How to protect CAD drawings and industrial IP shared with contractors

Overview

Sharing CAD drawings, 3D models, and technical specifications with contractors is routine, but the moment a file is downloaded, your control disappears. The practical fix is zero-cleartext viewing: keep the original file on your server, render only watermarked pixels to the contractor's browser, and enforce access policies you can audit.

The problem isn't the contractor; it's the copy

The truth is, most contractors are not the enemy. They need the drawing to quote, fabricate, or inspect. The enemy is the copy they now have: a DWG, a STEP file, a PDF of specs. Once that copy sits on their laptop, their email, or a subcontractor's USB drive, your IP is living outside your perimeter. And this isn't theory, eh — it is the default outcome of every file attachment sent today.

Traditional protection focuses on the transport: encrypted email, secure file shares, VPNs. They answer 'was the trip safe?' but not 'what happens after arrival?' That is the wrong question for industrial IP, because the risk is not the journey; it is what the recipient can do next.

• Downloads create permanent copies you cannot recall, patch, or audit.
• Email forwards, sync folders, and USB sticks move files beyond your visibility.
• Even trusted contractors use unmanaged endpoints, shared accounts, and subcontractors.

Zero-cleartext viewing changes the equation

Here's the thing: if the contractor never receives the original file, there is nothing to forward, extract, or lose. Zero-cleartext viewing means the document stays on your infrastructure and the server renders each page, sheet, or view into pixels in memory. Only those pixels travel to the browser. No DWG, no STEP, no editable PDF reaches the endpoint.

This is the same principle behind server-side PDF rasterization, but applied to engineering formats. The viewer sees the drawing; the drawing never sees the viewer's disk. For CAD sets in particular, it means you can share a full set of plans without shipping the vector geometry, layers, or metadata that make the file reusable or exfiltrable.

Layered controls: watermark, policy, and audit

Pixels alone are not enough. You also need to know who looked at what, and you need the ability to cut access instantly. A modern pipeline combines three controls: dynamic forensic watermarking, deterministic access policies, and immutable audit logs.

• Forensic watermarking embeds user and session data into every rendered view, so a leaked screenshot points back to a specific person. See how it works in our forensic watermarking guide.
• Deterministic policies decide, on every request, whether this user can open this sheet at this time from this device — a direct application of NIST SP 800-207 Zero Trust.
• Audit logs capture viewer identity, IP, timestamp, and page, exportable for compliance with frameworks like ISO/IEC 27001.
• No downloads, no print-to-PDF, no copy-paste: the policy follows the view, not the file.

Together these controls turn a 'shared file' into a 'supervised session.' The contractor still gets the information they need to do the job; you keep custody of the asset. It is the same custody model that makes EDRM effective for general documents, now tuned for CAD and technical IP.

Where to start

• Inventory the formats you share: DWG, DXF, STEP, IGES, PDF drawings, spec sheets.
• Classify each by sensitivity and identify which contractors actually need the editable file versus just the visual.
• Replace direct file transfers with a viewer that supports server-side rendering and per-user policy.
• Run a pilot with one supplier and measure download attempts, blocked actions, and audit coverage.

Industrial IP does not leak because people are malicious; it leaks because the tools we use were built for sharing, not for custody. When you share CAD drawings through zero-cleartext viewing, you stop sending copies and start granting views. If your organization works with contractors, subcontractors, or external fabricators, the question is not whether to protect those files — it is how soon you can stop delivering the originals. Ready to see it in action? Request a demo.