A nanopublication is protected when its publication info types the nanopublication itself as npx:ProtectedNanopub. This has to be a type of the nanopublication, not a \"nanopublication type\" annotation of the kind used for classifying content: registries check the former and ignore the latter, so a nanopublication that only looks protected would be sent to the public network.

Nanodash adds the marker through a checkbox in the publish form, offered only when the instance it runs on is a local one. Where a form is opened on a protected nanopublication, or uses a protected template, the box is ticked and cannot be cleared, so nothing protected can leak through a copy.