2026-10-11

Reusing a Word template for a new client? What file metadata can still reveal about the last one

A consultant finishes a proposal for a new client by opening last quarter's proposal for a different client, running a find-and-replace on the company name, swapping the logo, and sending the file. The visible text reads clean — nothing in the paragraphs mentions the previous client. But Word, Excel, and PowerPoint files carry information about themselves in parts of the file nobody scrolls past, because nobody opens them during a normal edit. A new client who checks File > Properties, or just hovers over the file in a folder listing, can see exactly what that find-and-replace never touched.

The lawsuit that was a different lawsuit three minutes earlier

The clearest documented case of what that oversight can reveal isn't a consultant's proposal — it's a complaint actually filed in a Michigan courtroom. Reporting from CNET News.com in early 2004, reprinted by The Globe and Mail and separately covered by Pinsent Masons, found that the Word document behind SCO Group's lawsuit against DaimlerChrysler still carried its own editing history. Up until Feb. 18 at 11:10 a.m., the draft named a different defendant entirely — "Bank of America, a National Banking Association." At that exact timestamp that name was deleted and "DaimlerChrysler Corp." typed in its place; three minutes later, a margin comment asking "Are there any special jurisdiction or venue requirements for a NA bank?" was deleted too. Nine days after that, on Feb. 27, the filing location itself moved — from California, where Bank of America is based, to Michigan, DaimlerChrysler's home state. SCO ultimately filed the DaimlerChrysler suit in Oakland County Circuit Court on March 3, 2004, alleging breach of DaimlerChrysler's Unix software agreement — a different legal theory entirely from the copyright and DMCA claims the Bank of America draft had argued, down to different damages language. Whether SCO was ever seriously planning to sue the bank was never established publicly; what the file itself established, independent of anything SCO's lawyers said afterward, was that the final document had been built by editing an earlier one meant for someone else.

What a reused .docx carries in the same spot today

SCO's case ran on a feature — Word's old "fast save" revision log, embedded inside the binary .doc format — that modern Office retired when it moved to the zip-based .docx/.xlsx/.pptx format in 2007. Today's equivalent isn't an automatic log of every past edit; it's three small XML files inside that zip archive, in docProps/. core.xml carries the author name and lastModifiedBy — whoever last saved the file. app.xml often auto-fills Company from whatever organization name Office was registered to at install time. custom.xml holds free-form fields that proposal software, contract-assembly tools, and document-management systems commonly use to write in a client name or matter number, so the file stays searchable inside that system later. None of the three is touched by editing the document's visible text. A proposal.docx built by copying last quarter's file for Client A, then rewritten for Client B, can still read Company: Client A Inc. in its own Properties dialog — not because anyone meant to leave it there, but because a normal edit pass never opens that part of the file in the first place.

A duty some professions already have, and the mechanics everyone else shares

For lawyers specifically, this isn't only an embarrassment risk — it's a stated professional obligation in at least one jurisdiction. The North Carolina State Bar's practice-management center, in a 2022 article aimed at its own members, cites the state's 2009 Formal Ethics Opinion 1 (adopted Jan. 15, 2010): a lawyer "must use reasonable care to prevent the disclosure of confidential client information hidden in metadata when transmitting an electronic communication," and a lawyer who receives a document and notices metadata that looks inadvertently disclosed has a duty to notify the sender. Most consultants, freelance writers, accountants, and marketing agencies have no bar association writing that rule down for them specifically — but the file mechanics behind it don't check what profession opened the template. A reused proposal, invoice, or report carries the same three XML parts no matter who built it, and a new client who happens to glance at Properties sees exactly what an opposing lawyer would.

What clearing a reused template changes before you send it

Running the finished file through a client-side scrubber — entirely in the browser, the way NearScrub works, with nothing uploaded anywhere — blanks docProps/core.xml, app.xml, and custom.xml in one pass, across docx, xlsx, pptx, and their OpenDocument equivalents, plus the equivalent Info-dictionary keys and XMP stream in an exported PDF. At that point it no longer matters whether Client A's name was ever typed into Company, or whether the proposal software wrote Client A's matter number into a custom field three projects ago — there's nothing left in the file's own properties for a new client, or anyone else, to find.

What this doesn't fix

The SCO case is a useful cautionary story, but it's honestly not the exact mechanism docProps clearing solves. What tripped up that document was leftover text and a comment inside the body — the same place Word stores tracked changes today, in word/document.xml and comments.xml, parts of the archive entirely separate from docProps/. NearScrub doesn't touch either one. If a reused template has Track Changes turned on, or unresolved comments left over from the original client's review, those have to be accepted, rejected, or deleted inside Word's own Review pane — or checked with Word's built-in Document Inspector (File > Info > Check for Issues) — before any metadata tool runs. Clearing a file's properties also doesn't catch an incomplete find-and-replace sitting in the visible text itself; that's a proofreading problem, not a metadata one, and no scrubber reaches it. And like every scrub, it only affects the copy you run it on — a version of the template already sent to a different client last quarter is outside anything you can fix today.