--- title: "How to Run a Closed Playtest Without Leaks (NDAs Alone Fail) in 2026" lang: en canonical_url: https://www.peony.ink/blog/closed-playtest-security description: "Riot Games uses Peony for playtests. I explain why NDAs fail and how to gate, trace and spot leaks, with lessons from Battlefield and Diablo IV." date: "2026-11-04T12:00:00.000Z" last_updated: "2026-11-04T12:00:00.000Z" author: "Deqian Jia" --- > **TL;DR:** An NDA alone will not keep a closed playtest private. Battlefield Labs testers agreed to NDAs, and PC Gamer still saw "substantial leaks of every single one" of the tests ([PC Gamer, Aug 2025](https://www.pcgamer.com/games/fps/ea-tells-battlefield-labs-testers-not-to-leak-battlefield-6s-new-big-maps-playtest-so-of-course-they-leaked-it-immediately)). Steam Playtest is not confidential by default: Valve says players "aren't under nondisclosure agreements with you" ([Steamworks, accessed Nov 2026](https://partner.steamgames.com/doc/features/playtest)). A safer test has three layers, which we call **Gate, Trace, Alert**: limit who gets in, mark every copy per tester, and find out when access looks wrong. Don't count on takedowns: PC Gamer saw leaked Battlefield videos "often stay up for days or weeks," though it noted EA seemed relatively lax about removing them. Courts can help after the fact: a Chinese court ordered two defendants at first instance to pay miHoYo **1M yuan (about $150,000)** over test data, according to miHoYo ([Automaton, Oct 2026](https://automaton-media.com/en/news/honkai-star-rail-leakers-ordered-to-pay-around-150000-in-damages-to-mihoyo-after-distributing-unreleased-game-data-and-assets/)), while a US default judgment over a pre-release stream reached **$16,500** of $156,600 sought ([Game File, Jan 2026](https://www.gamefile.news/p/honkai-star-rail-lawsuit-leaker-ruling)). With the games market forecast at **$213.9B** in 2026 ([Newzoo via MediaNews4U, Sep 2026](https://www.medianews4u.com/global-games-market-to-reach-213-9-billion-as-player-base-hits-3-7-billion-newzoo-report/)), more is riding on each reveal. [Riot Games uses Peony](https://www.peony.ink/solutions/gaming) for playtests: it protects the documents and recordings around the build, from **$52/admin/month** billed yearly, with dynamic watermarks and signed NDAs. _Last updated: November 2026_ I'm Deqian Jia, co-founder of [Peony](https://www.peony.ink/), a data room company used by 8,000+ teams. Riot Games uses Peony for playtests, with thousands of outside participants on one link, so this guide mixes public cases with what we've seen in practice. I have a stake here, because Peony sells part of this setup. A closed playtest is a private test of an unreleased game with invited players, usually under an NDA, run to collect feedback before the public sees it. The hard part is that you are handing unreleased work to strangers, and any of them can point a phone at the screen. ## What is the Gate, Trace, Alert framework? Gate, Trace, Alert is a way to check a playtest for gaps: every leak route should meet a control that limits access, one that identifies the copy, or one that tells you something is wrong. Most leak plans stop at the first layer, and a signed NDA only helps you once you know who to hold to it. | Layer | Question it answers | Controls | What it can't do | | ----- | ------------------- | -------------------------------------------------------------- | ----------------------------------------- | | Gate | Who can get in? | Allow list, email verification, signed NDA, age screen, expiry | Stop an invited tester from filming | | Trace | Whose copy is this? | Per-tester ID in the build, watermarks on documents and video | Prevent the leak, or survive every edit | | Alert | What looks wrong? | Leak monitoring, access alerts, anomaly detection | Prove misuse; alerts are prompts to check | ![The Gate, Trace, Alert framework for closed playtest security, showing the controls in each layer](https://www.peony.ink/images/blog/closed-playtest-gate-trace-alert.png) ## Why do NDAs alone fail to stop playtest leaks? NDAs fail alone because they create liability, not a barrier. Battlefield 6 is the clearest public case: Labs testers agreed to NDAs, and every early test leaked, including one where "a player streamed over 90 minutes" of gameplay ([The Game Post, May 2025](https://thegamepost.com/massive-battlefield-6-labs-playtest-leak-90-minutes-of-gameplay/)). EA's team knew the odds. Technical director Christian Buhl said they chose to put the game in front of players "even though we knew things would leak" ([PC Gamer, Sep 2025](https://www.pcgamer.com/games/fps/battlefield-6-devs-knew-everything-would-leak-from-playtests-but-said-the-risk-was-worth-it-to-get-feedback-from-players-that-had-to-come-at-any-cost)). That is a sensible decision, and it's the first one you should make yourself: how much leak risk will you accept for this test? A live-service shooter at a late stage can absorb a leaked map. An unannounced game with an unrevealed character can't. PC Gamer even argued that [leaks helped build Battlefield 6's hype](https://www.pcgamer.com/games/fps/ea-tells-battlefield-labs-testers-not-to-leak-battlefield-6s-new-big-maps-playtest-so-of-course-they-leaked-it-immediately), so don't assume every leak is a disaster. Some are just early marketing you didn't approve. The NDA still matters, for two reasons. It gives you a contract claim, and it helps show that you took "reasonable measures" under US trade secret law ([18 U.S.C. § 1839](https://www.law.cornell.edu/uscode/text/18/1839)). In 2025, the US District Court for the Eastern District of New York dismissed a trade secret claim where a company alleged multi-factor sign-in and need-to-know access, but no confidentiality agreement or notice ([National Law Review, Mar 2025](https://natlawreview.com/article/court-rejects-dtsa-claim-over-inadequate-efforts-protect-alleged-trade-secrets)). That wasn't a game case, but the lesson carries: controls and paperwork work together. ## What actually leaks from a closed playtest? Five routes account for the public cases I reviewed, and only some of them involve a tester breaking an NDA. | Route | Public example | Best layer | | -------------------------------- | ---------------------------------------------------------------- | ---------------- | | Tester records or streams | Battlefield Labs (2025), Diablo IV via a stream (2022) | Trace | | Recruitment page gives it away | Project Espresso listing (2026), identity unconfirmed by Sony | Gate | | Test data is obtained and shared | Honkai: Star Rail first-instance ruling (2026), route not public | Trace | | Community asks testers for files | HoYoverse's allegations against a wiki operator (2026, pending) | Alert | | Staff or systems are breached | GTA VI (2022): phishing and internal Slack, not a playtest | Security program | Two of these surprise people. The Project Espresso page described an unannounced AAA competitive shooter, and outlets linked it to Fairgame$ even though Sony and Haven haven't confirmed the connection ([Gematsu, Sep 2026](https://www.gematsu.com/2026/09/project-espresso-playtest-sign-ups-open-on-player-gg-seemingly-fairgame); [MP1st, Sep 2026](https://mp1st.com/news/fairgame-secret-closed-playtest-running-as-project-espresso)). A codename doesn't help if the listing's description and video identify the game. And the most famous leak in gaming wasn't a playtest at all: Rockstar has described the 2022 GTA VI breach as phishing that reached material on internal Slack ([Game Developer, Sep 2026](https://www.gamedeveloper.com/production/rockstar-and-fired-gta-developers-outline-core-arguments-during-union-busting-tribunal)). ## How do I set up a closed playtest step by step? Set the leak tolerance first, then build each layer before the first invite goes out. 1. **Set the leak budget.** Decide what can leak without real harm, and cut anything that can't from this build. 2. **Separate the build from the paperwork.** Keep the executable on your distribution channel, and put guides, NDAs and recordings somewhere with viewer-level tracking. 3. **Write a neutral listing.** Reveal genre and hardware needs, and leave out art, video and anything that identifies the game. 4. **Screen and age-gate at signup.** Favour people with a history in your community for the most sensitive builds, collect only what you need, and delete data from anyone who doesn't qualify. 5. **Sign before access.** Valve notes that you'll "need your own solution" if testers must accept an NDA before receiving a key. 6. **Give each tester a traceable copy.** Use a per-player ID in the build and [dynamic watermarks](https://www.peony.ink/features/watermarks) on documents and video. 7. **Set an end date.** Match access to the test window, not the calendar quarter. Use [link expiry](https://www.peony.ink/features/link-expiry) on documents and deactivate the build. Valve warns that "a key, once granted, is not automatically revoked" when a Playtest is marked Not Playable. 8. **Write the leak response in advance.** Name who decides, who contacts counsel and who talks to the community. ## What did we learn supporting closed playtests at scale? Most problems in a large test are operational, and they show up in the first hours. These lessons come from supporting closed tests at scale, along with the fixes I'd recommend to any team. **Load your list early, and count it.** With thousands of emails, a mistyped or partial list stays hidden until players say they're locked out. Load it at least a day before, then check the count against your source. **Send the link in your own invite.** One access link works for everyone on the allow list, so it can sit in your normal playtest email, which keeps support simple. **Test verification email before day one.** Some participants struggled to receive verification emails with email verification turned on. Send a test to a few personal inboxes, tell players to check spam, and keep a fallback ready. **Turn off owner notifications.** A view alert is useful for a sales deck and useless for 3,000 viewers. Turn notifications off, or your inbox becomes the first casualty. **Budget for an extension.** Studies run long when recruiting falls short. Agree in advance how you'll extend access, so that you aren't negotiating it mid-test. **Balance friction with honesty.** Every extra gate costs you participants. If a check doesn't change a decision, drop it, and spend that goodwill on the NDA and the verified email. ## What will your security team ask before approving a playtest? Your security team will ask who can get in, how you'd trace a leak, where the data lives and who responds. Bring this sheet to the first meeting, and most of the review becomes a yes or a no. | Question | What to bring | | ------------------------------ | ------------------------------------------------------------------------------------- | | Who can access the test? | Allow list source, verification method, age screen, NDA version | | Can our own staff use SSO? | [SSO](https://www.peony.ink/features/sso) setup for admins, and who holds admin rights | | How would we trace a leak? | Per-tester ID in the build, [watermarks](https://www.peony.ink/features/watermarks) on documents and video | | How would we notice a problem? | Leak monitoring owner, [anomaly alerts](https://www.peony.ink/features/anomaly-detection), audit trail | | Where does tester data live? | Vendor list, DPA, hosting region, and what each vendor stores | | When is it deleted? | A retention date for recordings and signup data | | Who responds to an incident? | Named owner, counsel on call, and the takedown template | ## What should a playtest NDA include? A playtest NDA should say exactly what's confidential, ban recording and description, and last until you release the content. One public example from a Steam developer has testers agree to "Not post, upload, stream, record, screenshot, share, or describe non-public Game content" ([Steam EULA example](https://store.steampowered.com/eula/4161820_eula_0)). Have counsel check these six points: - **Scope:** the build, documents, feedback channels and anything shown on a call. - **Conduct:** no capture, streaming or discussion, including in private groups. - **Term:** tie it to public release or a written release from you, because two US courts have treated an expired obligation as a sign that the owner stopped protecting a trade secret ([Holland & Knight, Dec 2018, historical anchor](https://www.hklaw.com/en/insights/publications/2018/12/trade-secrets-and-nondisclosure-agreements)). - **Feedback:** say who owns ideas and suggestions, so a tester can't claim a feature later. - **Remedies:** removal from the test, loss of access to future tests, and legal action. - **Age and notices:** an age statement, and any notice your lawyer needs. US trade secret law asks for an immunity notice in agreements with employees and contractors ([18 U.S.C. § 1833](https://www.law.cornell.edu/uscode/text/18/1833)). On Peony's Data Room plan, an [Advanced NDA](https://www.peony.ink/features/nda) records each signature and gives both sides a signed PDF. ## How do I trace a leak back to a tester? Trace leaks by making every copy different. VGC reported that leaked Diablo IV footage carried "numerous watermarks" reading "Private Test Build" along with an ID number ([VGC, Aug 2022, historical anchor](https://www.videogameschronicle.com/news/over-40-minutes-of-diablo-4-gameplay-has-seemingly-been-leaked/)). PlaytestCloud says each player gets "a uniquely fingerprinted version" of the build, and offers user-specific watermarks on recordings. Keep your expectations honest. I found no public case where a studio confirmed tracing a named tester from a watermark, and a visible mark can be cropped or blurred. A watermark raises the risk for the leaker and gives you evidence to pair with access logs. It doesn't prove the case by itself. For more on how marks work, see our [dynamic watermarking guide](https://www.peony.ink/blog/dynamic-watermarking-guide) and why [phone photos of documents](https://www.peony.ink/blog/stop-phone-photos-of-documents) are the hardest route to close. ## What should I do in the first 24 hours after a leak? Preserve evidence, contain access, then take it down. In that order, because a takedown can remove the evidence you need. 1. **Capture everything.** Save URLs, uploader names, timestamps, and any visible ID or watermark. 2. **Contain it.** [Revoke the suspected viewer's access](https://www.peony.ink/features/revoke-access) and check their activity. 3. **Call counsel.** Decide between a takedown, a subpoena and a letter. 4. **Send DMCA notices.** A notice needs a signature, identification of the work, a good-faith statement and a statement under penalty of perjury ([17 U.S.C. § 512](https://www.law.cornell.edu/uscode/text/17/512)). In the Ninth Circuit, you must consider fair use first ([Jones Day, Sep 2015](https://www.jonesday.com/en/insights/2015/09/ninth-circuit-says-fair-use-must-be-considered-before-sending-a-dmca-takedown-notice)). 5. **Identify anonymous accounts if needed.** The same statute allows a subpoena to identify an infringer. Take-Two sought these from Microsoft and Discord in August 2026 ([PC Gamer, Aug 2026](https://www.pcgamer.com/games/grand-theft-auto/take-two-kicks-off-gta-6-leaker-hunt-with-subpoenas-demanding-records-from-microsoft-and-discord/)). 6. **Remove and sanction under your terms.** EA said in 2021 it had "already removed plenty of people" from a Battlefield 2042 test and warned that future game access was at risk ([GamesRadar, Aug 2021, historical anchor](https://www.gamesradar.com/battlefield-2042-players-caught-breaking-tech-test-nda-may-face-permanent-game-ban-ea-warns/)). How far should you go? HoYoverse sits at the far end: it reported civil suits against 2,388 individuals and more than 37M yuan ($5.38M) recovered in 2025, though those figures cover leaks and cheats together ([Outlook Respawn, Mar 2026](https://respawn.outlookindia.com/gaming/gaming-news/hoyoverse-recovers-538m-from-anti-leak-crackdowns-in-2025)). Few studios need that. Rockstar says it employs five full-time investigators and a director to watch for leaks, according to [its tribunal filing](https://www.gamedeveloper.com/production/rockstar-and-fired-gta-developers-outline-core-arguments-during-union-busting-tribunal), in a dispute that remains undecided. Most teams need a clear response plan and a lawyer on call. As for the law itself, I found no US ruling on the merits of a playtest NDA, so nobody can promise how one would hold up. The closest live case is Cognosphere v. Zhou, which includes breach-of-contract claims and hasn't been decided ([Aftermath, Feb 2026](https://aftermath.site/genshin-impact-leak-homdgcat-lawsuit-wiki/)). This guide isn't legal advice. ## What does impossible travel tell you about a playtester? Impossible travel tells you to look closer, and nothing more. Microsoft defines it as activity from "geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second" ([Microsoft Learn, Oct 2026](https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks)). On a playtest, it can point to a shared login or a link passed to a friend. It can also be an honest player on a VPN. Microsoft names VPN activity as a false-positive scenario ([Microsoft Learn, Aug 2026](https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy)), and an academic dataset derived from real impossible-travel alarms includes false alarms from mobile devices ([Roden and Layman, Feb 2020, historical anchor](https://arxiv.org/abs/2002.10530)). A single alert shouldn't lead to a ban. Check it against the viewer's history, and act when several signals agree. Peony's [anomaly detection](https://www.peony.ink/features/anomaly-detection) applies this to shared links, on Enterprise. It emails the link's creator about two accesses by one email within 60 minutes, from different countries or more than 500 km apart, and on visits through VPNs, Tor exit nodes, known proxies and hosting networks. Alerts are best effort and inform rather than block, so your team makes the call and treats the audit trail as the record. ## What privacy rules apply to playtesters? Treat playtest data as personal data from day one, because recordings of a face, voice and screen usually are. GDPR can reach non-EU studios that offer services to people in the EU or monitor their behaviour, whether or not anyone pays ([GDPR Art. 3](https://gdpr-info.eu/art-3-gdpr/)), and it requires data to be kept "for no longer than is necessary" ([GDPR Art. 5](https://gdpr-info.eu/art-5-gdpr/)). So set a deletion date before the test begins. Children are the sharpest risk. COPPA applies when you have actual knowledge you're collecting personal information from under-13s, which can include a recording with a child's image or voice. Penalties run "up to $53,088 per violation" ([FTC, COPPA FAQ](https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions)). Microsoft's $20 million Xbox settlement turned partly on data kept from children's account creation ([FTC, Jun 2023, historical anchor](https://www.ftc.gov/news-events/news/press-releases/2023/06/ftc-will-require-microsoft-pay-20-million-over-charges-it-illegally-collected-personal-information)). In the EU, where you rely on consent for an online service offered to a child, a parent must approve below 16, and member states can lower that to 13 ([GDPR Art. 8](https://gdpr-info.eu/art-8-gdpr/)). An age screen at signup, plus deletion for anyone who fails it, removes most of that risk. ## Which tools handle builds, and which handle documents? Use a playtest platform for the build and a secure sharing tool for the documents and recordings around it. The tools I reviewed focus on build access, recruitment and recording; where documents appear, it's mainly NDA acceptance. | Tool | Best for | Note on confidentiality | | -------------------------- | ------------------------------------------- | ------------------------------------------------------------- | | Steam Playtest | Distributing a build on Steam | Not confidential by default; bring your own NDA step | | PlaytestCloud | Remote research with recorded sessions | Advertises fingerprinted builds, and watermarks on recordings | | Antidote | Studies with chosen distribution channels | Vendor materials mention NDA provision | | FirstLook | Running a test with a player community | Optional NDA acceptance before access | | [Peony](https://www.peony.ink/solutions/gaming) | NDAs, guides, reports and recorded sessions | Per-viewer watermarks, audit trail and access alerts | ## How does Peony fit into a playtest? Peony covers part of each layer for your documents and video, while your other tools handle the build and leak monitoring. Riot Games and 8,000+ teams use it to share confidential files, and viewers are free, so a long tester list doesn't raise the bill. ![A Peony data room showing folders and key files](https://www.peony.ink/hero-dataroom.webp) - **Gate:** [allow lists](https://www.peony.ink/features/security) with CSV import and email verification on [Business ($30/admin/month)](https://www.peony.ink/pricing), and an [Advanced NDA](https://www.peony.ink/features/nda) with a signed PDF on [Data Room ($52/admin/month)](https://www.peony.ink/pricing). - **Trace:** [dynamic watermarks](https://www.peony.ink/features/watermarks) over pages and video on Data Room, with [screenshot protection](https://www.peony.ink/features/screenshot-protection) from Business. - **Alert:** [page-level analytics](https://www.peony.ink/features/page-analytics) on every plan, a full audit trail on Data Room, and [anomaly alerts](https://www.peony.ink/features/anomaly-detection) on Enterprise. - **Your team:** [SAML SSO](https://www.peony.ink/features/sso) with Okta, Azure AD or any identity provider on Enterprise, or Google and Microsoft sign-in on Deal Team. ![Peony analytics showing unique visitors, top visitors and view duration](https://www.peony.ink/analytics.png) Peony has no upload size limit on any plan, so long session captures aren't a problem. Export replays to MP4 with H.264 so they stream in the browser; our [secure video data room guide](https://www.peony.ink/blog/secure-video-data-room) covers the details. The same controls protect [media screeners](https://www.peony.ink/solutions/media) and [M&A data rooms](https://www.peony.ink/solutions/ma), so a studio can run its pitches and any sale from the same account. Peony is SOC 2 Type II-ready and ISO 27001-ready, with both audits underway. ## Bottom line - **Indie test with friends and community:** an NDA, a neutral listing and a short window will do. [Peony Business](https://www.peony.ink/pricing) covers an acknowledge-only NDA and an allow list. Use Data Room if you need signed copies. - **Unannounced game with hundreds of testers:** add per-tester IDs and watermarks. Start on Data Room. - **Thousands of testers and a security team:** add monitoring, anomaly alerts and SSO for your staff, on Enterprise. See [Peony for game studios](https://www.peony.ink/solutions/gaming). If you're also raising money or selling the studio, see our [top gaming investors](https://www.peony.ink/blog/top-gaming-investors) and [game studio due diligence guide](https://www.peony.ink/blog/game-studio-acquisition-due-diligence). ## Frequently Asked Questions ### I'm a user researcher running a closed playtest for 2,000 players. Is an NDA enough to stop leaks? No. An NDA gives you a legal claim, but it doesn't stop a phone camera or tell you who broke it. Battlefield Labs testers agreed to NDAs and every test still leaked. For a 2,000-player test, pair the NDA with an allow list, a per-tester mark on every copy and monitoring. [Peony](https://www.peony.ink/solutions/gaming) adds that layer for playtest documents and recordings: dynamic watermarks and signed NDAs on Data Room ($52/admin/month), which a shared drive doesn't give you. ### Is Steam Playtest confidential for an unannounced game? No, not by default. Valve says players signing up for a Playtest aren't under NDAs with you and there shouldn't be an expectation of secrecy, so you need your own NDA step before you hand out keys. If you're a 10-person studio on Steam, keep Steam for the build and use a tool like [Peony](https://www.peony.ink/features/nda) to collect a signed NDA and share briefing packs with viewer-level tracking, which Steam Playtest doesn't provide for documents. ### How do game studios find out which tester leaked footage? Mostly by marking each copy. Diablo IV's leaked 2022 test footage showed 'Private Test Build' and an ID number, and PlaytestCloud sells per-player fingerprinted builds. I found no public case where a studio confirmed tracing a named tester from a watermark, so treat tracing as evidence rather than a guarantee. For your documents and recorded sessions, [Peony's dynamic watermarks](https://www.peony.ink/features/watermarks) stamp each viewer's identity on the Data Room plan, unlike a shared folder where every copy looks the same. ### We just found our playtest on YouTube. What do we do in the first 24 hours? Save evidence first, then send a DMCA notice, and check fair use before you send it. Record URLs, timestamps and any visible tester ID. Have counsel decide whether to seek a DMCA subpoena to identify an anonymous uploader. If you run a 500-person test on [Peony's Data Room plan](https://www.peony.ink/features/page-analytics), pull that viewer's activity from the audit trail and [revoke access](https://www.peony.ink/features/revoke-access) instead of waiting on a takedown. ### Should our playtest NDA expire when the game launches? End it on an event you control, not a fixed date. Two US courts have treated an expired confidentiality obligation as a sign that the owner stopped protecting a trade secret, and launches slip. A common pattern is an NDA that runs until public release or a written release from the studio, with confidentiality surviving for anything still unreleased. Ask counsel to draft it. On Peony's Data Room plan ($52/admin/month), an [Advanced NDA](https://www.peony.ink/features/nda) gives you a signed PDF for each tester. ### Our security engineer wants impossible-travel alerts on playtest access. Are they useful? Yes, as a prompt to check, not as proof. Microsoft defines impossible travel as activity from distant locations in less time than the trip would take, and its documentation names VPNs as a false-positive source. For a 3,000-player test, a flag helps your engineer spot a shared login. [Peony's anomaly alerts](https://www.peony.ink/features/anomaly-detection) on Enterprise cover two accesses within 60 minutes from different countries or more than 500 km apart, which is how a security team spots access that a plain audit log only shows later. ### Can under-13s join our closed playtest? Avoid it unless you've built for COPPA. If you know you're collecting personal information from children under 13, COPPA applies, and that can include a child's voice or image in a recording. Penalties run up to $53,088 per violation. The simple control for a studio of any size is an age screen at signup and deletion of records from anyone who fails it. Keep recordings in one place with [access you can revoke](https://www.peony.ink/features/revoke-access), as Peony allows, rather than spread across drives. ### Our team signs in with Okta. How do external playtesters get into a Peony room? Through the link. Your staff use [SSO](https://www.peony.ink/features/sso) on Enterprise, with Okta, Azure AD or any SAML provider, and external playtesters enter through email verification, an allow list and an NDA gate. For a 3,000-player test, that keeps your directory clean. Viewers are free on every plan, so a long tester list doesn't add seats the way per-user tools can. ### Security has to approve our 5,000-player external playtest. What will they want to see? Expect questions about who can get in, how you'd trace a leak, where recordings live and when they're deleted. Bring a one-page plan covering the NDA, allow list, per-tester marks, retention date, vendor DPA and incident owner. On Deal Team and Enterprise, [Peony](https://www.peony.ink/solutions/gaming) gives your reviewer a DPA and security documentation, and it is SOC 2 Type II-ready and ISO 27001-ready with both audits underway, so ask for the audit timeline if your policy needs an issued report. ### Can our publisher and localization vendor watch replays without downloading them? Yes. Export replays to MP4 with H.264, add them to a [Peony room](https://www.peony.ink/blog/secure-video-data-room) and give each partner a view-only group. Video streams in the browser with the player's download control removed, and on the Data Room plan ($52/admin/month) each viewer's watermark sits over the picture. Keep those groups view-only, because a downloaded video has no watermark. For a studio sharing clips with three partners, that beats a shared drive, where every copy looks the same. ### What happens if a beta tester leaks our game? Usually you remove them, take the content down and decide whether to pursue them. EA has pulled testers from a test mid-way, a US default judgment over a leaked stream reached $16,500, and a Chinese court ordered 1M yuan in damages at first instance, according to miHoYo. For a 500-player indie test, removal and a takedown are the realistic steps. In [Peony](https://www.peony.ink/features/revoke-access), you can check what that viewer opened and revoke access, which applies the next time they open or refresh the room. ## Related Resources - [Data Rooms for Game Studios](https://www.peony.ink/solutions/gaming) - [Anomaly Detection](https://www.peony.ink/features/anomaly-detection) - [Password-Protect a Video](https://www.peony.ink/blog/password-protect-video-guide) - [Startup NDA Guide](https://www.peony.ink/blog/startup-nda-guide) - [Single Sign-On](https://www.peony.ink/features/sso) - [Leak Protection](https://www.peony.ink/features/leak-protection) - [Game Studio Acquisition Due Diligence](https://www.peony.ink/blog/game-studio-acquisition-due-diligence) - [Dynamic Watermarking Guide](https://www.peony.ink/blog/dynamic-watermarking-guide) - [Secure Video Data Rooms](https://www.peony.ink/blog/secure-video-data-room) - [Stop Phone Photos of Documents](https://www.peony.ink/blog/stop-phone-photos-of-documents) - [Top Gaming Investors](https://www.peony.ink/blog/top-gaming-investors) --- _Markdown version of [https://www.peony.ink/blog/closed-playtest-security](https://www.peony.ink/blog/closed-playtest-security.md) for AI agents and LLMs; canonical HTML: https://www.peony.ink/blog/closed-playtest-security. Every page on peony.ink is available as markdown — append `.md` to the URL or request it with `Accept: text/markdown`. More: [llms.txt](https://www.peony.ink/llms.txt)._