Collaborating securely: introducing Trizlink workspaces

A workspace is a self-contained tenant: its own short links, its own custom domains, its own bio pages, its own members and its own plan. Nothing crosses between workspaces, and switching between them is one click. If you have ever handed a freelancer your login because the tool had no other way to let them work, this is the feature that replaces that.

What a workspace contains

• Every short link created in it, with its labels, folders and history.
• The custom domains verified for it, on plans that include them.
• The link-in-bio pages published from it.
• The connected social accounts, and the queue of scheduled posts.
• The analytics for all of the above, on one timeline.
• The members, their roles, and the audit trail of what each of them did.

The consequence worth stating plainly: a link in workspace A is invisible from workspace B, including in search, in exports and in the API. That is what makes the model usable for agency work, where two clients must never see each other.

The four roles

1. Owner — everything, including billing, deleting the workspace, and transferring ownership. One per workspace.
2. Admin — everything except billing and deletion: members, domains, links, pages, posts and settings.
3. Member — creates and edits links, pages and posts, and reads all analytics. Cannot manage members or domains.
4. Viewer — reads links and analytics, and creates nothing. The role for a client who wants the numbers without the ability to change anything.

The point of the split is narrower than it looks. Most collaboration accidents are not malice; they are somebody with more permission than the task needed. A contractor who can make links but cannot delete a verified domain cannot accidentally take your short links offline on their last day.

Why a shared login is worse than it feels

A shared login has three failure modes and no fix for any of them. Every action is attributed to one account, so the audit trail says nothing useful. Removing one person means changing the password for everybody. And the credential spreads — into a password manager note, a chat message, a handover document — with no way to count where it now lives.

Switching, and what does not leak

The workspace switcher sits in the app header and changes everything below it at once: the links list, the analytics, the domains, the queue. The active workspace is remembered on your device, so returning tomorrow puts you back where you were rather than in whichever workspace happens to be first alphabetically.

Isolation is enforced by the database, not by the interface hiding things. A query that asks for another workspace’s links gets nothing back rather than being told it is not allowed — which is the correct behaviour, because a refusal is itself a disclosure that the record exists.

Inviting people, and what happens next

An invitation is sent to an email address with a role already attached, so the decision about permission is made before anyone has access rather than after. The person accepts by signing in with Google; if the address they sign in with differs from the one invited, the invitation does not match and nothing is granted — which is deliberate, because an invitation that quietly accepts a different identity is not an invitation.

Removing somebody is immediate and total. Their membership row goes, and with it every route through which they could read the workspace: the app, exports and the API alike. Nothing is cached in their browser that will keep working until a token expires, because permission is read at query time rather than baked into a session when they signed in.

The audit log, and why roles need one

Roles decide what somebody can do. The audit log records what they did — who changed a destination, who deleted a link, who removed a domain, and when. Without it, roles produce a comfortable feeling and no evidence, which matters the first time a link starts pointing somewhere unexpected and three people had the ability to change it.

The log is append-only: entries are written and never edited, including by an owner. That is the property that makes it worth reading. A log anyone can tidy is a log that tells you what somebody wanted you to see, and the moment it can be edited it stops being usable as an answer to "what happened here".

How many workspaces you get

The Free plan is one workspace with one member — enough to run your own links properly. Pro raises that to three workspaces and three members, and Team to ten workspaces and fifteen members, which is the tier where roles, teams and the audit log arrive. Every limit is listed before you pay for anything.

If you are weighing whether you need more than one, the useful test is whether two sets of links should ever appear in the same report. Campaigns for one business belong in one workspace with folders and labels. Two clients belong in two workspaces.