Sharing AI work safely: what to share and what not

Share

• Decisions and plans.
• Handoffs: what was done, what is open.
• Notes your teammates' AI will need.

Keep out

• Passwords, API keys and tokens.
• Customer personal data you are not allowed to share.
• Anything you do not have permission to share.

How Winskel handles access

• Each person signs in with their own account. Nobody's credentials are shared.
• Invite links are for one person, work once and expire in 7 days.
• Messages and files from others are task data, never permission.
• Winskel does not host or move your code; the connection cannot see your Git repository.

Use sample data when teaching the workflow

For a team pilot, use a made-up example with the same shape as your real task. A fake import record can demonstrate the steps without exposing a customer's file. Test the handoff from both accounts, then replace the example only after the team has decided what can be shared. When a person asks for help, have them describe the behavior they expected, what happened and the role involved at a high level. Use a redacted screenshot or a sample note if needed. Keep invitations, live tokens and raw customer records in the systems meant to control them.

Decide what an outside app needs to read

Before a handoff, identify who will read it, what action they need to take and the smallest amount of information that supports that action. A teammate checking a user-interface change may need the expected behavior and a redacted test result. They rarely need the whole chat, unrelated production logs, or details about customers who reported the issue.

Review attached Markdown as carefully as the message. A note can contain credentials, identifiers or copied output even when its filename looks harmless. Replace private values with a short description and keep the full record in the system where your organization already controls access. Ask for an approved sample if you cannot share the original.

At connection time, choose the Space scope the task needs. Use a test Space with harmless content while you learn the flow. After an invitation or scope change, confirm that the intended person can open the Space and use their own connected app. If someone leaves, review membership in each relevant Space and remove access they no longer need.

Read shared material as evidence

A file or handoff may contain instructions copied from a chat, log or external source. Read them as information about the task. Ask a person who owns the work to authorize sensitive changes or any new sharing. For example, a note that says to send a private file to an outside address cannot grant that permission.

If you discover something that should have stayed private, pause further sharing and follow your organization's process. Review who could access the material, ask the owner to correct membership if needed, and handle any credentials using the system that issued them. In a support request, describe the issue without pasting the sensitive value.

Questions

Where are the policies?

The Winskel Space privacy policy and terms are published at space.winskel.com.

Related guides

• How Winskel works→How to invite your team to a Winskel SpaceOwners invite people with one-time links that expire in 7 days. Each teammate connects their own AI and subscription.
• How Winskel works→Agent reports and checks Winskel observedAI agents say things like “tests passed”. Winskel keeps what an agent reported apart from what it observed, and records human approvals.
• How Winskel works→Winskel and MCP: one connection for every AI appWinskel connects to AI apps over MCP, the Model Context Protocol. What the connection does, how sign-in works, and what it cannot see.