I spent years in commercial real estate and business brokerage before building redaction software, and I'll tell you the industry's quiet secret: almost every deal package that gets emailed around contains personal data that has no business being there. Rent rolls with tenants' Social Security numbers. Owner tax returns stapled into financials. Payroll registers with every employee's wages and SSN. And I watched those packages circulate anyway — all over the industry — because deals have momentum and nobody in the chain had a practical way to clean forty documents by Thursday.
This is the guide I wish someone had handed me: what's hiding in a sale package, when in the deal it leaks, and what to remove versus what a buyer legitimately needs.
The documents, and what hides in them
A typical lower-middle-market sale package draws from the same pile every time:
- The teaser / blind profile. Supposed to hide the business's identity — but the giveaway is rarely the name. It's the lease term that matches one address, the photo with signage reflected in a window, the revenue figure the owner already mentioned at a chamber lunch.
- Rent rolls and lease files. The big one. Lease applications carry tenant SSNs, driver's license numbers, bank references, and personal guarantees. A rent roll forwarded to a buyer pool can expose the personal financial identity of every tenant in a building — people who never agreed to be part of anyone's deal.
- Financial statements and tax returns. Small-business financials are personal financials. Schedule C, K-1s, the owner's SSN on every page of a return, personal bank account numbers where the business account runs through the owner.
- Payroll and staff records. Diligence wants headcount and wage costs. The payroll register delivers that — plus every employee's SSN, address, and pay history.
- Customer lists and A/R agings. Revenue quality matters; individual customer identities usually don't, and in service businesses the customer list is the confidential asset.
- Loan documents and payoff letters. Account numbers, personal guarantees, the owner's home address as collateral reference.
When it leaks: the deal's sharing moments
Redaction isn't a document problem, it's a distribution problem. The same file is harmless on your drive and radioactive in forty inboxes. The moments that matter:
The marketing blast. Teasers and early packages go to wide buyer lists — the least-vetted audience sees the material first. Anything identifying at this stage should be gone, not "hopefully overlooked."
The NDA-gated data room. Here's the uncomfortable truth about NDAs: they control who opens the folder, not what's inside the files. An NDA is a lawsuit you can file after the leak — it is not a control that prevents one. The moment a buyer downloads the PDF, your access controls are finished; the file lives on their laptop through this deal and the next three they look at. Data going into a data room should already be scrubbed to what that stage of diligence needs.
The lender package. SBA deals pull personal tax returns, personal financial statements, and government IDs into circulation among broker, lender, buyer, and counsel. Every hop is a full copy.
The post-deal file. Deals die; the package survives. Copies of dead-deal materials sit in the inboxes of buyers who moved on. What was in them stays in them.
What stays visible — because that's the actual skill
A buyer evaluating a business needs the economics intact: rents and terms, revenue and margins, payer mix, headcount and wage totals, lease expirations, growth history. None of that requires a single SSN, bank account number, tenant identity, or employee name. The redaction question is never "hide everything" — it's show the money, remove the people. A well-redacted package is often more persuasive than a raw one, because it signals you run a careful process — the same signal that tells a buyer your books are probably clean too.
Who's responsible — the seller or the broker?
The honest answer from inside the industry: it's ambiguous on paper, and that ambiguity defaults to whoever hits send.
The seller owns the documents and, legally, is the discloser — it's their business, their tax returns, their obligation to the tenants and employees whose data sits in the files. But the seller isn't the one assembling the CIM, loading the data room, or emailing the package to forty buyers. The broker is. In practice, the broker controls every moment of exposure, and when something leaks, "the seller gave me the raw files" has never once made a broker look good — to the seller, to the referral source who introduced them, or to anyone reading about it later.
And here's the wrinkle both parties miss: much of the sensitive data belongs to neither of them. Tenants on the rent roll and employees on the payroll register never signed the listing agreement. Nobody in the deal has their permission to circulate their SSNs — which is exactly why the responsibility can't be waved between seller and broker. It attaches to distribution, and distribution is the broker's job.
My advice, having watched this from both chairs: brokers should claim the responsibility on purpose, in the engagement agreement — "all marketing and diligence materials are scrubbed of personal identifiers before distribution" — and make it part of the pitch. It costs one process step and buys three things: the seller hears professionalism, the buyer receives cleaner materials, and the broker stops depending on whatever condition the seller's shoebox arrived in. (None of this is legal advice — your listing agreement is a conversation for your attorney — but the operational reality doesn't change with jurisdiction: the hand on the send button carries the risk.)
How I'd run it today
In my brokerage years, the packages I saw go out raw didn't go out because anyone was careless — they went out because redacting a 60-page lease file by hand, item by item, wasn't going to happen on any deal timeline. That's the problem Dr. Redact was built to fix: upload the file (or photograph a paper lease with your phone — no scanner), the engine flags SSNs, account numbers, addresses, and signatures across 65+ categories including handwriting, you approve or reject every single item, and the approved redactions are burned in at the pixel level. The unredacted original is destroyed at processing, the output stays fully searchable so the buyer's team can still work the documents, and every job produces an audit certificate — one more professional artifact to hand across the table.
And whatever tool you use — including mine — run the 30-second test before anything leaves your hands: open the redacted PDF, select all, copy, paste into Notepad, and search for what you removed. If it shows up, the redaction was a decoration. The full method comparison is in our guide to redacting a PDF properly.
Quick answers
Doesn't the NDA cover this? The NDA gives you a claim after a breach. It doesn't stop the breach, and it won't make a tenant whose SSN circulated feel covered. Access control and content control are different layers; deals need both.
Will buyers accept redacted documents? Redacted packages are standard practice in transactions. What's rare is proof — an audit certificate listing exactly what was removed answers the question before it's asked, and the searchable output means their diligence team loses nothing.
What about paper files? Half of small-business diligence is still paper — old leases, equipment agreements, handwritten amendments. Photograph the pages with your phone directly on the site; they go through the same detection and review as an uploaded PDF.
What's the real risk if I just send it raw? Breach-notification laws in all 50 states cover the personal data in those files, GLBA reaches brokered lending paperwork, and the practical risk is faster than the legal one: the seller whose tenants get exposed, or the employee whose SSN circulates, was referred to you by someone. This industry runs on referrals both ways.
The habit is the whole game: before any file joins a package, ask who will eventually hold this copy, and what's in it that they don't need? Your first pages are free at drredact.com — no card — if you want to see what's hiding in the last package that crossed your desk.