Company PDFs, local crypto, honest limits
Invoices, contracts, board financials, discovery exhibits. Same AES/RC4 pdf-lib path. If DLP forbids browsers, stop. If DLP forbids unknown SaaS processors, Instant is the better fit than an upload locker.
Email forwarding
A locked PDF still forwards. The passphrase is the gate. Rotate it if the wrong person received it. Keep unlocked masters in your records system, not in the same inbox.
Huge archives
100 MB+ and folder-scale locks are Premium. The crypto is still local pdf-lib, not a VPS OCR job.
Employees who forget
No recovery. Internal procedure: retain an unlocked original in a vault you already trust.