diff --git a/Gemfile.lock b/Gemfile.lock
index 92ff8bfc580..5732f5f2da6 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -197,6 +197,10 @@ GEM
       multi_json (>= 1.3)
       rake
     execjs (2.8.1)
+    exiftool (1.2.4)
+      json
+    exiftool_vendored (12.60.0)
+      exiftool (>= 0.7.0)
     factory_bot (6.2.0)
       activesupport (>= 5.0.0)
     factory_bot_rails (6.2.0)
@@ -694,6 +698,7 @@ DEPENDENCIES
   devise-security (~> 0.16.0)
   email_spec (~> 2.2.0)
   erb_lint (~> 0.3.1)
+  exiftool_vendored (~> 12.60.0)
   factory_bot_rails (~> 6.2.0)
   faker (~> 2.22.0)
   file_validators (~> 3.0.0)
diff --git a/Gemfile_custom b/Gemfile_custom
index fe5bf841827..27ce20b120f 100644
--- a/Gemfile_custom
+++ b/Gemfile_custom
@@ -24,4 +24,5 @@
 #
 # Add your custom gem dependencies here
 
+gem "exiftool_vendored", "~> 12.60.0"
 gem "ruby-ntlm", "~> 0.0.4"
diff --git a/app/models/document.rb b/app/models/document.rb
index 9a48ed6150f..8541b160f35 100644
--- a/app/models/document.rb
+++ b/app/models/document.rb
@@ -11,6 +11,8 @@ class Document < ApplicationRecord
 
   scope :admin, -> { where(admin: true) }
 
+  before_save :remove_metadata
+
   def self.humanized_accepted_content_types
     Setting.accepted_content_types_for("documents").join(", ")
   end
@@ -36,4 +38,14 @@ def association_name
     def documentable_class
       association_class
     end
+
+    def remove_metadata
+      return unless self.attachment.attached?
+      attachment_path = ActiveStorage::Blob.service.path_for(self.attachment.key)
+
+      Exiftool.new(attachment_path, "-all:all=")
+      self.attachment.attach(io: File.open(attachment_path), filename: self.attachment.filename.to_s)
+    rescue Exiftool::ExiftoolNotInstalled, Exiftool::NoSuchFile
+      nil
+    end
 end