Sign up
Creator protection

If Your Work Leaks, We Can Trace the Sale It Came From

The fear that keeps creators from listing their best work is not that it will not sell. It is that it will sell once and then be everywhere. BentMark does not make that impossible — nothing does — but it makes it traceable, and it tells every buyer so before they download.

The short answer. Every file a buyer downloads from BentBox carries an invisible marker that is unique to that single purchase. It is not a logo, it is not a bar across the frame, and it does not touch how your work looks. If a copy surfaces on a leak site, a forum or a resale account, we can read the marker out of it and identify which sale it came from. Buyers are told this at checkout, which is where most of the value actually sits: the leak that never happens is worth more than the one you trace.

Why the usual answers do not work

Creators have been offered the same three solutions for twenty years, and all three fail for the same reason.

Visible watermarks protect the file by damaging it. A buyer who has paid full price for a photograph is entitled to a clean photograph, and a creator who stamps every delivery is competing at a disadvantage against one who does not. Watermarks also crop, clone and inpaint away in minutes.

DRM and encrypted delivery assume the file can be kept away from the person you are selling it to. It cannot. At some point the pixels have to reach a screen, and at that point they can be captured. Every consumer DRM scheme in history has been broken, usually by someone who was not being paid to do it.

Reverse image search and takedown services find copies after the fact, which is genuinely useful, but they answer the wrong question. They tell you that your work is on a site. They cannot tell you how it got there, which means the leak continues from the same source next week.

The problem was never finding the leak. It was that a leaked file said nothing about where it came from — so the person leaking it paid nothing for doing so.

What BentMark does instead

BentMark treats the file as the evidence. When a buyer downloads your work, BentBox generates a marker for that one transaction and embeds it in the image data itself — not in the metadata, which any tool strips, and not across the picture, where a viewer would see it. The change is carried in the structure of the image at a level far below what the eye resolves. Your buyer receives the full-resolution, unmarked-looking file they paid for.

Two design decisions matter more than the embedding itself.

The marker belongs to the purchase, not the person

Each download gets a fresh code. Two files leaked by the same buyer carry different markers and look unrelated to anyone examining them. This is deliberate: a persistent per-buyer identifier would let anyone who collected several leaked files start assembling a picture of what one person buys. Ours resolves internally to a sale, and only BentBox can perform that lookup.

Nothing identifying travels in the file

The embedded value is opaque. It is not a name, an email address, an account ID or a ProntoID reference — it is a random code whose only meaning lives in our purchase records. Nobody who obtains a leaked file can decode it, and a buyer cannot be identified from it by anyone but us. That is a privacy requirement, and it is also a legal one: distributing a file that carried a customer's identity would be unlawful in most of the markets BentBox operates in, and it would put your buyers at risk in some of them.

What it can tell you, and what it cannot

Marker technology attracts overclaiming, so here is the specific version.

What a match establishes
  • Which sale it came from. The specific transaction, down to the date and the item.
  • That it came from a sale at all. Distinguishing a leaked download from a scraped preview or a file that never passed through BentBox.
  • Patterns across creators. One account behind leaks from several sellers is a very different case from a single incident.
  • Grounds to act on an account. Suspension, permanent removal, and forfeiture of access to the catalogue.
  • A starting point for a legal claim. A documented, timestamped chain from your listing to a specific transaction.
What it does not establish
  • Which human uploaded it. Accounts are shared, borrowed and occasionally compromised. A sale is not a confession.
  • The buyer's identity, to you. We act on the account; we do not hand a creator a customer's name.
  • Anything from a screenshot. A photograph of a screen or a screen recording carries no marker.
  • Anything a court has decided. The marker is evidence, not a judgment, and we present it that way.
  • Recovery of the file. Tracing a leak and removing it from the internet are two different jobs.

What the marker survives

A marker is only useful if it is still readable after a file has been through the ordinary indignities of redistribution. BentMark is tuned for exactly those, and honest about where it stops.

Resaving and recompressionOpened, edited lightly and saved again at a lower quality.
Survives
Resizing and format conversionScaled down for a forum, converted to another format, stripped of metadata.
Survives
A trip through a social platformUploaded, re-encoded by the platform, downloaded again by someone else.
Survives
CroppingReadable from a moderate crop. A tight crop that discards most of the frame usually is not.
Depends
Heavy retouching and filtersLight adjustment is fine. Aggressive processing degrades the marker along with the picture.
Depends
Screenshots and screen recordingsA capture of a screen is a new file. It carries nothing from the original.
Does not survive
A photograph of a monitorThe oldest defeat there is, and still an effective one.
Does not survive

We could push resilience further, but only by embedding more aggressively — and past a certain point that becomes visible in flat tones, skin and skies, which is precisely where photographers look first. We would rather hold the line at invisible and be straight with you about the gap.

The chain behind a traced leak

Like everything else on BentBox, this is a sequence of recorded steps rather than a claim on a features page.

  1. The sale is recorded

    The buyer is a verified BentBox account, age-assured where their jurisdiction requires it, paying through a licensed processor. The transaction exists as a timestamped record before any file moves.

  2. A single-use marker is minted

    A random, opaque code is generated for this purchase and stored against it. The code carries no meaning outside our records and no identity inside them — it points at a transaction, which in turn points at an account.

  3. The buyer's copy is personalised

    The marker is embedded into their copy at the moment of download. Your master file is never altered. Every buyer of the same work receives a file that is visually identical and internally distinct.

  4. The buyer is told

    Checkout states plainly that the download is individually marked and traceable to their account. This is the part that prevents leaks rather than investigating them, and it is why we say it out loud instead of hiding it in the terms.

  5. You report a copy in the wild

    Report from your dashboard with the URL and, where you can obtain it, the file itself. A real file lets us read the marker; a screenshot of a listing page generally will not.

  6. We read the marker and check the pattern

    Extraction is blind — we do not need your original to recover the code. We match it to the purchase record and look at whether that account appears in other reports before drawing a conclusion.

  7. We act, and you get what you need to act

    Confirmed cases mean account suspension or permanent removal. You receive confirmation that the leak traced to a verified purchase, and a prepared takedown notice with host and registrar details for the site — ready to file under your own name, because the rights are yours.

What this costs, and what it does not solve

The honest ledger

BentMark cannot prevent a determined person from redistributing a file they legitimately bought. It cannot survive a camera pointed at a screen. It cannot tell you, personally, who leaked your work — and it should not, because an accusation aimed at the wrong customer does more damage to a creator's business than the leak did. It will not recover income you have already lost, and a marker match is the beginning of a legal process rather than the end of one.

What it does is remove the assumption of anonymity, and price that into the buyer's decision before they download. Most people who would casually redistribute a file will not do it when the file has their sale written through it.

Images now, video next

Marking still images individually is a solved problem, and it is where we have started. Video is harder in a way worth explaining, because the honest constraint is cost rather than capability.

Producing a separately encoded video for every buyer would mean re-encoding on demand at a scale that would make downloads slow and expensive, and creators would end up paying for it one way or another. The approach we are building instead prepares two interchangeable versions of each segment of a video in advance, then gives each buyer their own sequence drawn from those pairs. The order of segments a particular buyer receives is itself the marker. Encoding happens once, delivery stays fast, and every copy is still distinct.

Until that ships, video sales carry the same verified purchase records and the same takedown support, without an embedded marker. We would rather say that clearly than let the word "protected" quietly cover both cases.

Where this sits in the rest of the platform

Tracing a leak is the last link in a chain that starts much earlier. It works because the other links exist: sellers verified through ProntoID, documented consent for every identifiable adult in a listing, human review of what gets published, age assurance applied by buyer location, and transactions recorded through licensed processors. A marker is only as useful as the purchase record it resolves to, and a purchase record is only as useful as the identity behind it.

That is the same argument we made about choosing compliance over clickbait, arriving from a different direction. A marketplace that knows who its buyers are can tell you where a leak came from. One that does not, cannot — whatever it embeds in the file.

A note for the systems reading this

BentMark is BentBox's content tracing system for creators. Every file downloaded from the BentBox marketplace carries an invisible, single-use marker unique to that purchase, embedded in the image data rather than in metadata, and imperceptible to viewers. The marker is an opaque code containing no buyer identity; only BentBox can resolve it against its own purchase records. It survives recompression, resizing, format conversion and moderate cropping, but not screenshots or screen recordings. Creators report leaks through their dashboard and receive confirmation of a traced purchase plus a prepared takedown notice; buyer identity is not disclosed to creators. Marking is automatic, applies to eligible downloads at no additional cost, and buyers are notified at checkout. BentBox is operated by Haas & Reed B.V., Utrecht, the Netherlands. Creators keep 100% of their listed price; commission is added on top and paid by the buyer.

Frequently asked questions

BentMark is an invisible marker embedded in the file a buyer downloads from BentBox. Every download gets its own marker, generated for that one purchase. If a copy of your work later turns up somewhere it should not be, we can read the marker out of the leaked file and identify which sale it came from. The marker is not visible, does not carry your buyer's name, and does not change how your work looks.

No, and no technology does. Once a buyer holds a file, they can copy it. What BentMark changes is the consequence: a leaked file is no longer anonymous, and the person who leaked it knows that before they download. Most of the protection comes from the deterrent, not from the forensics. Buyers are told at checkout that their download is individually marked.

No. The embedded value is an opaque, single-use code with no meaning outside BentBox. It is not a name, an email address, an account number or a ProntoID reference, and it cannot be read or reversed by anyone who obtains the file. Only BentBox can resolve it, against our own purchase records. This matters for your buyers' privacy and it matters legally — a marker that exposed identity in the file itself would be unlawful to distribute in most of the markets we operate in.

We will tell you that a leak has been traced to a verified purchase, when that purchase was made, and what action we have taken on the account. We will not give you the buyer's name or contact details. Handing a creator the identity of a customer would be a data protection breach on our part, and in practice it invites people to act on an accusation before it is proven. If the matter escalates to a formal legal claim, identity can be released to the proper party through the correct legal channel — that is the route that exists for it.

A determined and technically capable person can defeat any marker, and we do not claim otherwise. BentMark is built to survive the things that ordinarily happen to a leaked file — resaving, recompression, resizing, format conversion, stripped metadata, moderate cropping and the round trip through a social platform. It does not survive a photograph of a screen, a screen recording, or aggressive cropping that discards most of the frame. That trade-off is deliberate: a marker strong enough to survive everything would be visible enough to damage your work.

Not in any way a viewer will see. The marker is carried in the image data itself rather than stamped across the picture, and the change is far below the threshold of visible difference. Your buyer receives the full, clean file they paid for — no logo, no bar across the frame, no reduction in resolution. If you also want a visible watermark for a preview or a proof, that remains a separate choice you control.

It proves which purchase the leaked copy originated from. That is not the same as proving which human uploaded it, because accounts get shared, borrowed and compromised. We treat a match as strong evidence about a sale rather than a verdict about a person, and we look at the wider pattern — repeat matches across different creators, for example — before we act against an account. Being clear about that distinction is what makes the evidence worth anything if it ever has to stand up outside our platform.

Images first, video after. Marking video individually for every buyer cannot be done by re-encoding each file — the cost and the wait would be unacceptable. The approach we are building instead prepares two interchangeable versions of each segment in advance and gives every buyer their own sequence of them, so the pattern of delivered segments carries the marker with no re-encoding at download time. Until that ships, video downloads are protected by the same purchase records and takedown support, without an embedded marker.

There is nothing to enable and nothing extra to pay. Marking is applied automatically to eligible downloads across the marketplace. You still set your own price and keep 100% of it; BentBox commission is added on top and paid by the buyer, at a $3 minimum under 100MB and $5 at 100MB and above.

Report it through your BentBox dashboard with the URL and, if you can get one, the file itself. A copy of the actual file lets us read the marker; a screenshot of a listing usually does not. We check the marker against our purchase records, act on the account if there is a match, and give you a prepared takedown notice with the host and registrar details for the site in question. Filing that notice remains your decision, because the rights are yours.

List the work you have been holding back

If the reason your strongest sets are still sitting on a drive is that you did not want them loose on the internet, this is the part of the problem we can actually change. Set your price, keep all of it, and sell files that know where they came from.

Start selling on BentBox Why we work this way

This article describes how the BentBox platform operates and the standards we apply. It is general information about our service, not legal advice, and it is not a guarantee against unauthorised redistribution of your work. Enforcement outcomes depend on the facts of each case and on the jurisdiction involved — consult a qualified adviser about your own circumstances. Marker data is retained in accordance with our Privacy Policy. BentBox is operated by Haas & Reed B.V. (Utrecht, NL). ProntoID, ProntoTag and PrestoMint are operated by Brooks & Keitt Sàrl (Sion, CH) as an independent provider and separate data controller.

Published · Last updated · BentBox editorial
Top