One or more non-transitory computer-readable media storing computer-executable instructions configured to program one or more computing devices to perform operations comprising: when a document is created on a client device, configuring the document to send a report to the one or more computing devices indicating that the document is opened on an opening device, the report indicating identifying information of the opening device including at least one of a network address of the opening device or a geographic location of the opening device, wherein the configuring includes embedding a link in the document that causes a request to be submitted to a monitored network address when the document is opened and the link is clicked, wherein the link embedded in the document is configured to cause the report to be sent to the monitored network address (128, 130), wherein the document is configured to cause the request to be submitted to the monitored network address only when the determined network address or geographic location of the opening device differs from a predefined expected network address or a predefined expected geographic location; receiving the report; determining that the network address or the geographic location in the report does not match the predefined expected network address or the predefined expected geographic location; determining that the identifying information in the report corresponds to an unauthorized entity, based on the determination that the network address or the geographic location in the report does not match the predefined expected network address or the predefined expected geographic location; and in response to determining that the identifying information in the report corresponds to an unauthorized entity, sending an alert to an entity associated with the document indicating that the unauthorized entity has possession of the document. when a document is created on a client device, configuring the document to send a report to the one or more computing devices indicating that the document is opened on an opening device, the report indicating identifying information of the opening device including at least one of a network address of the opening device or a geographic location of the opening device, wherein the configuring includes embedding a link in the document that causes a request to be submitted to a monitored network address when the document is opened and the link is clicked, wherein the link embedded in the document is configured to cause the report to be sent to the monitored network address (128, 130), wherein the document is configured to cause the request to be submitted to the monitored network address only when the determined network address or geographic location of the opening device differs from a predefined expected network address or a predefined expected geographic location; receiving the report; determining that the network address or the geographic location in the report does not match the predefined expected network address or the predefined expected geographic location; determining that the identifying information in the report corresponds to an unauthorized entity, based on the determination that the network address or the geographic location in the report does not match the predefined expected network address or the predefined expected geographic location; and in response to determining that the identifying information in the report corresponds to an unauthorized entity, sending an alert to an entity associated with the document indicating that the unauthorized entity has possession of the document.