Access Control Layers: NDA, Email, Password, Watermark, Screenshot Protection
Peony has five access control layers that stack on any link. What each does, its honest limits, and when to use it.
Last updated July 22, 2026
Peony has five access control layers that can be stacked on any data room link: email capture / verification, password, NDA gate, dynamic watermark, and screenshot protection. They are independent — enable any combination. Some layers are plan-gated (noted below).
The Five Layers
1. Email Capture and Verification
There are two distinct link settings here, and they are gated differently:
- Require viewer info (Free): the viewer types their email before the room loads. It's captured and logged, but there's no code — nothing checks the address is real. This is the free-tier email option, set inside the Require email control.
- Verify email (Business and above): the viewer also has to enter a one-time code sent to that address. This is what actually verifies inbox access. On Free plans this toggle shows an upgrade badge.
Does: Logs the viewer's email against every view. With Verify email on, the address is confirmed via a one-time code. The captured email feeds the watermark.
Does not: Verify identity. Even with the code, anyone with access to the inbox can complete it, and a viewer can still use a secondary email. Require viewer info alone captures whatever the viewer types — it doesn't check it.
Use on: Every sensitive room. Capture is the free baseline; add Verify email (Business) when you need the address confirmed. Turning both off means anyone with the URL walks in.
To restrict who can even reach the code step, pair email verification with an Allow/block list (Business) so Peony auto-rejects any address not on your list. Domain-gated access (allow a whole company domain) is a Data Room feature.
2. Password Protection
Does: Viewer enters a shared password before the room loads. You share it out-of-band (Signal, phone, separate email).
Does not: Give per-viewer identity. If the password leaks, anyone can enter. Weaker than email verification.
Use on: Shares where email verification is impractical — internal team channel, conference audience, links that need to open without per-person invites.
3. NDA Gate
Does: Viewer must either (a) click a checkbox agreeing to your NDA text, or (b) sign a PDF NDA via Peony's built-in e-signature. Peony captures email, timestamp, and IP for every acceptance. Signed copies land in the Signatures tab.
Does not: Stop leaks technically. An NDA is a legal deterrent — if a viewer accepts and then leaks, the NDA gives you legal recourse. Combine with watermarks and screenshot protection for the technical layer.
Use on: M&A diligence, acquisition talks, sensitive financial data, litigation-adjacent materials.
On the link, the checkbox NDA is the One-click NDA toggle (Business); a full signed PDF NDA is Advanced NDA (Data Room).
To set up a signed NDA template: Quickstart > Send a document for signature (or Create agreement from template) → add signature fields → select the template in link settings. Template creation works best on desktop. See NDA Gates and E-Signatures.
4. Dynamic Watermark
Dynamic watermark is a Data Room feature (and above).
Does: Every page is overlaid at view time with the viewer's identity. The watermark renders four lines (email, IP, and timestamp detail) into the stream, so any screenshot, photograph, or recording captures it with the content. You can adjust it with the Customize watermark control.
Does not: Protect a downloaded PDF as hard. If downloads are enabled, Acrobat Pro can sometimes strip static watermark overlays. Keep downloads off.
Use on: Every external share. The watermark is the primary leak deterrent — if a document leaks, the embedded email tells you which viewer leaked it.
Recommended: Watermark on, downloads off.
5. Screenshot Protection
There are two levels, gated differently:
- Screenshot protection (Business): basic desktop protection. On supported desktop browsers (Chrome on Windows, Chrome and Safari on macOS), intercepts the OS screenshot gesture and either blocks it or blurs the capture. Logs the attempt to analytics.
- Screenshield (Data Room and above): Advanced Screenshot protection. Stronger capture and screen-recording protection. By design it reduces the visible viewing area to shrink what a capture can grab, so viewers see a smaller window at a time.
Does not:
- Stop phone cameras. A phone pointed at the screen bypasses every digital protection. This is why watermarks matter — the photo still carries the viewer's identity.
- Work the same on mobile. Screenshot prevention is desktop-optimized and has inherent limits on phones and tablets, where the OS gives apps less control over the capture gesture. Lean on watermarks there.
Use on: All audiences. For max protection, combine with watermarks and Screenshield (Data Room).
Recommended Stacks by Use Case
Fundraising (pitch deck to 30 investors)
- Email verification ON
- Dynamic watermark ON
- Screenshot protection ON
- NDA gate OFF (angels and VCs usually decline)
- Downloads OFF
- Expiry: 30-60 days
M&A sell-side (full diligence)
- Email verification ON
- NDA gate ON (signed PDF)
- Dynamic watermark ON
- Screenshot protection ON
- Downloads OFF
- Expiry: 90 days, per-buyer links
Investor updates (quarterly, existing LPs)
- Email verification ON
- NDA gate OFF (LPs already under LPA)
- Dynamic watermark ON
- Screenshot protection OFF
- Downloads ON
Paid newsletter or course
- Email verification ON
- Dynamic watermark ON
- Screenshot protection ON
- Downloads OFF
- Expiry: tied to subscription
Internal team share
- Email verification ON (workspace domain whitelist)
- All other protections OFF
- Downloads ON
The Layered Protection Model
None of these is perfect alone. Strength comes from stacking:
- Email verification tells you who opened the room
- NDA gate gives you legal recourse if they leak
- Watermark makes any leaked image traceable
- Screenshot protection raises the friction of casual captures
- Downloads off prevents technical extraction
Together: leaks become expensive (legal risk), traceable (audit trail + watermark), and technically hard. They do not make leaks impossible — a human with eyes and a phone camera can always reproduce content. They make leaks meaningfully harder and meaningfully riskier.
Common Mistakes
- Watermarks alone for downloaded files. Acrobat Pro can sometimes strip them. Keep downloads off.
- Relying on screenshot protection on mobile. Prevention is desktop-optimized and limited on phones and tablets. Use watermarks as the real deterrent there.
- Password instead of email verification. No per-viewer identity. Email verification is always stronger.
- NDA configured at the room but not toggled on the link. Viewers walk past it.
- Leaving the default link open after invites. Set an expiry or revoke.
Common Questions
Email verification only proves someone can open an inbox, not who they are. Can I lock a room down harder?
Right. A one-time code confirms inbox access, not identity — a forwarded code still gets in, and a viewer can use a secondary email. Three ways to tighten it:
- Allow/block list (Business): Peony auto-rejects any address not on your list. This is the first thing to add.
- Domain-gated access (Data Room): allow a whole company domain instead of listing individual emails.
- Signed NDA (One-click NDA on Business, Advanced NDA on Data Room): for genuinely sensitive material, always pair access controls with a signed NDA for legal recourse.
Device fingerprinting is an Enterprise capability, and session detection sits on the Deal Team tier.
My domain-gated access shows an upgrade prompt even though I'm on Business.
Domain-gated access (allowing a whole company domain) is a Data Room feature. The Allow/block list — listing individual emails to permit or block — is what's included on Business. If you need to gate by domain, that's the Data Room plan.
Can I run one room but show different people different documents?
Yes — that's the point of stacking links and permissions. Create one data room, then create multiple links at different access levels (teaser link → full diligence link → finalist link), and use granular per-file permissions to control what each group sees. This is safer than duplicating rooms. Granular per-item permissions are a Data Room feature.
Is screenshot protection weaker on mobile?
Yes, by design of the platform. Screenshot prevention is desktop-optimized; phones and tablets give apps less control over the OS capture gesture, so there are inherent limits. Screenshield (Advanced Screenshot protection, Data Room) also shrinks the visible viewing area on purpose to limit what any single capture can grab. On mobile, treat the dynamic watermark as your real deterrent — a leaked photo still carries the viewer's identity.