商业机密保护：合并 PDF 前该先确认的五件事 / Trade Secret Protection: Five Things to Check Before Merging a PDF

一句话结论 / Short answer

商业机密 PDF 合并这件事，判断标准不在工具页面上写了什么保密承诺，而在三件事有没有同时成立：信息本身是不是商业秘密、有没有采取相应保密措施、合并这一步有没有把副本交到别人手上。第一条决定这份文件受不受保护，第二条决定将来能不能主张权利，第三条决定风险是不是还在你自己手里。三条都成立，这份 PDF 才算按商业秘密的规格处理过；少一条，出事时最常听到的那句“我们以为是内部资料”就派不上用场。

Trade secret protection for a PDF merge does not turn on what a vendor page promises about confidentiality. It turns on three things holding at once: whether the information is actually a trade secret, whether reasonable secrecy measures are in place, and whether the merge itself handed a copy to somebody else. The first decides if the file is protected at all, the second decides whether you can assert anything later, and the third decides whether the risk stays on your own machine. All three and the file has been handled to a trade secret standard. Miss one and the sentence that usually comes out in hindsight, that everyone assumed it was internal material, does no work.

第三条是三条里最容易一次性解决的。文件在浏览器里从头处理到尾、不产生上传，就没有第三方拿到副本这件事，也就没有“能不能主张对方违约”这类要论证的问题。剩下的工作从谈判和取证降级成记录，这也是为什么法务在评估 PDF 工具时，现在往往先问一句“能不能在本机跑完”，再问别的。本地流程的能力边界见 /blog/offline-pdf-merge-limits，零上传是怎么实现的见 /blog/how-zero-upload-pdf-tools-work。

The third one is the easiest to settle in a single move. Process the file in the browser from start to finish and nobody receives a copy, so the question of whether you can claim a breach of contract never arises. What remains is documentation rather than negotiation and forensics, which is why reviewers now ask whether a job can run on the device before asking anything else. The limits of the local route are in /blog/offline-pdf-merge-limits, the mechanics of zero upload in /blog/how-zero-upload-pdf-tools-work.

说明：下面是给工具选型和内部流程用的核对口径，不是法律意见。落到具体责任判断时，以本单位法务或外部律师的意见为准。

哪些 PDF 真的算商业秘密 / What actually counts

商业秘密指的是不为公众所知悉、具有商业价值、并经权利人采取相应保密措施的技术信息、经营信息等商业信息。三个要件缺一个都不算。落到日常文件上，常见的几类是配方与工艺参数、客户名单与报价体系、未公开的财务模型与定价表、正在申请专利前的技术方案、以及带有成本结构的供应商条款。判断标准不看文件名里有没有“机密”两个字，看三件事能否同时证明。

A trade secret is technical or business information that is not generally known, carries commercial value, and is protected by measures its owner actually takes. Drop any one of the three and it is not a trade secret. In day-to-day files the usual candidates are formulations and process parameters, customer lists and pricing structures, unpublished financial models and rate cards, technical solutions before a patent filing, and supplier terms with cost breakdowns. The test is not whether the file name says confidential, it is whether all three elements can be evidenced.

中文语境里还有一条容易被忽略的口径差别。“商业秘密”是《反不正当竞争法》下的概念，保护的是经营信息和技术信息；含个人隐私的个人信息走的是《个人信息保护法》那一套，两套规则的义务主体和举证方式都不一样。同一份员工名册可能同时落进两边：姓名与身份证号按个人信息处理，附着在上面的薪酬结构按商业秘密处理。上一轮 GDPR 的同款骨架见 /blog/gdpr-compliant-pdf-tools，个保法那八项见 /blog/china-pipl-pdf-tools-requirements。

One distinction gets missed in Chinese practice. Trade secrets sit under the Anti-Unfair Competition Law and cover business and technical information, while personal information runs under the Personal Information Protection Law with different duty holders and different burdens of proof. The same staff roster can fall into both: names and ID numbers are handled as personal information, the salary structure attached to them as a trade secret. The GDPR version of this checklist is in /blog/gdpr-compliant-pdf-tools and the eight PIPL items in /blog/china-pipl-pdf-tools-requirements.

常见的商业秘密形态，按举证难度从低到高排

• 技术类：工艺参数表、配方、图纸、未公开的测试结果报告
• 经营类：客户名单（含成交价与联系人）、渠道政策、投标底价表
• 财务类：未审计的合并报表草稿、成本模型、定价策略文件
• 法务类：并购尽调材料、未公开的合同条款、诉讼策略备忘录
• 人事类：薪酬带宽表、股权激励池分配方案

Four places a PDF hides the origin of a secret

• Metadata: author, company and edit history often reveal who worked on it and when
• Comments and layers: review notes that never made it into the final text
• File names and folder paths: a customer code or a project codename sitting in the path
• Scanned pixels: letterheads, seals and handwritten margins that no text search finds

合并会让范围判断变麻烦，这一点和元数据的问题叠在一起。两份单独看都只是普通技术参数的 PDF，合成一份后可能凑出完整的工艺窗口；而合并后的文档信息字典只留一套值，原来那份“谁在什么时候改的”痕迹可能被覆盖，也可能被留下。各层元数据在一次合并里的实际表现见 /blog/pdf-metadata-preservation-merge。

泄密发生在哪三个环节 / Where it actually leaks

多数人把注意力放在“对方会不会偷看”，实际出问题的位置通常在别处。把一次合并拆成三个环节，各自的风险点不一样。

Most attention goes to whether the far side will read the file. Where things actually go wrong tends to be elsewhere. Split one merge into three stages and each has its own risk.

第一行决定了后两行的难度。从来没有文件离境，第二、三行从“要对方承诺并取证”变成一句陈述。日志和临时文件这类细节，架构上的差别见 /blog/client-side-vs-server-side-pdf-tools，怎么自己验证见 /blog/devtools-network-tab-privacy-guide。

Row one sets the difficulty of the other two. When nothing leaves the device, rows two and three collapse from something you have to extract a promise and evidence for into a single statement. The architectural difference on logs and temp files is in /blog/client-side-vs-server-side-pdf-tools, and how to verify it yourself in /blog/devtools-network-tab-privacy-guide.

第三个环节最容易被忽略，因为它是唯一一个本地工具也需要自己处理的。合并完导出前，元数据、批注层、隐藏图层和文件名都还带着原来的信息。这一步和上传与否无关，属于谁都要做的收尾。

五件事检查清单 / Five checks

下面这张表按顺序列出检查项、通过的样子和一眼能看出来的不合格信号。第三列最有价值，因为供应商和内部流程的回答在这些地方通常含糊，而含糊本身就是答案。

The table lists each check, what passing looks like, and the signal that fails it at a glance. The third column earns its keep, because vague answers cluster there and vagueness is itself an answer.

第五行在实务中最常出问题，也最好补。把分级、路径和留痕写进一页纸的操作规范，成本很低，覆盖面却比事后追责大得多。责任边界怎么划见 /blog/personal-pdf-privacy-vs-enterprise-saas。

Row five is where practice most often fails and where the fix is cheapest. One page of procedure covering classification, routing and logging costs very little and reaches further than any retroactive conversation. Where the responsibility boundary sits is in /blog/personal-pdf-privacy-vs-enterprise-saas.

当天能跑的本地流程 / A workflow you can run today

把下面七步固定下来，一次做完，最后那页记录可以直接进供应商清单和内部保密制度档案。前三步解决“是不是”和“怎么保”，后四步解决“能不能拿出证据”。

Fix these seven steps once and the last page becomes the record that goes into the vendor list and the internal secrecy policy file. The first three settle whether the material qualifies and how it is protected; the last four settle whether evidence exists.

1. 给待合并的文件定性：商业秘密、个人信息、普通内部资料，结果写进清单或文件名
2. 确认保密措施到位：分级标识、访问范围、保密义务签署记录三项都能出示
3. 选处理方式：能在浏览器里跑完的工具，最先钝掉的上传、日志、残留三项直接变成零风险项
4. 需要外部协作时先补书面约定，别在导出前临时联系对方
5. 本地完成合并与页序调整，过程和结果都不经过第三方服务器
6. 导出前清一遍元数据、批注层和隐藏图层，文件名去掉客户代号与项目代号
7. 把以上六条连同文件用途、经手人和保存期限签在同一页纸上归档

1. Classify the files: trade secret, personal information, or ordinary internal material, and write it into the manifest or file name
2. Confirm the measures exist and can be produced: classification marking, access scope, signed confidentiality undertakings
3. Decide how it gets processed; a browser-local tool turns upload, logging and residue into non-issues first
4. Put any written agreement in place before external collaboration, not at export time
5. Merge and reorder locally, with neither the process nor the result passing through another server
6. Before exporting, clear metadata, comment layers and hidden layers, and strip customer or project codes from the file name
7. Sign all six items with purpose, handler and retention period on one page, then file it

合并这一步在 pdfmergenext.shop 全程本地完成，挑页码和调页序都不需要把含商业秘密的文件交出去。这也是为什么本地工具和需要上传的工具不该放在同一张表上逐项比：前者在上传、日志、残留三行直接空着。挑页语法见 /blog/pdf-page-selection-1-3-5-syntax，上一轮 HIPAA 的同款清单见 /blog/hipaa-compliant-pdf-merge。

Merging on pdfmergenext.shop happens entirely on your device, so selecting pages and reordering never means handing a file containing trade secrets to anyone. That is why local and upload-required tools do not belong in the same comparison grid: the upload, logging and residue rows are simply blank for the local route. Page selection syntax is in /blog/pdf-page-selection-1-3-5-syntax and the HIPAA version of this checklist in /blog/hipaa-compliant-pdf-merge.

更多 PDF 工具合规与隐私的判断细节见 /blog，医疗场景同时要对齐的要求见 HIPAA 合规 PDF 合并，个保法的八个核对点见 个保法下的 PDF 工具要求。