How Financial Firms Control Access to Earnings Previews and Analyst Reports

Financial information has a shelf life measured in hours. An earnings preview distributed to a limited set of institutional investors 24 hours before public release is entirely normal and legal — provided access is controlled, documented, and revoked before the information goes public. The same document circulating 25 hours later is a compliance failure.

This time-sensitivity is what makes standard document distribution inadequate for pre-release financial content. Email attachments don’t expire. Shared drive links persist after the distribution window closes. Screen recordings of secure portals are indistinguishable from any other screen recording.

The Regulatory Dimension

SEC Regulation FD (Fair Disclosure) requires that when a public company discloses material nonpublic information to certain individuals, it must make simultaneous public disclosure. The practical implication for investor relations teams is that pre-release distribution to institutional investors must be documented and the information must become public before or at the same time the recipients act on it.

DRM doesn’t make a selective disclosure compliant — that’s a legal and process question. What it does is give compliance teams a technical record of who accessed what, and when access was revoked relative to the public disclosure event.

For firms on the buy side — hedge funds, asset managers, family offices — the concern is different: research that took months to develop should not survive the end of a client relationship. Analyst reports, model assumptions, and thesis documents are proprietary. When an analyst leaves, every document they accessed shouldn’t travel with them on a personal device.

Pre-Release Distribution with Automatic Expiry

A practical setup for managing earnings previews:

1. IR prepares the earnings document as a PDF
2. The document is encrypted through MoatGoat and distributed to the approved investor list
3. The distribution key is configured to expire at the time of the earnings release
4. After that moment, the document is unreadable on all devices, including those of recipients who never opened it

The expiry is enforced by the key server, not by the file itself. There’s no “work around” available to the recipient because the decryption key simply stops being served. The file they have is unreadable ciphertext.

This is meaningfully different from a portal with a session timeout. A portal can be screenshotted during the session. A protected PDF that no longer decrypts provides no usable content after expiry — even a screenshot of the open document would capture only the visible page at the time the screenshot was taken.

Research Document Control at Asset Managers

Buy-side research documents present a different challenge: they need to be accessible to portfolio managers and analysts across multiple systems and locations, but the firm wants to ensure they don’t leave the organization’s effective control.

With on-premises DRM, the key server sits on the firm’s infrastructure. A document opened by an analyst in London and a portfolio manager in New York both authenticate against the same key server. Access control policies — who can open which documents, on which devices, with or without printing rights — are centrally administered.

When a researcher leaves the firm, their access is revoked at the key server. Documents they had previously downloaded remain on their devices but become unreadable. No coordinated device-by-device action required.

Audit Trail for Compliance Documentation

Every access event generates a log entry: who authenticated, from which IP address, at what time, which document, and what action (open, print attempt, copy attempt). This audit trail is retained on the firm’s own infrastructure — no access log data lives with a third-party vendor.

For compliance purposes, this means:

• The firm’s compliance team has direct access to access records without submitting a data request to a vendor
• Records are retained according to the firm’s own data governance policies, not a vendor’s default retention period
• In the event of a regulatory inquiry, access logs can be produced without involving a third party

Infrastructure Considerations for Financial Firms

Financial services firms typically operate under strict infrastructure controls: on-premises data centers, dedicated cloud VPCs, or both. MoatGoat’s server component deploys as a single binary with no external dependencies. It runs in air-gapped environments, on private cloud instances, or on colocation hardware.

For firms with SOC 2 or ISO 27001 requirements, the on-premises deployment model means DRM infrastructure is within the firm’s existing compliance scope — not a separate third-party system requiring its own assessment.

Licensing is annual and per-server, not per document or per seat. For high-volume research distribution, this translates to predictable costs regardless of how many documents are protected or how many recipients access them.

---

If you’re evaluating DRM for financial document workflows, contact us or start with a free account to test the full document lifecycle on your own infrastructure.