The link is hashed before it is stored
The token is generated on your device and only a digest of it is ever written down. A database dump is not a set of working links.
Share one thing, not your workspace
The person you need an answer from should not have to create an account, join a workspace or occupy a seat. In Zephyr you share a single action with a single address — and that is all they can ever see.
The premise
Every other tool asks the wrong person to change
You are waiting on a subcontractor, a district nurse, a candidate, a client's finance team. To chase them inside a shared tool, they have to adopt your tool. They will not, so you go back to mail, and the tracking goes back into your memory.
So Zephyr stays single-tenant: nobody joins your workspace, because there is no way to join a workspace. Collaboration happens on one item. A share names exactly one action, one email address and one role, and it widens what that person can read by precisely one row.
Not filtered down to one row — widened by one row. There is no “share my workspace” grant in the database and no way to write one, so the blast radius of a share is a property of the schema rather than a property of the code being careful.
SHARE · ONE ACTION
Confirm staffing numbers for Thursday
Active
Everything else in your workspace
Not visible
Access ends by itself after 90 days.
The security decisions
Four choices that make a shared link safe to send
A share link is a credential arriving by mail, which is the least trustworthy channel there is. These are the four things that follow from taking that seriously.
A forwarded link is inert
Access is checked against the email address on the session the invitee actually signed in with. Passing the link on gives the next person nothing.
Every refusal says the same sentence
“Specific” error messages tell a stranger whether a given invite exists. All of them are answered identically for that reason.
A forgotten share closes itself
Access carries a 90-day expiry evaluated when the data is read, so it lapses on its own — and a revoked one stops working on the next query, not at the next scheduled job.
Phase A
Read-only, on purpose
Today a grantee can see the one action they were sent and nothing else. They cannot edit it, complete it, comment on it or delete it, because there is deliberately no policy in the database that would let them.
“Mark my side done” is the obvious next step, and when it arrives it will be a proposal the owner confirms rather than a write. Outsiders propose; the owner approves — which is exactly the rule the AI follows, applied to people.
- One action, one address, one role. The share is not a link that anyone with it can use.
- No seat, no licence, no invoice. The person you are chasing is not a billable user, and never becomes one.
- Nothing else widens. No capture, no person, no brief and no other action is reachable through a grant.
- Revocable from the action. Sharing is a property of the item, so unsharing is too.
Ready to see it on your own work?
Zephyr is in development for iOS and Android. Join the early access list.