Important Notes
Tracking requires internet access. The document must be opened on a device connected to the internet for the tracking pixel to load.
Key Considerations
- External image blocking - Some corporate environments block external images in documents by default
- Desktop apps may prompt - Applications like Word and Excel may ask users to "Enable External Content" before loading images
- Test first - Always open the document yourself first to verify tracking works before sending to recipients
- Multiple opens - The same person may trigger multiple events if they open the document several times
Testing Your Pixels
Before sending a tracked document to your recipient, always test it:
1 Test Procedure
- Create your tracking pixel
- Embed it in your document
- Save the document
- Open the document on a different device or network
- Check your Signal Canary dashboard for the test event
- Verify the data looks correct
Testing from a different network (like your phone's mobile data) helps ensure the pixel works correctly outside your office network.
Common Use Cases
| Use Case | What to Track | What to Look For |
|---|---|---|
| Sales Proposals | When prospects open your proposals | Multiple opens may indicate high interest |
| Contracts | When contracts are reviewed | Verify the right party is reviewing |
| Legal Documents | Document access for legal proceedings | Proof of document receipt and viewing |
| Investigation Decoys | Detect unauthorized data access | Any access indicates potential breach |
| Insider Threat Detection | Monitor access to sensitive files | Unexpected access patterns or locations |
| IP Monitoring | Track intellectual property documents | Access from unexpected organizations |
Understanding Limitations
When Tracking May Not Work
- Offline viewing - Documents opened without internet access
- Blocked images - Organizations that block external content
- Print copies - Physical printouts cannot be tracked
- Screenshots - Screenshots of documents won't trigger tracking
- PDF security settings - Some PDF readers disable external connections
Location Accuracy
IP-based geolocation is approximate. City-level accuracy is typically good, but can be off by tens of miles. VPN and proxy users will show the VPN exit location, not their true location.
Attribution Confidence
Not all access events are equal in terms of how confidently you can identify the viewer:
| Confidence Level | Indicators |
|---|---|
| High | Corporate IP, matches expected recipient's company, business hours access |
| Medium | ISP IP in expected geographic area, reasonable device/browser |
| Low | VPN/proxy detected, cloud provider IP, unusual patterns |
| Minimal | TOR network, known scanning service, automated access |
Signal Canary provides indicators and intelligence, but cannot definitively prove identity. Use access data as part of a broader investigation, not as sole evidence.
Ethical Considerations
Signal Canary is designed for legitimate security and business purposes:
- Protecting sensitive business documents
- Detecting data breaches and leaks
- Verifying document receipt
- Insider threat investigation
Always ensure your use of document tracking complies with applicable laws and organizational policies.