# Client-file metadata checklist before delivery

Originally published at https://gifi.ai/guides/client-file-metadata-checklist.

Before delivering a client file, work on a copy, use the application’s own document inspector for comments and hidden content, inspect the package for author and provenance metadata, remove only the agreed surfaces, then reinspect the final file. Check the filename and visible document content separately. Keep a short audit record without duplicating the client file.

Reviewed by [Can Balkaya](https://gifi.ai/authors/can-balkaya). Published 2026-08-22; updated 2026-08-22.

## How to verify the job

1. **Make a delivery copy.** Keep the approved original unchanged. Rename a copy for delivery and review the filename itself for names, internal codes or version notes.
2. **Inspect both layers.** Use Word or Office Document Inspector for document content, then inspect the package and embedded assets for named metadata.
3. **Clean, reopen, reinspect.** Remove the agreed surfaces, reopen the output in its native application, and repeat the inspection before handoff.

## Start with the content the client can see

Review tracked changes, comments, hidden text, headers, footers, notes, hidden sheets and links in the native application. Microsoft recommends running Document Inspector on a copy because some removals cannot be restored.

Decide whether comments should be deleted or merely anonymized. A package cleaner can clear a comment author while leaving the comment text, which is useful in some reviews and wrong in others.

## Then inspect the container

For DOCX and ODT, check author and company fields, custom properties, revision-save identifiers, thumbnails and the metadata inside embedded images. For PDF, check the info dictionary and XMP. For images, check EXIF including GPS, XMP, comments and local C2PA manifests.

C2PA soft binding can survive because the matching fingerprint may live on a remote service. Removing the embedded credential verifies only that the local note is gone.

## Verify the exact delivery artifact

Reopen the cleaned output, confirm it still renders and behaves correctly, then reinspect it. Compare the findings and action list. Lossless image handling should not re-encode pixels; document cleaning should not rewrite paragraphs, tables or styles.

Check the final filename, archive, email subject and share-link permissions. Those operational surfaces can disclose more than the metadata you just removed.

## Keep a minimal handoff record

Record the client, file type, reviewer, inspection date, named actions and delivery outcome. Reference the approved storage location rather than attaching another copy to a tracking sheet.

If a format cannot be cleaned completely, stop and escalate. A clearly refused file is safer than a partial clean that the team represents as complete.

## Questions

### Is Microsoft Document Inspector enough for a DOCX?

It is the right first pass for Word content and personal information. A package-level check adds revision identifiers, thumbnails and metadata inside embedded images, so use both for a client-delivery workflow.

### Should the document title always be removed?

No. A title may be intentional client content. Agree the rule first; Gifi preserves the title while clearing author and company fields.

### Does stripping metadata change the file’s authorship?

No. It changes the delivery artifact, not who created the work or what must be disclosed.

## Primary sources

- [Microsoft Document Inspector guidance](https://support.microsoft.com/en-us/office/collab-files/remove-hidden-data-and-personal-information-by-inspecting-documents-presentations-or-workbooks)
- [ECMA-376 Office Open XML standard](https://ecma-international.org/publications-and-standards/standards/ecma-376/)
- [C2PA specifications](https://spec.c2pa.org/specifications/)