How do I get a workspace, and how do invitations work?

A workspace represents an isolated tenant organization in PinSay. This guide explains how workspaces come into existence, how owner invitations operate, link security rules, and what to do if email delivery is turned off.

How a workspace comes into existence

In PinSay, workspaces are not provisioned through uncontrolled public sign-up forms. Instead, a platform Super Administrator creates and provisions a new workspace by inviting the prospective workspace owner.

The primary invitation flow

1. Admin sends the invitation: In the Super Admin dashboard (under Admin → Tenants), the administrator enters:
   • The owner's email address.
   • An optional display name.
   • The selected subscription plan (e.g. Free, Starter, or Pro).
   • Link expiration in days (default is 7 days; maximum is 30 days).
2. No passwords in the invitation flow: There is no password field anywhere in the primary invitation screen. Neither the administrator nor the server generates or sees a temporary password.
3. The invitation email: PinSay sends an email containing a unique, cryptographically signed invitation URL.
4. The owner sets their own password: The invitee opens the link in their browser. The page prompts the owner to verify their name and choose their own secure password.
5. Immediate activation: Upon submitting the form, the workspace and the owner account are created and activated immediately. There is no second approval step, manual confirmation ticket, or administrative unlock required. The invited subscription plan takes effect immediately.

Single-use links and expiration

Workspace invitation tokens are strictly protected:

• Single-use (MaxUses = 1): An invitation link can be accepted exactly once. Once the owner sets their password, the token is marked as consumed. Any subsequent visit to the same link will fail cleanly.
• Expiration cap: Invitations expire automatically after their configured duration (7 days by default, capped at a maximum of 30 days). Expired tokens cannot be redeemed.

Managing invitations: Resend, Rotate, and Revoke

Super Administrators can manage active invitations from the Pending Invitations table in the Tenants screen:

• Resend: Re-sends the invitation email to the recipient's address and resets the expiration window, keeping the existing link valid.
• Rotate link (rotate=true): Invalidates the old token immediately and mints a brand-new invitation code. Use this if an invitation email was accidentally sent to an incorrect address or if the link may have been exposed.
• Revoke: Cancels the pending invitation entirely. Any person attempting to open or accept a revoked link receives an immediate 404 error.

Copy-link fallback when email delivery is off

When running a self-hosted PinSay instance where SMTP email delivery is not configured (or in local/staging test environments), PinSay detects that outbound email delivery could not be performed (emailSent === false).

Secondary path: Direct creation with password

Underneath the primary invitation form, an expandable disclosure labelled “Create directly (sets the password yourself)” allows an administrator to provision a workspace and manually set an initial password.

This path is provided strictly as a secondary fallback for air-gapped environments or automated provisioning scripts. In all standard customer onboarding workflows, the invitation flow is the strongly recommended standard so owners always control their own credentials.

Self-service paths

Beyond invitations, workspaces can come into existence in two self-service ways, both governed by the selected subscription plan's workspace count (how many workspaces one account may own) and its approval setting:

• Public signup (when the operator enables it on the Access settings screen): a visitor registers a workspace with their own email and password. When the plan does not require approval (the default), the workspace and its admin account are active immediately — there is no wait for a platform approval. A plan can still be configured to require approval, in which case the workspace stays pending until a Super Administrator approves it.
• “+ New workspace” in the dashboard: a signed-in Workspace Admin can open an additional workspace straight from the header switcher. Workspaces created within the plan's workspace count are active immediately; creating beyond the count is refused with an upgrade prompt rather than silently queued.

Moving a project to another workspace

A project can be moved between workspaces with export/import: in the source workspace, use the project's Export action to download a portable JSON snapshot of its comments; switch to the target workspace and use Import project on the Projects screen to upload it. The project is created in the target workspace if it does not exist there yet, with comments, replies, statuses and element context preserved.

Workspace name and logo

Each workspace has its own name, and optionally its own logo, set by a Workspace Admin in Settings. When a logo is set it replaces the PinSay mark in the dashboard header; removing it restores the default branding. Logos are PNG, SVG, WebP or JPEG, up to 1 MB.

Workspace ownership can be transferred to an existing Deputy from the workspace's own Team → Members screen (“Promote to owner”). Transferring ownership directly to an account that is not already a Deputy is not supported — promote them to Deputy first.

AI providers & keys

Some PinSay features use an AI provider. You choose the provider and model for each feature in Settings, in the AI providers & keys section. The section lists the providers, the features each one serves, and the key status of each provider.

• ElevenLabs: speech to text.
• Anthropic: translation suggestions, and the workspace assistant (later).
• OpenAI: speech to text, translation suggestions, and the workspace assistant (later).

The workspace assistant is not released yet, so its switch is disabled and labelled Not released yet.

Platform default or your own key

By default, PinSay uses its own provider keys. A Workspace Admin can add an own key for a provider, so that this workspace uses that provider with its own account. Without an own key, the workspace uses PinSay's default. Your plan decides whether own keys are included; if it does not, the section says so.

• Set key adds a key for a provider. Replace key changes it.
• Keys are write-only. After you save one, PinSay never shows it again. The section only shows ends with and its last four characters, so you can tell which key is in use.
• Remove deletes the key. Use PinSay’s default goes back to the platform setting.
• A provider you choose in a workspace is used only while that workspace has its own working key for it. Until then, the section shows your choice as saved but not in use.
• Translation suggestions made with your own key do not use your plan’s monthly translation allowance. The per-minute limit still applies.

Whether a feature is on at all is decided by the PinSay super administrator, per feature, for the whole platform. A workspace cannot switch a feature on or off itself.

Names in Arabic

PinSay works in English and Arabic. Some names can have an Arabic version next to the English one, shown as Arabic (optional) in the form:

• Role name and role description.
• Status names (built-in and custom statuses).
• Action titles and rule titles.
• Workspace name and project name.

When you view PinSay in Arabic, each of these shows its Arabic version. If it is empty, PinSay shows the English version instead, so nothing is left blank.

For most of these fields you can ask for a suggestion: Suggest Arabic translates the English text, and Suggest English translates the Arabic text. Suggestions are not available for workspace and project names, or for prompts; type those names yourself.

• A suggestion appears in a box below the field, with Apply and Dismiss.
• Applying a suggestion only fills the field. Nothing is saved until you press Save.
• If suggestions are not available right now, or you have used this month’s allowance, you can still type the text yourself.