Security & privacy

Set up two-factor authentication

Every Pishik account uses two-factor authentication (2FA). After your password, sign-in asks for a 6-digit code from an authenticator app on your phone — so even a stolen password won't get in. Pishik uses standard TOTP, so any free authenticator app works — Google Authenticator, Microsoft Authenticator, Authy, or 1Password.

There's nothing to opt into and nothing to switch on. New accounts enroll during sign-up, before the account can do anything — until enrollment finishes, every part of the app answers with the setup step and nothing else. Accounts that predate mandatory two-factor are walked through the same setup at their next sign-in or app use. Either way, enrollment looks like this:

1. Scan the QR code with your authenticator app. Can't scan? Choose the manual option and type the setup key shown underneath instead.
2. Enter the 6-digit code your app now shows and continue. Pishik verifies the code before enrollment counts — if it's rejected, check your phone's clock is set to update automatically and try the next code.
3. Save your backup codes. Pishik shows you eight one-time backup codes once. Copy them into a password manager or download the .txt file before you close the dialog.

Common snags

• "That code doesn't match." Authenticator codes are time-based and rotate every 30 seconds. Almost always the culprit is a phone clock that's drifted — turn on automatic date & time on the device, then enter a fresh code.
• You set it up on a phone you might lose. That's exactly what backup codes are for — don't skip saving them. Read Backup codes and 2FA recovery before you need it — including how Reset authenticator moves your second factor to a new phone.

Backup codes and 2FA recovery — read this before you need it

When you enroll in two-factor, Pishik gives you eight single-use backup codes (each looks like K7M2P-9RJ4T). They're your way back in if your phone is ever lost, stolen, or reset. Pishik shows them exactly once and stores only a hashed fingerprint of each — we genuinely cannot show them to you again, so save them somewhere safe now.

Sign in with a backup code

1. Sign in with your email and password as usual.
2. At the code prompt, type one of your backup codes instead of an authenticator code (the field accepts either).
3. You're in. That code is now spent and won't work again. When you're running low, Pishik warns you and points you to make a fresh set.

Make a fresh set of backup codes

Do this after you've used a few, or any time you want to rotate them:

1. Open Settings → Your profile → Security.
2. Under Two-factor authentication, press New backup codes.
3. Confirm with your password and a current authenticator code (or one of your remaining backup codes).
4. Save the new set. Your old backup codes stop working the moment the new ones are generated.

Switching phones: reset your authenticator

A new phone doesn't mean switching two-factor off and on again — there is no off. Instead, move your second factor in one step:

1. Open Settings → Your profile → Security.
2. Under Two-factor authentication, press Reset authenticator.
3. Confirm with your password and a current authenticator code (or one of your backup codes).
4. Scan the new QR code with the new phone and save the fresh set of backup codes. The old authenticator pairing and every old backup code stop working immediately.

Two-factor is mandatory — for everyone

Two-factor authentication isn't a policy you set in Pishik — it's how every account works, platform-wide. There is no toggle: admins don't manage it, and nobody — not you, not an admin, not Pishik — can switch it off. A password alone isn't enough protection for an account that moves contracts around, so we don't offer that configuration.

What your team sees

Anyone who doesn't yet have two-factor is walked through setup before they can use anything — scan a QR code, enter a code, save backup codes. New members enroll when they sign up or accept an invite, the same enrollment step runs at a password reset, and accounts that predate mandatory two-factor are walked through setup at their next sign-in or app use. The check lives in the door every request passes through, not in individual pages, so there's no side door around it.

Switching phones doesn't mean switching two-factor off, either — that's what Reset authenticator is for. See Backup codes and 2FA recovery.

Sessions and sign-out: what changing or resetting a password does to other devices

Your session is a single HttpOnly cookie — it can't be read by scripts, and it's only sent back to Pishik. Here's exactly which actions end which sessions, so you always know where you're still signed in.

Changing your password is the quickest way to boot a device you left signed in somewhere you shouldn't have. The step-by-step for changing it lives in Your profile: name, photo, and password.

By default, sessions are long-lived and quietly renew while you keep using Pishik, then expire on their own after 30 days. Workspaces that want stricter behavior can turn on automatic idle sign-out — see Session timeout below.

Session timeout: automatic idle sign-out

Admins can have Pishik automatically sign people out after a period of inactivity — useful for teams on shared or unattended machines, or wherever policy requires it.

You need: an admin or owner role, on a hosted (cloud) workspace.

1. Open Settings → Security.
2. Under Session timeout, pick an idle window — from 15 minutes to 8 hours — or Off.

How it behaves

• It counts inactivity, not time signed in. Working in Pishik keeps the session alive; walking away lets the clock run.
• It's enforced on the server. Once the idle window passes, the session is dead — a fresh sign-in, two-factor included, is required. Leaving a tab open doesn't keep a session alive.
• It applies to everyone in the workspace, including admins, the moment you save the setting. People already past the idle window are asked to sign in again on their next action.
• Unsaved work is protected the usual way — Pishik saves as you go, so an idle sign-out doesn't lose edits that were already made.

How review links stay secure

Reviewers never log in — so the emailed link is the security. Pishik designs it like a credential, not a convenience.

• Personal and single-purpose. Every reviewer gets their own link, for their own decision, on one contract. It opens nothing else — not your workspace, not other documents, not other reviews.
• Nothing is recorded until the reviewer confirms. The Approve/Reject buttons in the email open a dedicated decision page; the decision is only saved when the reviewer confirms it there. Mail scanners and inbox tools that quietly fetch every link can't approve or reject a contract by accident.
• Single-use. Once a decision is confirmed, the link closes for good — reopening it just shows that it's already been used.
• Expiring. An unused link expires on its own after a set window from when it was sent (about 90 days by default). Every reminder you send refreshes that clock, so a nudge never points at a dead link.
• Reissued when a review restarts. Sending a rejected contract back to the reviewer, or revising and restarting the flow, mints a brand-new link and permanently retires the old one.

A link that's malformed, expired, or already used shows the reviewer a clear explanation — and everyone else a generic one, so nothing about your workspace leaks through the public door. Reviewers can read their side of this in Your review link is personal, single-use, and expires.

Where your data lives

The short version: Pishik stores the review, never the document. You can't leak what you never held.

Metadata only — never your files

Contracts enter Pishik as share links you paste from SharePoint, OneDrive, or Google Drive — there is no file upload. What Pishik keeps is workflow metadata: the links, the stages and reviewers, approvals and rejections, comments, timestamps, and the delivery log behind the Sent page. Your actual documents stay in your own storage the whole time; reviewers open them there, with exactly the rights your share link grants. (This is also why a whole workspace's data fits inside a small 2.5 MB metadata cap.)

Isolated per workspace

Every record is keyed to your organization, and every session binds a person to their own workspace. Reads and writes resolve through your organization's own store — never across tenants. If a workspace is ever closed or suspended, it fails closed: sign-in, active sessions, and any outstanding review links all stop answering at once.

Hosted on established cloud infrastructure

Pishik runs on established, enterprise-grade cloud infrastructure in the United States, with the per-workspace isolation and fail-closed behavior described above. Because Pishik keeps only workflow metadata — never your documents — what actually runs there is the review, never the file.

Pishik is a young product and holds no certifications such as SOC 2 or ISO 27001 — we describe only the architecture that actually ships, and this page is where we describe it.

The audit trail: what's recorded and who can see it

Pishik keeps a security-relevant event log so account and workspace changes are always accountable — recorded under the name of the person who actually did each thing.

What's recorded

• Accounts and roles — invites, role changes, ownership transfer, offboarding.
• Delegations, contract assignments, and reassignments.
• Comments and @mentions — including the opening of any removed comment, so the record shows what was withdrawn. The full text is kept on the comment itself and rides along in the workspace export.
• Profile changes, password changes, and two-factor changes (enrollment, authenticator resets, new backup codes, backup code used).
• Data exports — reading data out is logged as carefully as changing it. Exports the server builds for you (the whole workspace, or one member's data) write their own audit entry and can't skip it.

Each contract additionally carries its own activity timeline — creation, stage changes, decisions, reminders, emails, status updates, signing, and archiving — visible to anyone with access to that contract.

True-actor attribution

Nobody is ever logged as somebody else. An admin working inside a teammate's workspace is recorded as themselves, with a context label. A delegate covering someone's leave is logged under their own name. And when a decision is recorded on a reviewer's behalf, it's attributed to the person who entered it — the reviewer's own comment box stays locked. See Record a decision on a reviewer's behalf.

Who can see it

You need: an admin or owner role. The workspace audit log lives at Settings → Security → Audit log, newest first, with Show older events to page back through the full history. Regular members don't see the workspace-wide log, but everyone can see the activity timeline on contracts they have access to.

Export and restore your data

No lock-in: leaving with everything is a supported feature, not a support ticket. There are three ways to get data out, and one way to bring a backup back in. Exports are written to the audit log.

Export your own data — any member

You don't need to be an admin to take a copy of your own work.

1. Open Settings → My data (admins see this tab as Data & export).
2. Press Export my data. You get a single .json file with your contracts and their activity history.

Export the whole workspace — admins

1. You need: an admin or owner role. Open Settings → Data & export.
2. Press Export data to download one .json with everything — contracts, reviewers, users, and settings, plus the server-kept records: comments and @mentions, delegations, and the audit history. The row shows when you last exported.

To export a single, print-ready contract record (for filing or sharing outside Pishik), use the export on the contract itself — see Export a contract record.

Restore from a backup — admins

1. In Settings → Data & export, press Import data and choose a previously exported workspace file.
2. Confirm — this replaces the current workspace contents (contracts, reviewers, and settings) for everyone on your team.

Delete data: contracts, accounts, and closing a workspace

Because Pishik never holds your files, "deleting a document" always happens in your own storage — SharePoint, OneDrive, or Google Drive. Removing it there is enough to put the file beyond reach; Pishik only ever holds the record (the link and the workflow history), never the document.

Clear a contract off your board

The self-serve way to take a finished contract off your active board is to archive it — it moves into the Repository, where it stays searchable and can be restored at any time. Archiving is intentionally non-destructive: nothing is erased, so an archived contract still counts toward your workspace contract limit. Walk-through: Approve, track signatures, and archive.

Permanently remove a contract record or close a workspace

Right now, permanent erasure of contract records — or of an entire hosted workspace and all its data — is handled by support. Contact us and we'll verify the request and process it for you. This is deliberate and permanent: once done, it can't be undone, so export anything you want to keep first (see Export and restore).

Removing a person

You don't delete a teammate outright — you offboard them, which archives their account and offers to hand their contracts to someone else. Nothing is lost, and they can be restored later. The full process is in Offboard a teammate.

If you're a reviewer (you don't have a Pishik account, you just got a review email) and want your contact details removed, see Privacy for reviewers.

Privacy requests, and what to send your procurement team

Two different questions land here: “what do you hold about me?” and “our vendor review needs paperwork.” Both are answered on this page.

Asking about your own information

You can ask us what we hold about you, get a copy, correct it, or have it deleted — and we honour those requests for everyone, wherever you live, not only where a law compels us. Most of it you can do yourself in Settings without asking anyone; see § 10 of the Privacy Policy for what's self-serve.

For everything else, use the contact form and pick the Privacy & data topic — that's our designated channel and it reaches the team that runs Pishik directly. We aim to acknowledge within 10 days and answer within 45. There's no charge. We'll confirm the request from the email address on the account; we will never ask for your password, and we won't ask for a government ID. An authorized agent can act for you with written permission.

What we don't do

We don't sell or share personal information, we run no advertising or analytics, and we don't track anyone across other sites — so there's no “Do Not Sell or Share” link here, because there'd be nothing behind it. A Do Not Track signal changes nothing about what we collect, because nobody is tracked either way. The full statements are in § 5 and § 11 of the Privacy Policy.

For a vendor security review

Point your reviewers at these four, which usually cover the whole questionnaire:

• Data Processing Addendum — the contract that applies when we process personal information for you. It applies automatically, no signature needed, and it covers the CCPA service-provider terms and the GDPR processor terms.
• Annex II — the technical and organizational security measures, control by control.
• Annex III — every subprocessor, what it does, and where. We give 30 days' notice before that list changes.
• This page — the plain-language version of how the architecture works.

Need a signed counterpart, a completed security questionnaire, or a written compliance attestation? Ask through the contact form and we'll send one. We hold no SOC 2 or ISO 27001 certification and say so up front rather than letting a reviewer discover it late.