In-browser PDF viewing — watermarked
Every page of every PDF served inline carries the viewer's email + IP + UTC timestamp, applied server-side via pdf-lib before bytes reach the browser. Reviewers read freely; you have evidence if a draft leaks. Downloads stay un-watermarked so sha256 chain-of-custody holds.