Access Control Layers: NDA, Email, Password, Watermark, Screenshot Protection
Peony has five access control layers that stack on any link. What each does, its honest limits, and when to use it.
Last updated April 10, 2026
Peony has five access control layers that can be stacked on any data room link: email verification, password, NDA gate, dynamic watermark, and screenshot protection. They are independent — enable any combination.
The Five Layers
1. Email Verification
Does: Viewer enters their email, verifies with a one-time code, gets logged. The verified email feeds the watermark.
Does not: Verify identity. Anyone with access to the inbox can complete it. A viewer can still use a secondary email.
Use on: Every sensitive room. This is the baseline. Turning it off means anyone with the URL walks in.
2. Password Protection
Does: Viewer enters a shared password before the room loads. You share it out-of-band (Signal, phone, separate email).
Does not: Give per-viewer identity. If the password leaks, anyone can enter. Weaker than email verification.
Use on: Shares where email verification is impractical — internal team channel, conference audience, links that need to open without per-person invites.
3. NDA Gate
Does: Viewer must either (a) click a checkbox agreeing to your NDA text, or (b) sign a PDF NDA via Peony's built-in e-signature. Peony captures email, timestamp, and IP for every acceptance. Signed copies land in the Agreements tab.
Does not: Stop leaks technically. An NDA is a legal deterrent — if a viewer accepts and then leaks, the NDA gives you legal recourse. Combine with watermarks and screenshot protection for the technical layer.
Use on: M&A diligence, acquisition talks, sensitive financial data, litigation-adjacent materials.
To set up: Quickstart > Sign Documents → create an e-sign template with one signer → select it in link settings. See NDA Gates .
4. Dynamic Watermark
Does: Every page is overlaid at view time with the viewer's email and IP. The watermark is rendered into the stream, so any screenshot, photograph, or recording captures it with the content.
Does not: Protect a downloaded PDF as hard. If downloads are enabled, Acrobat Pro can sometimes strip static watermark overlays. Keep downloads off.
Use on: Every external share. The watermark is the primary leak deterrent — if a document leaks, the embedded email tells you which viewer leaked it.
Recommended: Watermark on, downloads off.
5. Screenshot Protection
Does: On supported desktop browsers (Chrome, Safari on Windows/macOS), intercepts the OS screenshot gesture and either blocks it or blurs the capture. Logs the attempt to analytics.
Does not:
- Stop phone cameras. A phone pointed at the screen bypasses every digital protection. This is why watermarks matter — the photo still carries the viewer's identity.
- Work perfectly on every setup. There is a known Chrome + macOS bug where the blur state does not clear on arrow-key navigation. Fix shipping.
Mobile: Enable Screenshield (Business / Enterprise) to block screenshots and screen recording on iOS, iPadOS, and Android.
Use on: All audiences. For max protection, combine with watermarks and Screenshield.
Recommended Stacks by Use Case
Fundraising (pitch deck to 30 investors)
- Email verification ON
- Dynamic watermark ON
- Screenshot protection ON
- NDA gate OFF (angels and VCs usually decline)
- Downloads OFF
- Expiry: 30-60 days
M&A sell-side (full diligence)
- Email verification ON
- NDA gate ON (signed PDF)
- Dynamic watermark ON
- Screenshot protection ON
- Downloads OFF
- Expiry: 90 days, per-buyer links
Investor updates (quarterly, existing LPs)
- Email verification ON
- NDA gate OFF (LPs already under LPA)
- Dynamic watermark ON
- Screenshot protection OFF
- Downloads ON
Paid newsletter or course
- Email verification ON
- Dynamic watermark ON
- Screenshot protection ON
- Downloads OFF
- Expiry: tied to subscription
Internal team share
- Email verification ON (workspace domain whitelist)
- All other protections OFF
- Downloads ON
The Layered Protection Model
None of these is perfect alone. Strength comes from stacking:
- Email verification tells you who opened the room
- NDA gate gives you legal recourse if they leak
- Watermark makes any leaked image traceable
- Screenshot protection raises the friction of casual captures
- Downloads off prevents technical extraction
Together: leaks become expensive (legal risk), traceable (audit trail + watermark), and technically hard. They do not make leaks impossible — a human with eyes and a phone camera can always reproduce content. They make leaks meaningfully harder and meaningfully riskier.
Common Mistakes
- Watermarks alone for downloaded files. Acrobat Pro can sometimes strip them. Keep downloads off.
- Screenshot protection on mobile. It does not work on iPad or iPhone. Use watermarks and a device-type gate.
- Password instead of email verification. No per-viewer identity. Email verification is always stronger.
- NDA configured at the room but not toggled on the link. Viewers walk past it.
- Leaving the default link open after invites. Set an expiry or revoke.