When you "share" a Peony data room, files are not sent to the recipient. They stay on Peony's servers. Viewers read documents in an in-browser viewer. Unless you explicitly allow downloads, nothing leaves Peony's infrastructure.

This is the opposite of email attachments, Dropbox share links, or Google Drive share links.

The Short Answer

Files are stored on AWS (US region).
"Sharing a data room" means sharing a link, not files.
Viewers render files in a secure in-browser viewer — they never receive the underlying file.
Downloads are off by default, enabled per link if you want.
Revoking a link stops access instantly. Anything not already downloaded is gone.

When You Upload a File

Three things happen:

Upload — encrypted in transit (TLS), written to Peony's AWS storage (US region).
AI auto-indexing — text extracted, document classified, searchable index built. Finishes in under three minutes for most rooms.
Render-ready conversion — PDFs use a custom secure viewer. Excel renders via a hardened web viewer. PowerPoint converts to browsable pages. Video streams in-place.

Files are encrypted at rest and retrievable only through authenticated requests from your workspace.

When a Viewer Opens a Link

Peony checks the access gates — email verification, NDA, password, domain whitelist, expiry.
Gates pass → viewer enters the room.
The browser loads the file list from Peony's API, not the files themselves.
When the viewer clicks a document, Peony streams the rendered view page by page, under the watermark and protection layers you configured.
Every action logs to analytics.

The file itself never leaves Peony's servers — only the rendered view does. A PDF is not sent as a PDF; it is sent as a stream of pages into the Peony viewer.

Why View-Only Is Real

"View-only" is a technical property, not a marketing claim. When downloads are disabled, the viewer has:

No file path to right-click and save
No "download original" button
No way to extract the source file from the viewer
No way to intercept the raw file via devtools (the stream is rendered, not raw)

What they can still do:

Take a screenshot (unless screenshot protection is on and they are on desktop — see Access Control Layers)
Photograph the screen with a phone
Read and remember content

For hard protection: downloads off + screenshot protection + dynamic watermark + NDA gate. Even if a phone photo slips through, the watermark carries the viewer's email.

Why Storage Location Matters

Peony hosts on AWS in the US region:

Latency — viewers outside North America see marginally slower initial loads. Still fine for document viewing.
Data residency — If your governance requires EU hosting, standard Peony is not a fit. Enterprise can discuss EU options.
Compliance — SOC 2 Type II in progress via Sprinto. See Compliance and Certifications.

For most deal teams — VCs, PE firms, founders, M&A advisors, CRE brokers, consultants — US-region AWS is a non-issue.

When You Revoke a Link

Link URL stops working instantly.
Viewers who try to open it after revoke see "link not found."
A file already open in their browser tab keeps displaying until they close it, but they cannot re-enter.
A file they already downloaded (if downloads were enabled) stays on their machine — Peony cannot reach across the internet to delete it.

The only way to guarantee a viewer never has the file is to keep downloads disabled from the start.

Backups

Automated backups every 4 hours, 30-day retention. If you delete a room or folder by accident, support can restore it within the retention window. See Backups and Disaster Recovery .

Common Mistakes

Assuming "sharing a link" means emailing a file. It does not.
Enabling downloads for convenience. Any viewer who clicks download now has the file permanently. Default is downloads-off for a reason.
Treating revocation as a time machine. Revoking stops future access; it does not un-download anything.
Assuming EU-region storage on the standard plan. It is not. Contact sales for Enterprise options.

How File Storage Works (Files Never Leave Our Servers)