Visitor Anomaly Alerts: Get Emailed About Unusual Access
On Enterprise, Peony emails an admin when a visitor's location looks unusual or access comes through a VPN, Tor or proxy. Alerts don't block access.
Last updated November 1, 2026
Visitor anomaly alerts Enterprise email an admin when access to a shared link in Peony, a virtual data room for fundraising, M&A and due diligence, looks unusual. They are off by default. An alert blocks nothing. The visitor keeps access until you change it.
Turn Alerts On or Off
- Click Settings at the bottom-left of Peony.
- Click Enable anomaly alerts. The item changes to Disable anomaly alerts while they're on.
The setting covers the whole workspace, and any admin can change it. If the workspace leaves a plan that includes alerts, they stop, and returning to it restores your earlier choice.
What Triggers an Alert
Peony watches completed access: opening a link, viewing content and requesting a download. An alert is sent for either of these:
- Unusual location. The same visitor email accesses your links twice within 60 minutes from different countries, or from places more than 500 km apart.
- Flagged network. The access comes through a Tor exit node, a VPN or a known proxy network, or from a hosting or cloud provider network.
Location alerts need a visitor email. On a link that asks for no email, only network alerts apply, and the alert names an Anonymous viewer.
Who Gets the Email
One admin gets it: whoever created the link. If that person is no longer an active admin, the email goes to the oldest active admin in the workspace. This is separate from visitor notifications, so turning those off doesn't stop anomaly alerts.
The email names the link, location, time and activity, and says whether the visitor's email was verified. Subjects read like Unusual location activity on a shared link or Shared link accessed through a VPN. Use Review link settings to open the link.
What to Do With One
An alert doesn't confirm misuse. People use VPNs and hosting networks for ordinary reasons, and locations are estimated from network information, so a mobile network or VPN can place someone far from where they are.
If the access doesn't look right, ask the visitor, then revoke their access if you need to.
Notes and Limits
- Repeat access from the same visitor, link and place doesn't send a new email each time.
- Alerts are best effort. Don't rely on them as your only control. Use permissions and link settings to restrict who gets in.
- Your own previews of a link don't count as access.
Common Questions
Do anomaly alerts block the visitor?
No. They only send an email. The visitor keeps access until you change it.
Who gets the anomaly alert email?
One admin: whoever created the link. If that person is no longer an active admin, the email goes to the oldest active admin in the workspace.
Does the visitor know an alert was sent?
No. The email goes to one admin in your workspace.
Anomaly alerts are on our plan. Why am I not getting alerts?
They're off by default. Open Settings and click Enable anomaly alerts.