When you "share" a Peony data room, files are not sent to the recipient. They stay on Peony's servers. Viewers read documents in an in-browser viewer. Unless you explicitly allow downloads, nothing leaves Peony's infrastructure.

This is the opposite of email attachments, Dropbox share links, or Google Drive share links.

The Short Answer

Files are stored on Cloudflare R2 (US region).
"Sharing a data room" means sharing a link, not files.
Viewers render files in a secure in-browser viewer — they never receive the underlying file.
A newly created link has Allow downloads turned on. Turn it off per link to make the room truly view-only — this is the recommended default for anything sensitive. (Disabling downloads requires a Business plan or higher; on Free the Allow downloads row shows a Requires Business plan badge.)
Revoking a link stops access instantly. Anything not already downloaded is gone.

When You Upload a File

Three things happen:

Upload — encrypted in transit (TLS), written to Peony's Cloudflare R2 storage (US region).
AI auto-indexing — text extracted, document classified, searchable index built. Finishes in under three minutes for most rooms. Auto-indexing runs on the Data Room plan ($52/admin/mo) and above; on lower plans documents still upload and render, they just do not get the automatic searchable index.
Render-ready conversion — PDFs use a custom secure viewer. Excel renders via a hardened web viewer. PowerPoint converts to browsable pages. HTML and HTM render live in the viewer (JavaScript executes, so interactive AI-generated artifacts run as intended). Video and audio stream in-place. See Supported File Formats.

Uploading HTML, video, or audio requires a Business plan ($30/admin/mo) or higher. On the Free plan the upload is blocked before the file is stored, with a message that these formats need Business. Once a file of these types exists, previewing it is not restricted by tier.

Files are encrypted at rest and retrievable only through authenticated requests from your workspace.

When a Viewer Opens a Link

Peony checks the access gates — email verification, NDA, password, domain whitelist, expiry.
Gates pass → viewer enters the room.
The browser loads the file list from Peony's API, not the files themselves.
When the viewer clicks a document, Peony streams the rendered view page by page, under the watermark and protection layers you configured.
Every action logs to analytics.

The file itself never leaves Peony's servers — only the rendered view does. A PDF is not sent as a PDF; it is sent as a stream of pages into the Peony viewer.

Why View-Only Is Real

"View-only" is a technical property, not a marketing claim. When downloads are disabled, the viewer has:

No file path to right-click and save
No "download original" button
No way to extract the source file from the viewer
No way to intercept the raw file via devtools (the stream is rendered, not raw)

Video and audio get the same treatment. The in-place media player disables the browser's download control (nodownload) and blocks the right-click context menu, so there is no one-click "save video." When a dynamic watermark is active, it also renders as an overlay across the playing video — unlike the HTML viewer, which does not carry the watermark overlay.

What they can still do:

Take a screenshot (unless screenshot protection is on and they are on desktop — see Access Control Layers)
Photograph the screen with a phone
Read and remember content

For hard protection: downloads off + screenshot protection + dynamic watermark + NDA gate. Even if a phone photo slips through, the watermark carries the viewer's email.

Why Storage Location Matters

Peony stores files on Cloudflare R2 in the US region (app compute runs on AWS US-West):

Latency — viewers outside North America see marginally slower initial loads. Still fine for document viewing.
Data residency — If your governance requires EU hosting, standard Peony is not a fit. EU-region hosting is available on the Enterprise plan.
Compliance — SOC 2-ready. See Compliance and Certifications.

For most deal teams — VCs, PE firms, founders, M&A advisors, CRE brokers, consultants — US-region storage is a non-issue.

When You Revoke a Link

Link URL stops working instantly.
Viewers who try to open it after revoke see "link not found."
A file already open in their browser tab keeps displaying until they close it, but they cannot re-enter.
A file they already downloaded (if downloads were enabled) stays on their machine — Peony cannot reach across the internet to delete it.

The only way to guarantee a viewer never has the file is to keep downloads disabled from the start.

Backups

Automated backups every 4 hours, 30-day retention. If you delete a room or folder by accident, support can restore it within the retention window. See Security Overview.

Common Mistakes

Assuming "sharing a link" means emailing a file. It does not.
Leaving downloads on. A new link ships with Allow downloads turned on, so if you do nothing, viewers can save the file. Turn downloads off for anything sensitive — any viewer who clicks download has the file permanently.
Treating revocation as a time machine. Revoking stops future access; it does not un-download anything.
Assuming EU-region storage on the standard plan. It is not — EU-region hosting is an Enterprise option. Contact sean@peony.ink.

Common Questions

Is there a storage limit, or a fee for large files or lots of viewers? No. Storage is unlimited and there are no size fees — you are never charged by the file, by the gigabyte, or by how many external viewers open your rooms. Pricing is per admin seat only. Videos and web links count the same as any other file.

Do downloads default to on or off? On. A newly created link has Allow downloads turned on. To make a room truly view-only, open the link's settings and turn Allow downloads off. Disabling downloads requires a Business plan or higher; on the Free plan the row shows a Requires Business plan badge.

Which file types need a paid plan to upload? HTML/HTM, video, and audio require a Business plan ($30/admin/mo) or higher. The upload is blocked before the file is stored on Free. PDFs, Office files, and images upload on any plan.

Does auto-indexing run on every plan? No. AI auto-indexing (text extraction, classification, searchable index) runs on the Data Room plan ($52/admin/mo) and above. On lower plans documents still upload and render — they just are not automatically indexed for search.

My HTML file flashes or does not load after I download it. HTML renders correctly inside Peony's in-browser viewer, where its JavaScript executes as intended. A standalone HTML file downloaded and opened locally can behave differently because it no longer has the viewer's runtime around it. If the file misbehaves inside the Peony viewer itself, that is usually a connection issue — see Upload Issues.

How File Storage Works (Files Never Leave Our Servers)