Complete Audit Trail
Every open, download, and terms acceptance is logged with timestamp, IP, and browser data — filterable and exportable to CSV for compliance and dispute situations
Business Software
Share Confidential Documents. Know Exactly Who Opened What.
PM DataRoom is a secure, self-hosted virtual data room. Create a project, upload files, send personalized tracked links — and monitor every access, download, and terms acceptance in real time.
Confidentiality by Design
Files live outside any public URL space, administrators cannot see inside data rooms, and every download passes full access validation before delivery
Adjustable Security, Low Friction
Per-project toggles scale from a frictionless tracked link to login + IP lock + download limits + NDA — matching the sensitivity of each sharing scenario
Sales & Deal Intelligence
Open counts, first/last access times, and per-file download data show exactly which recipients are engaged — signal you never get from an email attachment
What it's about
PM DataRoom
Email attachments are untraceable. Consumer file-transfer tools have no access control. Enterprise virtual data rooms are expensive and overbuilt. PM DataRoom sits exactly in between: professional enough to enforce logins, IP restrictions, download limits, and legally logged terms acceptance — simple enough that one manager sets up a complete data room in minutes.
Every recipient receives a personalized access link containing a unique, cryptographically random tracking token. From the moment they click, PM DataRoom records opens, downloads, IP addresses, and terms acceptances — giving you a complete, filterable audit trail for every project.
PM DataRoom is developed by premotion media and runs as self-hosted software on your own infrastructure. No third-party SaaS holds your confidential files, and no external service dependencies are required to operate it.
Features
Thought through to the daily workflow.
Every building block is focused on a clear benefit and fits into existing processes.
Feature Section
Each data room is a self-contained project with its own files, recipients, settings, and analytics. Access rules are configured per project through a clean set of toggles — no security expertise required.
Data Rooms with Granular Access Control
Each data room is a self-contained project with its own files, recipients, settings, and analytics. Access rules are configured per project through a clean set of toggles — no security expertise required.
- Access mode per project: link-only access or mandatory email + password login
- Validity window: set "valid from" and "valid until" dates; rooms open and expire automatically
- Download limits: restrict how many times each recipient may download each file (1–99)
- IP lock: bind each recipient to the first IP address they access from; other networks are denied
- Terms requirement: block file access until all assigned terms documents are accepted
- Project lifecycle with draft, scheduled, active, expired, and archived states — transitions run automatically
Trackable Personalized Access Links
Every recipient gets a unique access link containing a 64-character cryptographically random tracking token. The link attributes every action to a specific person — no shared passwords, no anonymous downloads.
- Tokens generated with cryptographically secure randomness — practically unguessable
- First open, last open, and total open count recorded per recipient
- Every access and download logged with timestamp, IP address, and browser information
- Links outside the validity window still resolve to branded "not yet available" or "expired" pages, so attempted access is visible too
Recipient Accounts with Optional Login
Recipients have real accounts — but whether they must log in is your decision, per data room. Low-sensitivity sharing stays frictionless; sensitive projects get a proper authentication layer.
- Recipient accounts created automatically when a manager adds an email address
- One account per person across all data rooms — invitations to multiple projects link to the same account
- Protected mode: recipients log in with email and password before reaching any files
- Auto-generated credentials delivered in the invitation email for protected rooms
- Self-service password reset flow for recipients
Terms & Conditions with Logged Acceptance
Put a legal agreement in front of your files. Managers create reusable terms templates, assign one or more to a project, and recipients must accept every document before any file becomes accessible.
- Reusable templates with categories: data protection, privacy, usage, NDA, and custom
- Versioned templates — the accepted version is snapshotted for the audit trail
- Multiple terms documents per project, each with its own mandatory checkbox
- Acceptance recorded with timestamp, IP address, browser information, and document version
- Terms are not re-shown on return visits unless the document version changes
Secure File Handling from Upload to Download
Files are never exposed through public URLs. Uploads are validated, stored under UUID-based names in a private storage zone, and every download is streamed through the application only after all access checks pass.
- Drag-and-drop multi-file upload with per-file titles and descriptions
- Extension and MIME-type validation on every upload
- Optional folder organization within each data room
- Files stored in a private Bunny Edge Storage zone — accessible only server-side, never via direct URL
- Every download re-validates the tracking token, validity window, login state, IP lock, and download limit before a single byte is sent
- Supports PDF, Word, Excel, PowerPoint, OpenDocument, text, images, archives, and audio/video formats
Email Invitations with Queue-Based Delivery
Send personalized invitations to your entire recipient list without timeouts or throttling problems. Emails are queued and processed in the background by a scheduled worker.
- Personalized invitation emails with the recipient's tracked access link
- Login credentials included automatically for protected data rooms
- Queue-based sending via your own SMTP server
- Failed deliveries retried automatically with exponential backoff
- Per-recipient invitation status (pending, sent, failed) with resend capability
- Automatic expiry warning emails before a data room closes
Reporting, Analytics, and CSV Export
The reporting dashboard answers the questions that matter in a due diligence or sales process: Who opened the room? Who never did? Who downloaded which files, and from where?
- Project overview: recipients, opened vs. not opened, validity window, and status at a glance
- Per-project detail report: first/last open, open count, downloads, locked IP, terms acceptance, invitation status
- Filter by open status, terms status, date range, or free-text search
- CSV export of filtered report data — with built-in protection against spreadsheet formula injection
- Recipient import via CSV or manual entry, with duplicate detection
Role Separation: Admin, Manager, Recipient
PM DataRoom enforces a deliberate separation of concerns. Administrators run the platform; managers run their own data rooms; recipients see only what they were invited to.
- Administrators create and manage manager accounts and view platform-level statistics
- Administrators cannot see inside data rooms or access project files — confidentiality by design
- Each manager owns and controls their projects independently
- Forced password change on first login for newly created managers
- Credential emails sent to managers directly from the admin panel
How it works
A clear path to the result.
- 01
Step 1 — Create a Data Room
Log in as a manager and create a new project with a name and description. Configure access with simple toggles: require login, set the validity window, limit downloads, lock to IP, require terms.
- 02
Step 2 — Upload Files
Drag and drop your documents. Add optional titles, descriptions, and folder groupings. Every upload is validated and stored privately under a non-guessable name.
- 03
Step 3 — Add Recipients
Enter email addresses manually or import a CSV list. Recipient accounts are created automatically — or linked, if the person already has one from a previous project.
- 04
Step 4 — Send Invitations
Send personalized invitation emails containing each recipient's unique tracked link — plus login credentials for protected rooms. Delivery runs through a background queue with automatic retries.
- 05
Step 5 — Monitor Everything
Watch the report dashboard: who opened, who didn't, what was downloaded, which terms were accepted, and from which IP addresses. Filter, sort, and export to CSV at any time.
- 06
Step 6 — Let It Expire
When the validity window closes, the data room expires automatically and recipients see a branded expiry page. The complete audit trail remains available to you.
Who is it for?
Made for concrete requirements.
The solution is a particularly good fit for these teams, roles and business models.
M&A and Due Diligence Teams
Run a time-boxed due diligence window with login protection, IP lock, per-file download limits, and NDA acceptance on record — the full control set of an enterprise data room without the enterprise overhead.
Law Firms and Notaries
Exchange contracts and case documents with clients under logged terms acceptance. Every access event is recorded with timestamp, IP, and browser information for a defensible audit trail.
Financial and Tax Advisors
Share reports, statements, and filings with clients through expiring, access-controlled rooms instead of email attachments. Password-protected access gives clients visible reassurance.
Agencies and Consultancies
Deliver proposals, audits, and project files to clients through polished, branded data rooms — and see exactly when a prospect opened the deck and which documents they downloaded.
Real Estate and Investment Professionals
Distribute exposés and investment documents to a defined buyer list, track engagement per recipient, and automatically close access when the offer period ends.
Organizations with Data Sovereignty Requirements
PM DataRoom is self-hosted. Files, accounts, and logs live on your own infrastructure — a clear answer for teams that cannot place confidential documents in third-party SaaS tools.
Tech & scope
The key details at a glance.
- Application Type
- Self-hosted web application
- Language
- PHP 8.4 (strict types, no framework dependency)
- Database
- MySQL 8+ / MariaDB
- Web Server
- Nginx with PHP-FPM
- Frontend
- Vanilla JavaScript (ES modules), no build step
- Design
- Hand-built design system, self-hosted fonts, light and dark mode, responsive
- File Storage
- Private Bunny Edge Storage zone, server-side streaming only
- SMTP via PHPMailer, queue-based with retry
- Password Hashing
- Argon2id
- Access Tokens
- 64-character cryptographically random tracking tokens
- User Roles
- Administrator, Manager, Recipient
- UI Language
- English
- Author
- premotion media
- Deployment & Pricing
- Available on request from premotion media
FAQ
Frequently asked questions.
What exactly is PM DataRoom?
A self-hosted virtual data room application. Managers create projects, upload confidential files, and distribute personalized tracked access links to recipients. The system enforces access rules and logs every open, download, and terms acceptance.
Do recipients need to create an account?
No — accounts are created automatically when a manager adds a recipient's email address. Whether recipients must actually log in depends on the data room: in link-only mode the tracked link is sufficient; in protected mode they sign in with email and password.
Can I make a data room available only for a limited time?
Yes. Each project has an optional validity window with "valid from" and "valid until" dates. Rooms activate and expire automatically, recipients see clear "not yet available" or "expired" pages outside the window, and managers receive a warning email before expiry.
How does the IP lock work?
When enabled, the first IP address a recipient uses is recorded and locked. Any later access from a different IP is denied with a message to contact the manager, who can view and reset the locked IP at any time.
Is terms acceptance legally traceable?
Every acceptance is logged with timestamp, IP address, browser information, and the exact version of the accepted document. A project can require multiple terms documents — for example an NDA plus a data protection agreement — and all must be accepted before any file is accessible.
Can recipients share their link with someone else?
The combination of controls makes uncontrolled forwarding impractical: protected mode requires the recipient's personal login, IP lock binds access to one network, download limits cap file retrieval, and every access is attributed and logged — so any anomaly is immediately visible in the report.
Where are the files stored?
Uploaded files are stored under non-guessable UUID names in a private storage zone that is only reachable server-side. There are no public file URLs. Every download is streamed through the application after all access checks — token validity, validity window, login, IP lock, and download limit — have passed.
What do I need to run PM DataRoom?
A standard server with Nginx, PHP 8.4, and MySQL or MariaDB, plus an SMTP account for invitation emails. There are no external service dependencies beyond file storage, no frontend build tooling, and no framework stack to maintain. Deployment options and pricing are available on request from premotion media.
Ready?
Your Files. Your Rules. Full Visibility.
PM DataRoom replaces untraceable attachments and overpriced enterprise tools with a focused, self-hosted data room: personalized tracked links, login protection, IP lock, download limits, logged terms acceptance, and automatic expiry — all monitored from one clear reporting dashboard. Set up your first data room in minutes and know, for the first time, exactly what happens to every document you share.
Discuss your project