--- title: "Visitor Anomaly Alerts: Get Emailed About Unusual Access" lang: en canonical_url: https://www.peony.ink/docs/features/security/visitor-anomaly-alerts description: "On Enterprise, Peony emails an admin when a visitor's location looks unusual or access comes through a VPN, Tor or proxy. Alerts don't block access." --- Visitor anomaly alerts Enterprise email an admin when access to a shared link in Peony, a virtual data room for fundraising, M&A and due diligence, looks unusual. They are off by default. **An alert blocks nothing.** The visitor keeps access until you change it. ## Turn Alerts On or Off 1. Click **Settings** at the bottom-left of Peony. 2. Click **Enable anomaly alerts**. The item changes to **Disable anomaly alerts** while they're on. The setting covers the whole workspace, and any admin can change it. If the workspace leaves a plan that includes alerts, they stop, and returning to it restores your earlier choice. ## What Triggers an Alert Peony watches completed access: opening a link, viewing content and requesting a download. An alert is sent for either of these: - **Unusual location.** The same visitor email accesses your links twice within 60 minutes from different countries, or from places more than 500 km apart. - **Flagged network.** The access comes through a Tor exit node, a VPN or a known proxy network, or from a hosting or cloud provider network. Location alerts need a visitor email. On a link that asks for no email, only network alerts apply, and the alert names an **Anonymous viewer**. ## Who Gets the Email One admin gets it: whoever created the link. If that person is no longer an active admin, the email goes to the oldest active admin in the workspace. This is separate from [visitor notifications](https://www.peony.ink/docs/troubleshooting/streamlined-access-and-notifications#visitor-notifications), so turning those off doesn't stop anomaly alerts. The email names the link, location, time and activity, and says whether the visitor's email was verified. Subjects read like **Unusual location activity on a shared link** or **Shared link accessed through a VPN**. Use **Review link settings** to open the link. ## What to Do With One An alert doesn't confirm misuse. People use VPNs and hosting networks for ordinary reasons, and locations are estimated from network information, so a mobile network or VPN can place someone far from where they are. If the access doesn't look right, ask the visitor, then [revoke their access](https://www.peony.ink/docs/features/security/revoke-access) if you need to. ## Notes and Limits - Repeat access from the same visitor, link and place doesn't send a new email each time. - Alerts are best effort. Don't rely on them as your only control. Use [permissions and link settings](https://www.peony.ink/docs/getting-started/permissions-and-security-settings) to restrict who gets in. - Your own previews of a link don't count as access. ## Common Questions #### Do anomaly alerts block the visitor? No. They only send an email. The visitor keeps access until you change it. #### Who gets the anomaly alert email? One admin: whoever created the link. If that person is no longer an active admin, the email goes to the oldest active admin in the workspace. #### Does the visitor know an alert was sent? No. The email goes to one admin in your workspace. #### Anomaly alerts are on our plan. Why am I not getting alerts? They're off by default. Open **Settings** and click **Enable anomaly alerts**. ## Related - [Streamlined access and visitor notifications](https://www.peony.ink/docs/troubleshooting/streamlined-access-and-notifications) - [Revoke access](https://www.peony.ink/docs/features/security/revoke-access) - [Which protections should I turn on?](https://www.peony.ink/docs/concepts/access-control-layers) - [Plans and pricing](https://www.peony.ink/docs/account-billing/plans-and-pricing) --- _Markdown version of [https://www.peony.ink/docs/features/security/visitor-anomaly-alerts](https://www.peony.ink/docs/features/security/visitor-anomaly-alerts.md) for AI agents and LLMs; canonical HTML: https://www.peony.ink/docs/features/security/visitor-anomaly-alerts. Every page on peony.ink is available as markdown — append `.md` to the URL or request it with `Accept: text/markdown`. More: [llms.txt](https://www.peony.ink/llms.txt)._