tl;dr: Every time someone uploads a PDF to a Google Drive folder, this n8n workflow automatically creates two secured versions: one with a diagonal "CONFIDENTIAL" watermark, one password-protected. Both are saved back to Drive. No code, no manual steps, no re-uploading. It runs in the background, every minute, forever.
Most teams have a document problem they don't even recognize as one yet.
Someone exports a contract as PDF. Sends it to a colleague to review. That colleague pastes it into an email without a watermark. Someone forwards it externally. Now your internal draft is sitting in a client's inbox with no indication that it was never meant to leave the building.
The fix isn't a policy memo. It's automation.
In this post I'll walk you through a concrete n8n workflow that watches a Google Drive folder and automatically produces a watermarked and a password-protected version of every new PDF that lands there. Using Autype for the document processing and the n8n Google Drive Trigger, the whole thing takes about 10 minutes to set up and then runs completely hands-free.
This is part of an ongoing series on document automation with n8n and Autype. More workflows are coming.
The Problem with Manual Document Security
Watermarking a PDF manually is a solved problem in the same way that manually backing up files is a solved problem: technically feasible, practically never done consistently.
You need a PDF editor. You open the file. You add the watermark. You export again. You remember to also add a password. You do this for every document. Every time. Or you don't, and you hope nothing goes wrong.
The real cost isn't the 3 minutes per document. It's the 100% probability that someone on your team skips it eventually because they were in a hurry, because they forgot, or because nobody told them the process changed.
Automation removes the human variable. If the workflow runs, the file is secured. No exceptions.
What the Workflow Does
The workflow triggers automatically whenever a new PDF appears in a watched Google Drive folder. From there:
- The PDF is downloaded and uploaded to Autype´s Document API (a single upload, the file ID is reused by both branches)
- In parallel, two operations run:
-
Watermark branch: a diagonal "CONFIDENTIAL" stamp is applied and the result is saved back to Drive as
filename-watermark.pdf -
Protection branch: the PDF is encrypted with a user password and an owner password, then saved as
filename-protected.pdf
-
Watermark branch: a diagonal "CONFIDENTIAL" stamp is applied and the result is saved back to Drive as
Both outputs land in the same Google Drive folder within seconds. The original file stays untouched.
The parallel structure matters here: instead of watermarking first and then re-uploading the watermarked file for protection (which adds a full round-trip), both operations work from the same uploaded file ID simultaneously. The result is faster and cleaner.
Setting It Up
You need three things before you start:
- A self-hosted n8n instance
- An Autype account with an API key (free tier works)
- The
n8n-nodes-autypecommunity node installed via Settings > Community Nodes
Step 1: Google Drive Trigger
Set the trigger to watch a specific folder for the fileCreated event. Replace YOUR_FOLDER_ID with the ID from your folder URL (https://drive.google.com/drive/folders/YOUR_FOLDER_ID). The trigger polls every minute by default.
Step 2: Download and Upload to Autype
After the trigger fires, a Google Drive node downloads the file binary. That binary goes straight into the Autype File Upload node. The upload returns a file ID that both parallel branches use.
Step 3: Watermark Branch
The Add Watermark node takes the file ID and stamps "CONFIDENTIAL" diagonally across every page at 30% opacity, 45-degree rotation, font size 50. All of this is configurable.
The output binary goes directly to a Google Drive upload node. The filename is derived from the original using an n8n expression:
{{ $('Download PDF from Drive').item.json.name.replace(/\.pdf$/i, '') }}-watermark.pdf
No Code node needed. Just an expression in the filename field.
Step 4: Protection Branch (runs in parallel)
The Password-Protect node uses the same Autype file ID from the upload. It encrypts the PDF with a user password (required to open) and an owner password (required to change permissions or print).
Same filename expression, different suffix:
{{ $('Download PDF from Drive').item.json.name.replace(/\.pdf$/i, '') }}-protected.pdf
Both branches save their outputs to the same Google Drive folder as the original. Three files in, three files out.
You can find the full workflow JSON here: Get Workflow JSON
What You Can Customize
This workflow is deliberately minimal. Here's where to extend it:
- Change the watermark text to your company name, "DRAFT", "INTERNAL USE ONLY", or anything else
- Adjust watermark style (opacity, rotation, font size) directly in the Autype node parameters
- Use separate input and output folders if you want to keep the originals in one place and the secured versions somewhere else
- Add a compression step before the Drive upload to keep file sizes manageable for email workflows
- Replace the Google Drive Trigger with a webhook, an email trigger, or a Slack event if your documents arrive through a different channel
More Document Automation Ideas (This Is Just the Start)
Document automation goes much further than watermarking and password protection. Here's a quick list of what's possible once you have a setup like this:
- Merge multiple PDFs into one consolidated report, strip cover pages, and compress the result
- Replace placeholders in Word templates with data from a form or database, convert to PDF, and send via email
- Auto file conversions (DOCX to PDF, PDF to images, images to PDF) triggered by uploads to a folder
- Split PDFs by page range and distribute sections to different recipients automatically
- Convert PDF pages to images and embed them in a generated summary document
- Bulk-generate personalized documents from a JSON dataset (invoices, certificates, contracts) in a single workflow run
- Trigger document generation from an AI agent that decides format and content based on user input
- Backups and redundancy (copy new uploads to S3, a second Drive, or a write-only archive folder)
- Versioning (write back files with timestamps, keep a changelog file, or automatically move old versions into an archive)
- Archiving (auto move secured PDFs to an archive folder after X days, or after a signature step completes)
All of this is doable with n8n and Autype today. I'll be publishing document Automation workflows in this series.
Automation doesn't have to be a big infrastructure project. A single workflow that runs in the background and handles one repetitive task correctly, every time, is already a significant win. Start with the thing that's most likely to slip through the cracks, secure your documents automatically, and build from there.
The barrier is lower than you think. The habit is what takes time to build.
Have questions about the workflow or want to share what you built? Drop a comment below.
Top comments (3)
hy
x
s
Some comments have been hidden by the post's author - find out more