---
title: "Anomaly detection in Peony's virtual data room: unusual location, VPN and Tor alerts"
lang: en
canonical_url: https://www.peony.ink/changelog/peony-adds-visitor-anomaly-detection
description: "Visitor anomaly detection has been in Peony's virtual data room since October 21, 2026, on Deal Team and Enterprise. It emails the workspace when a recipient's link opens from two countries, or places more than 500 km apart, within 60 minutes, or through a VPN, Tor, a known proxy or a hosting provider."
date: "2026-10-21T12:00:00.000Z"
author: "Sean Yu"
---

# Anomaly detection in Peony's virtual data room: unusual location, VPN and Tor alerts

_Security · October 21, 2026_

**Plans:** Deal Team and Enterprise

**For:** M&A advisors, Private equity, Founders raising capital, Security and compliance teams

Visitor anomaly detection has been in Peony's virtual data room since October 21, 2026, on Deal Team and Enterprise. It emails the workspace when a recipient's link opens from two countries, or places more than 500 km apart, within 60 minutes, or through a VPN, Tor, a known proxy or a hosting provider.

## What does it do?

Visitor anomaly detection watches successful accesses to your shared links and emails your workspace when one looks unusual. It looks for two patterns:

- **Unusual location:** the same recipient email has two granted accesses within 60 minutes from different countries, or from places more than 500 km apart. This can point to a shared or forwarded link, or to someone else using the recipient's access.
- **Unusual network:** a link is opened through a VPN, a Tor exit node, a known proxy, or a hosting or cloud provider network.

When both happen on the same access, they arrive in one email.

## Who is it for?

Deal teams sharing confidential material such as CIMs, financial models and diligence files, where a forwarded link or an anonymised visitor is worth knowing about quickly.

## How does it work?

1. Open the Settings menu and choose **Enable anomaly alerts**.
2. Peony checks views, downloads and completed link sign-ins after they are granted, across all of the workspace's shared links.
3. Alerts go to the workspace by email. They name the recipient email and explain why the access was flagged, for example "Two accesses came from different countries within 60 minutes."

Location comes from where the network says a request came from, so an alert is a signal to check, not proof of misuse. Detection never blocks or slows access. To cut someone off, [revoke the link](https://www.peony.ink/docs/features/security/revoke-access).

The detectors shipped over three releases: location checks (October 11, 2026), location alert emails (October 15), and VPN, Tor, proxy and hosting checks with combined alerts (October 19). The setting that lets Deal Team and Enterprise workspaces turn alerts on shipped on October 21, 2026.

## Which plans include it?

Deal Team ($64 per admin per month billed annually, $89 billed monthly, minimum 4 admins) and Enterprise. It is off by default. See [pricing](https://www.peony.ink/pricing).

## How does it compare?

Many data rooms log a visitor's IP address and location for later review. Peony's anomaly detection compares accesses as they happen and sends an alert, so a forwarded link can be spotted while a process is live.

## Where can I learn more?

- [Revoke access (docs)](https://www.peony.ink/docs/features/security/revoke-access)
- [Audit trail (docs)](https://www.peony.ink/docs/features/analytics/audit-trail)
- [Security features](https://www.peony.ink/features/security)

## FAQ

### Does Peony's data room have anomaly detection?

Yes. On Deal Team and Enterprise, Peony can alert you when a shared link is opened from two distant locations within 60 minutes, or through a VPN, Tor, a known proxy or a hosting network. It is off by default and never blocks access.

### Is anomaly detection on by default?

No. It is off for every workspace until an admin turns on anomaly alerts.

---

_Markdown version of [https://www.peony.ink/changelog/peony-adds-visitor-anomaly-detection](https://www.peony.ink/changelog/peony-adds-visitor-anomaly-detection.md) for AI agents and LLMs; canonical HTML: https://www.peony.ink/changelog/peony-adds-visitor-anomaly-detection. Every page on peony.ink is available as markdown — append `.md` to the URL or request it with `Accept: text/markdown`. More: [llms.txt](https://www.peony.ink/llms.txt)._