--- title: "Data Room Anomaly Detection: Impossible Travel and VPN Alerts — Peony" lang: en canonical_url: https://www.peony.ink/features/anomaly-detection description: "Peony emails the link's creator when a viewer appears in two distant places within 60 minutes, or arrives through a VPN, Tor exit node, proxy or hosting network." --- [Home](https://www.peony.ink/) [Features](https://www.peony.ink/features) Anomaly Detection Anomaly Detection # Know when a viewer's access doesn't add up Peony watches granted access to your shared links and emails the link's creator when something looks wrong: one viewer in two distant places within 60 minutes, or a visit through a VPN, Tor exit node, known proxy or hosting network. Riot Games uses these alerts for its playtests. Anomaly alerts are on Enterprise, off until you turn them on. Updated November 2026 · Live since October 21, 2026 · [Changelog](https://www.peony.ink/changelog/peony-adds-visitor-anomaly-detection) ## At a glance - Impossible travel: two accesses by one email within 60 minutes, from different countries or more than 500 km apart. - Suspicious networks: Tor exit nodes, VPNs, known proxies and hosting or cloud networks. - Email alerts: the link's creator sees the viewer, both locations and the reason, with one email per access. - Your decision: your team reviews the alert and can revoke access, which applies the next time the viewer opens or refreshes the room. Book a demo ## What does Peony check for? Peony runs two checks on granted access once a workspace opts in. Neither delays the viewer. Alerts are best effort and rate limited, so treat your audit trail as the record. | Check | What triggers it | Covers | | --- | --- | --- | | Impossible travel | Two accesses by one email within 60 minutes, from different known countries or more than 500 km apart | Links that collect an email, across all your links and the viewer's devices | | Suspicious network | A confirmed Tor exit node, VPN, known proxy, or hosting or cloud network | All granted access, including anonymous viewers on open links | ## What does Peony watch? Peony watches the three moments that matter on a shared link: a completed sign-in, a permitted view of a file or folder, and an authorised download request. To control downloads as well, use [download prevention](https://www.peony.ink/features/security) on Business and above. ## What should I do when an alert arrives? - Read the reason. A VPN or a mobile network often explains a location jump, so check whether the viewer usually works that way. - Open the viewer's [page-level analytics](https://www.peony.ink/features/page-analytics) and audit trail to see what they read. - If it looks real, [revoke access](https://www.peony.ink/features/revoke-access) or add the email to the link's block list. - Tighten the link with [email verification](https://www.peony.ink/features/2fa), an allow list and [dynamic watermarks](https://www.peony.ink/features/watermarks) so that a later leak can be traced. ## Who are anomaly alerts for? - Riot Games and other [game studios](https://www.peony.ink/solutions/gaming) running [closed playtests](https://www.peony.ink/blog/closed-playtest-security) with thousands of outside participants. - [M&A teams](https://www.peony.ink/solutions/ma) with many bidders in a confidential sale. - [Private equity](https://www.peony.ink/solutions/private-equity) deal teams who need to know when a link is being passed around. - Security teams that want it alongside [SSO](https://www.peony.ink/features/sso) and [leak protection](https://www.peony.ink/features/leak-protection). ## Frequently asked questions ### What is anomaly detection in a data room? Anomaly detection in a data room is automatic checking of viewer access for patterns that a normal reader wouldn't produce, such as one email opening files from two countries within minutes. In Peony it runs after access is granted and emails the link's creator, so a mid-market deal lead gets a prompt instead of finding the pattern in an audit log weeks later. ### What counts as impossible travel in Peony? Peony flags two granted accesses by the same email, across your workspace's shared links and that person's devices, that fall within 60 minutes and either come from different known countries or are more than 500 km apart. For a banker with 40 bidders in a room, that surfaces a shared login or a forwarded link without anyone reading the logs by hand. ### Does Peony block a viewer when an anomaly is detected? No. Alerts inform your team, and the viewer's session isn't slowed. A VPN or a mobile network can make one honest person appear in two places, so Peony leaves the decision to you. If the alert looks real, you can check their audit trail, tighten the link or revoke access, which applies the next time they open or refresh the room. ### Which Peony plans include anomaly alerts? Anomaly alerts are on the Enterprise plan, which is custom-priced. They are off by default, so a workspace admin turns on Enable anomaly alerts. If you run a confidential process with hundreds of outside viewers, book a demo and we'll scope it alongside SAML SSO and your other Enterprise needs. ### Which companies use Peony's anomaly detection? Riot Games uses Peony's anomaly alerts for its playtests, where thousands of outside participants open files from one allow-listed link. The same alerts are useful for M&A teams with many bidders, and for any team that wants an access signal by email rather than a log to review by hand. ### Who receives the alert, and what does it show? The alert goes by email to the person who created the link, or to the workspace's longest-standing active member if that person has left. It shows the viewer, the estimated locations and times of both accesses, the reason it was flagged and whether each email address was verified. One access produces one combined email, even when both the location and network checks fire. ### Does Peony flag VPN and Tor access to a data room? Yes. After access is granted, Peony classifies the viewer's network and flags Tor exit nodes, VPNs, known proxies and hosting or cloud networks. That check also covers links that collect no email, which appear as Anonymous viewer. For a sell-side team on a confidential process, a bidder arriving through a hosting network is worth a look, though many companies route staff through VPNs for ordinary reasons. ### How accurate are location-based alerts? They are estimates. Location comes from network information, and IP geolocation can be off by hundreds of kilometres, while VPNs, corporate proxies and mobile carriers can distort it further. An alert is evidence worth checking, not proof of a compromised account. Peony also shows whether each email was verified, because an unverified address doesn't establish that both accesses came from one person. ### How is anomaly detection different from an audit trail? An audit trail records what happened and waits for you to look. Anomaly alerts look for you and send an email when a pattern stands out. Most teams need both: the alert tells a 3-person deal team where to look, and the audit trail, available on Data Room ($52/admin/month) and above, shows what that viewer opened and for how long. ## Related features ### Single Sign-On Sign your own team in through your identity provider, and require SSO for every member. ### Leak Protection Trace a leak with per-viewer watermarks, real-time alerts and a full access log. ### Revoke Access End a viewer's access if an alert looks real. ## See anomaly alerts on your own room Anomaly alerts are on Enterprise. See [pricing](https://www.peony.ink/pricing) or book a walkthrough. Book a demo --- _Markdown version of [https://www.peony.ink/features/anomaly-detection](https://www.peony.ink/features/anomaly-detection.md) for AI agents and LLMs; canonical HTML: https://www.peony.ink/features/anomaly-detection. Every page on peony.ink is available as markdown — append `.md` to the URL or request it with `Accept: text/markdown`. More: [llms.txt](https://www.peony.ink/llms.txt)._