EveryTag. Module for EDMS and corporate systems

The module for EDMS and corporate systems (formerly Information Leak Detection, ILD) is the development system of EveryTag, which detects channels for information leakage on paper. It allows you to control the dissemination of confidential data in paper form (audit results, test and research protocols, requests from regulators and regulatory authorities, internal documents, financial information, and much more). In the event of a leak, the solution will help detect the attacker.

2023: Renaming to "Module for EDMS and Enterprise Systems"

According to EveryTag, in 2023 the ILD product was renamed the "Module for EDMS and Corporate Systems."

2021

Compatibility with EDMS "Thesis"

On March 25, 2021, Howlmont announced that, together with EveryTag, they had tested and confirmed the correct operation of the EDMS THESIS and the EveryTag Information Leaks Detection (EveryTag ILD) system. Read more here

Overview of protection against leakage of confidential documents

In March 2021, a review of the means of protection against the leakage of confidential documents from EveryTag was released. Read more here.

2019

Integration into the EDMS from Synthellect

EveryTag, a Russian developer of complex solutions in the field of information security of the organization, together with Synthellect, a company engaged in the development of solutions in the field of document automation, on November 21, 2019 announced the implementation of a project in which [ILD (Information Leaks Detection) technology was integrated into the Tessa system. A joint solution will allow its users to securely share documents and files containing sensitive information. Read more here.

Patented labeling algorithm

According to information for April 2019, the ILD system is based on a patented labeling algorithm (patent No. 2646341), which is used to automatically transform each copy of the document. If a leak is detected, the system helps to easily establish the owner of the compromised copy from the document photo, PC screen and document fragment, regardless of damage.

2018

Module for identification of matching printed forms of documents - in the Register of Russian software

EveryTag, a company specializing in the creation and supply of IT solutions in the field of corporate content management, on May 7, 2018 announced the inclusion of the module developed by it for marking and identifying matching printed forms of documents in the Register of Russian software. The functionality of the module is implemented in the Information Leaks Detection (ILD) system.

As explained in EveryTag, an affine transformation algorithm is used to mark restricted access documents. Thanks to it, employees who have access to a certain confidential document in the electronic document management system receive each of their individual copies of the file with previously changed line and letter distances in it.

These transformations are not visible to the human eye, but are read by the system and allow you to store information about who, when and with what changes a personal copy was issued. These parameters in the event of a document leak will help employees of the company's information security service find out who became the culprit of the incident. The module will allow you to accurately determine the source of the leak, even if only an excerpt of the document or its part containing blots gets into the public domain, emphasized in the "EveryTag."

ILD can be built into both proprietary and free document management and enterprise content storage systems. The solution can also be connected to any enterprise user database that supports LDAP. This significantly expands the coverage of companies potentially able to use the ILD solution, the developers say.

The module we have developed is used not only to investigate leaks that have already occurred, but also to prevent them. The inclusion of the solution in the Register will allow us to more effectively offer the solution to state organizations for which the problem of leaks is no less serious than for business, - said Anton Samoilov, General Director of EveryTag.

Patent for Document Identification Mechanism

The company "EveryTag," a Russian developer of solutions in the field of information security and corporate content management, on April 16, 2018 announced the patenting of a mechanism that allows you to modify and identify documents to establish a channel for unauthorized distribution. The method is used in the company's key product, the Information Leaks Detection (ILD) solution.

The company applied to patent the mechanism in December 2016. Before issuing the patent, the Federal Service for Intellectual Property (Rospatent) conducted a formal examination and examination of the essence of the patented invention. The received document provides EveryTag with the exclusive right to operate the IT solution.

The ILD system allows you to find with 100% accuracy the culprit of the leakage of a restricted document in electronic paper form from an individual copy issued to each employee. ILD is embedded in the company's electronic document management system and for employees working with the document generates copies that are visually identical to the original. At the same time, the solution saves information about who, at what time and with what kind of transformations received the personal version. If an unreliable employee prints out a document, or photographs it from a computer display to a smartphone and the file subsequently falls into a public field, the organization's security service will be able to easily determine who has become the source of the leak.

At the same time, thanks to an optimized full-text search algorithm, the solution allows you to find a compromised document in a matter of minutes, even if a fragment of it is in the public domain. This feature reduces the time it takes information security officers in the company to investigate a leak.

Documents "merged" or lost by employees of companies penetrate into the media space every now and then, and it is extremely important to protect organizations from possible financial and reputational damage from leaks. To solve this problem, we have developed ILD. Obtaining a patent is a recognition of our expertise in the field of information security and confirmation that the system is trustworthy of Russian companies for which the protection of their corporate information is important, "said Anton Samoilov, CEO of EveryTag.

Inclusion in the register of domestic software

The ILD EveryTag solution is listed Unified Register of Russian Programs for in electronic computers and databases as a "Module for marking and identifying matching printed forms of documents" (reg. No. ON 4464, Order No. 157 of Ministry of Telecom and Mass Communications of russia 12.04.2018).

2017

ILD is addressed to banks, state enterprises, insurance companies, financial institutions, industrial enterprises or mining enterprises. The size of the customer company does not matter, the developers say.

Sample Document Identification Function

On September 6, 2017, EveryTag introduced the next version of the ILD system. The updated ILD (Information Leaks Detection) solution implements the function of identifying a document based on a sample that has fallen into the public domain.

In the event of a leak of confidential information due to the large amount of internal document flow, the security service may have difficulties finding the original compromised document. The updated solution helps determine which document was uploaded to the media or reached competitors, the companies said.

In addition, if a fragment of a multi-page document is leaked into the media space, the system, in addition to detecting the original file, helps in the image to find exactly the page from which the published copy was made. Advanced functionality saves resources needed to investigate an incident.

We understand that in order to effectively combat leaks of confidential information on paper, companies need to provide such a technological infrastructure that would automate the investigation of such cybercrimes. Earlier, a mechanism has already been implemented in the ILD system to help accurately identify the employee responsible for the incident. The proposed function provides the security services of Russian companies with even more opportunities in terms of searching for original documents and analyzing the reasons why the leak occurred, - said Andrey Zaikin, technical director of EveryTag.

The ILD security module is based on an affine transformation mechanism that allows each employee working with an electronic copy of a paper document to receive their own individual version, which looks the same as the original version. The solution does not need to multiply or archive copies of documents in the electronic document management system. The ILD stores the conversion algorithm, the date and time the copy was created, and information about the employee who received it. In the event of a leak, the system will "recognize" the document, even if it contains breaks, blots or if only part of it has been transferred.

Previously, a module was built into the solution that allows you to connect any user database that supports LDAP to ILD. Information Leaks Detection is already integrated with a number of ECM platforms, including IBM FileNet, Nuxeo Platform, EMC Documentum, Directum, Alfresco.

Integration with Microsoft SharePoint

On August 22, EveryTag announced the integration of the ILD solution that controls sensitive document leaks with the Microsoft SharePoint collaboration platform.

As a result, all features of the ILD paper protection system have become available to companies using Microsoft SharePoint technologies. Ordinary users working with internal portals based on SharePoint will not notice any significant changes: working together in a team will remain the same convenient, while paper copies of documents will be properly protected, the company emphasized.

In addition to its own ILD protection methods, the integrated solution involves protecting electronic copies of confidential documents that users receive using Microsoft IRM (Information Rights Management) technology. The IRM system is designed for access rights management: a protected document is available only to the user for whom it was created, and only if the user is authenticated in the organization's domain. The ILD system allows you to determine the owner of a paper copy of such a document in the event of a leak.

The Microsoft SharePoint platform is a convenient collaboration tool that allows the company to establish a "smart" intranet in which employees can interact with each other both from workstations and from mobile devices. SharePoint's capabilities improve the efficiency of business processes, so hundreds of thousands of organizations around the world choose the platform. The integration of the ILD system with Microsoft SharePoint is a significant step towards creating a secure information environment for Russian companies, "said Andrey Zaikin, CTO of EveryTag.

Olga Rusnak, Microsoft Information Office Systems Development Manager in Russia, stressed that "despite the almost widespread use of digital technologies, hard copy documents are still in demand in many companies. Our colleagues at EveryTag understand this and offer a solution that allows you to successfully investigate incidents related to leaks of confidential information on paper. We are confident that the integration of ILD with Microsoft SharePoint marks the beginning of a long and productive collaboration in which technologies not only help lead joint projects in electronic format, but also guard the security of confidential data in organizations.

Integration with Directum

EveryTag and Directum, within the framework of a technological partnership, announced on August 17 the integration of the ILD (Information Leaks Detection) system with the Directum ECM system. The EveryTag solution is responsible for identifying data leakage channels on paper, and in case of unauthorized access to data, it helps to easily detect an attacker. Thanks to the integration mechanism, every time you access a confidential document, a unique copy is created in the ECM system, which, in case of a leak, will allow you to set the date of a specific user. You can read more about the event here.

Integration with "EDMS Logic"

On August 8, the Logic of Business company announced the integration of the Information Leak Detection (ILD) solution of EveryTag into the electronic document management system Logic of EDMS. The ILD system helps to ensure that confidential information is leaked on paper. The algorithm of the solution is to create individual copies of the document with which employees work in the electronic document management system. The ILD stores several document parameters: the conversion algorithm, the date and time when the copy was issued, and the identity of the employee. Thus, in the event of a leak of information, ILD reliably determines the employee through whose fault it occurred. Read more about technology integration here.

Open REST API

On July 5, 2017, EveryTag announced the release of the next version of the ILD (Information Leaks Detection) solution, a system for controlling leaks of confidential documents.

The updated solution protecting paper documents has implemented a number of new functions. In particular, the ILD system received an open REST API interface, which allows any developer to independently connect any to the ILD. electronic document management system This expands the possibilities of using the solution: in addition to proprietary - ECM platforms (such as IBM FileNet P8 Platform,, etc.), EMC Documentum Directum any free document management system can be connected to ILD and (data storage Nuxeo, Alfresco etc.).

Also, the system was able to connect any user database used in the organization and supporting the LDAP protocol.

The ILD system as a whole is an element of the company's information security system that allows you to reliably establish the source of confidential data leakage on paper. The solution is intended to investigate cases of leakage of confidential documents and can also be used to prevent leaks: for this, it is enough to launch a pseudo-document with important information into the electronic document management system and wait until it appears in the media or among competitors, specified in EveryTag.

"Tracking the leak of paper documents is much more difficult than electronic documents - an unscrupulous employee can simply make a copy, carry it in a bag and continue to transfer or sell the company's trade secrets. In some companies, this has been happening for years. No system guarantees that the document will not "leak," but after the implementation of ILD, each employee understands that his actions will be disclosed. In our experience, this reduces the number of leaks to almost zero, "said Anton Samoilov, CEO of EveryTag.

According to EveryTag, more than 20% of all cases of leakage occur precisely through paper media: if digital data is protected by DLP (Data Leak Prevention) systems, then printed documents are still vulnerable. In 54% of cases, it is their own employees who become sources of data leakage.

Principles of system operation

The ILD is based on the principle of creating personalized copies of the original document. Each employee working with the document receives their own personal copy, which has microscopic visual differences from the original. To create these differences, the system uses an algorithm of affine transformations. It randomly shifts strings and words relative to each other, changes the size of fields, adjusts line and character intervals. Visually, these changes are invisible, but for the system they form a unique "portrait" of the copy. As a result, each user receives his own unique document, which is assigned to him.

ILD stores all transformation parameters. If an unauthorized copy of the document is found on the Internet or in the media, it is enough to upload it to the system and scan it. The program will automatically compare the modification parameters of the uploaded document with all copies that were created and issued to employees or third parties. Based on the results of the comparison, the system will give a match rating, which will indicate an assessment of the compliance of a particular copy with the downloaded file. The issuance will indicate the name and other data of the employee - the owner of the copy, as well as the date and time of its receipt from the system, which will identify the attacker.

The system is able to determine the owner of the copy based on the sample document in any form and state: it can be a photo, screenshot, scan or screen photo. It will be possible to identify an unscrupulous employee even if the document is dented, contaminated, spoiled or only a small fragment of it is available, emphasized in the "EveryTag."

Technical features

The ILD electronic archive does not store the copies themselves, but only transformation algorithms, employee information and document issuance dates. Each generated copy is destroyed after a while: the term can be set independently (by default it is 9 hours). Digital casts of documents occupy 10-15 KB.

The system is not tied to proprietary platforms and integrates with most ECM-systems:, IBM FileNet,, Documentum, Directum "EDMS logic" as well as - open source systems. ILD also acts as a stand-alone service that can be worked with using the REST protocol (+ HTTP JSON).