Can I share a private request link outside the workspace?

Request access follows workspace authentication. Invite the person with the right role instead of forwarding an authenticated link.

Does sharing a request URL make the request public?

No. The viewer must still sign in with access to the correct workspace. A copied URL is a route to the request, not a replacement for membership or permissions.

Can I upload passwords or API keys for a request?

Do not place passwords, payment credentials, API keys, or secret tokens in briefs, files, comments, Slack, or Support. Use your organization's approved secret-sharing process instead.

Security and privacy

Safe workspace use

Use individual accounts rather than shared passwords
Remove access when a teammate leaves
Upload only material your organization is allowed to share
Keep passwords, card numbers, API keys, and secret tokens out of requests and chat
Check the destination before following a payment or reset link

Public policies

The current Privacy Policy and Terms are available from the public legal pages on app.piwot.co.

Access follows workspace membership

Requests, attachments, and organization settings require an authenticated account with the appropriate workspace membership. A copied request URL does not make the content public. Remove membership promptly when a teammate leaves or no longer needs access.

Share the minimum useful data

Briefs and support conversations should contain the context needed for the work, not every internal record available. Redact unnecessary personal information, use approved files, and keep passwords, card credentials, API keys, and secret tokens out of the platform.

Check policies for formal requirements

The public Privacy Policy and Terms explain the current legal commitments. A customer security questionnaire or data-handling requirement can be discussed with Support, but a request comment is not the right place to negotiate access or legal terms.