clearest evidence of that is a margin. Kudelski’s Watermarking and Streaming Protection revenue grew close to 40% in 2025, inside a Core Digital Security segment whose gross margin rose from 86.6% to 90.1%. Nobody earns ninety points processing pixels. Ninety points is what a market pays for an obligation.

The cost side is better sourced than the price side, and it has a second, broader reading worth putting beside the 42% at the top of this page. That figure is H/Advisors Abernathy’s, and its denominator is US deals above $1bn. Widen it to every deal everywhere and SS&C Intralinks with Bayes Business School put pre-announcement leakage at 9.5% in 2024 — a sixteen-year high across more than 15,000 acquisitions, with leaked deals closing roughly two weeks slower than clean ones. Two studies, two denominators, one direction. Whichever you use, the number is the highest either has recorded. On 6 May 2026 the SEC charged 21 individuals over information taken from several global law firms across more than twelve pending deals.

Published prices here exist only at the bottom — Imatag Monitor from EUR 299 a month, EchoMark Individual at $19.99 — and nowhere at the top, which is exactly where the obligations live. What follows is what the top tier commits us to, written the way it would have to appear in a contract, because an obligation that is not contractual is a marketing claim and prices like one.

The strongest evidence for this price band is not evidence about us, and we will say so before you find it. The public anchor in this category is Everfox, which holds a run of federal counter-insider-threat contracts: $84,678,976.05 at DISA over four years, about $21.2M a year, and five more running between $1.87M and $5.69M a year, five of the seven openly competed. That proves the category is expensive. It does not prove we are paid at that level, and it cannot, because we are not eligible to be. Those programmes require a US facility clearance, and Hlebourg FZCO is incorporated in the UAE. The bar is 32 CFR 117.9(c)(2)–(c)(3) — organised under the laws of the United States, located in the United States — and it sits before FOCI mitigation is reached, so it is not a question of ownership structure and not a question of price. Anyone quoting Everfox at you as our comparator is quoting a market we cannot sell into.

The direct comparators in that same registry are two orders of magnitude lower. Federal line items for “watermarking” top out at $298,926, and that one is radio-frequency watermarking for combat identification rather than documents; Locklizard at the US Air Force was $25,520.30. The gap between $25,520 and $21.2M is not technological — both systems track documents. It is that in the expensive case the vendor answers to a named programme with a regulatory basis, a deadline and an executive who owns it, and in the cheap case the vendor ships a feature. If you have no such programme, Locklizard is your comparator, and you should buy Locklizard.

A forensic engineer on duty, and a clock on the answer rather than on the acknowledgement. Covering one position around the clock is 4.2 people by the 168-over-40 arithmetic, and a fifteen-minute obligation requires whoever is on duty to know your specific installation, which caps how many accounts one line can carry. The published floor for engineers reserved against an event that may never happen is AWS’s: Incident Detection and Response from $7,000 a month, Countdown Premium at $10,000 per project per month. Two qualifications, both ours to make. The roster is a Nocturne property, shared with Vault and Entropy and charged once across the suite — it is not a line against this product, and a vendor billing three duty rosters for one duty engineer is selling the same thing three times. What belongs to Trace alone is the second clock: a contractual window inside which you receive a candidate set, a confidence figure and the derivation behind both, because an acknowledgement is not an answer.

An opinion built for a proceeding, with a person behind it. Chain of custody preserved from intake, the derivation written out for someone whose job is to argue with statistics, and a named expert contractually available to give evidence within a stated period. Read that against the limit stated above: no case law was found in which forensic document watermarking has been tested as evidence, and no obligation we sign changes that. What the obligation buys is that the record is assembled to survive the attempt.

An annual independent audit of the marking scheme, published whole. We commission it, we pay for it, and you receive it entire, including the findings we have not remediated. For the scale of the work: Trail of Bits publishes its Level of Effort, and its 2026 cryptographic engagements ran one to eight engineer-weeks, median 2.2 across eleven reviews. The attestation is the part of this that is real. What would not be real is a cash reserve held against a probability nobody has ever observed, and we do not sell one of those.

An outcome warranty, on a published ladder, adjudicated by someone who is not us. Take the objection first, because it is the right one: a warranty where the vendor writes the marking scheme, runs the verification pipeline and defines what “cannot name the recipient” means is a warranty the vendor adjudicates itself, and it is worth nothing. Druva’s resiliency guarantee is the public template for the shape, a payout ladder scaling with annual spend and reaching 10x at the top rung. What makes ours worth anything is the two things that shape does not supply by itself: the ladder is printed in the contract before you sign it, and a disputed determination goes to a named independent examiner rather than to our support desk.

The scheme that marked a copy stays alive as long as you could be asked about it. A leak investigated in 2033 has to be attributable by the scheme that was running in 2026: frozen release train, archived toolchain, a build that still reproduces. A procurement officer is right to observe that this is version control and a build archive rather than an exotic cost, and we will not pretend otherwise. What makes it an obligation rather than a habit is that we test it annually against the archive and hand you the result.

Works-council clearance, carried by us — and charged once. Per-recipient marking exists in order to attribute conduct to a named individual. That makes Trace the paradigm case for every European co-determination statute rather than an edge case, and the heaviest such load in Nocturne. Germany’s BetrVG §87(1)(6) engages. Austria’s ArbVG §96(1)(3) engages and the council’s refusal cannot be overridden by any body, which is why it sits in our limits and not in this section. The Netherlands treats it as a personeelsvolgsysteem under WOR art. 27(1)(l). Italy requires an RSU/RSA agreement or an INL authorisation under the Statuto dei Lavoratori’s remote-monitoring regime. France requires CSE consultation, with délit d’entrave at EUR 37,500 for the legal person. Trace is close to unsellable in DACH unless that clearance is a contractual deliverable rather than a description of our helpfulness. What you buy is the works-agreement technical annex mapped setting by setting, the data-flow dossier in the council’s own language, named engineers who attend the sessions, and the council’s own §80(3) expert funded to a cap. What the alternative costs you: an Einigungsstelle at roughly EUR 36,300–46,800 per escalation, borne entirely by the employer under §76a(1) with no statutory ceiling, plus the deployment standing idle while it runs.

Then the concession that is worth more than the claim it gives up. You have one set of works councils. If you also run Cadence or Harbour, this is one negotiation and one Gesamtbetriebsvereinbarung covering every system, and it is charged once at the suite level rather than once per product. A vendor billing the same clearance against six products is selling you the same thing six times. Check for that pattern in any proposal you are reading. Check for it in ours.

What this is not. Trace is not an AI Act Article 5 problem, and we would rather pre-empt the question than answer it in a review three months in. Article 5(1)(f) prohibits inferring emotion from biometric data; watermark attribution infers identity, from document structure and page rendering, and touches no biometric signal at any layer. Where Trace’s output feeds a personnel decision it is Annex III territory — and those high-risk obligations were deferred from 2 August 2026 to 2 December 2027 for standalone systems, and to 2 August 2028 for embedded ones, by Regulation (EU) 2026/1744, signed 8 July 2026. Deferred, not cancelled: the preparation window got longer, the obligation did not go away.

A fixed price for the term. No annual uplift, no CPI index, no recompute against actual volume, no supplement for additional deployments — and, symmetrically, no clause preventing the price falling when your perimeter shrinks. This is an obligation rather than a courtesy precisely because the meter is per copy: the meter is the thing that could otherwise run away from you. The norm it refuses is 5–8% annual escalation. Microsoft raised E5 from $57.00 to $60.00 on 1 July 2026 and withdrew the EA volume-discount tiers B–D in November 2025, so 100,000 seats no longer earns an automatic discount.

How the meter is shaped, and what is not on this page

Money is charged against one thing: the uniquely marked copy, one per recipient per issue. One meter, because a second meter is a price change wearing the clothes of a product update, and one number is easier to argue with than four.

Everything the market conventionally charges for separately sits on the other side of that line. Not pages — virtual data rooms still bill $0.40 to $1.00 per uploaded page, which is what makes a document-heavy quarter a budget event. Not seats: per-recipient marking is sold today inside seat-priced suites, Purview Suite at $12.00 per user per month, E5 at $60.00 from 1 July 2026, and Trace counts no users at all. Not investigations — not the submission, not the match, not the export — because a meter that runs during an incident teaches people to wait before calling one in, and the whole value of the register is that nobody waited. Not retention: the register and the closed packs stay live for as long as your limitation period runs.

There is no figure on this page and there will not be one. An individual, a mid-sized firm and a global bank buying this same product pay amounts two orders of magnitude apart, and a single number printed on a website would be a lie at both ends of that distribution. What is published instead is what the money is charged against, what it is never charged against, the checkable test for whether the top tier is aimed at you at all, and the list of what that tier obliges us to — which is the part that actually moves the number.