Stickylink Workspace, Terms of Service

Last updated: November 3, 2026

1. What Workspace is

Stickylink Workspace is a multi-tenant SaaS workspace that pairs a one-time purchase of physical QR or barcode stickers (the "Workspace Roll", 200 stickers per roll) with a cloud workspace for labs, R&D groups, and manufacturing engineering teams. Assets are created from templates, attached to a scannable code, organized in nested folders, and, on the Document Suite plan, authored as controlled manufacturing documents.

2. Plans, seats, and pricing

• Workspace Solo, $29 USD per month ($290 per year) for one editing seat: unlimited records, custom templates, full audit history and Excel/CSV export. There is no free tier. First-time subscribers to Workspace Solo or Secure Workspace receive a one-month free trial; a payment method is collected at signup and billing begins when the trial ends unless you cancel before then.
• Workspace Roll, $45 USD one-time per 200-sticker roll, plus shipping and applicable tax. Rolls ship in 3–5 business days. Rolls work with the free workspace; no subscription is required to use them.
• Secure Workspace, $59 USD per month per organization, 5 editing members included, plus $10 USD per month for each additional member. Adds multi-QR asset mapping, stock and inventory counters, maintenance logs, scan-side quantity edits, and shared folders.
• Document Suite, $249 USD per month per organization with 5 included seats; additional seats are $40 USD per month each. Adds custom templates, the in-app document editor, revision control and releases, travelers, setup sheets, manufacturing instructions with sign-offs, AI autofill and AI document review, and print/PDF/email output.
• Optional implementation and custom template packages, $200–$3,000 USD per engagement, depending on scope, with a 72-hour turnaround and two included revisions. All subscriptions are fully self-serve; implementation is never required.
• Custom sticker backings are quoted and ordered inside the dashboard; proofs must be approved by an organization admin before production.

Subscriptions are billed monthly or annually through our payment processor and are cancellable at any time. Plan changes are applied to your existing subscription: upgrades take effect immediately and are invoiced prorated for the remainder of the period, while downgrades and cancellations take effect at the end of the current billing period. After a cancellation the workspace becomes read-only: creating and editing records, documents and templates is disabled, and existing records, documents and audit history remain viewable.

Membership rules by plan. On Workspace Solo, email invitations are disabled; additional people join by signing up with an email address on your organization's verified domain and being approved by an admin. Secure Workspace adds email invitations and includes 5 editing members, with additional members at $10 USD per month each. Document Suite includes 5 seats with additional seats available at $40 USD per month each. Scanning a code and viewing a public record never consumes a seat.

3. Beta status

Workspace is offered as a beta product. It is provided "as is" and "as available" and may have bugs, downtime, and evolving features. We are actively working toward SOC 2 Type II and other attestations, see the Compliance Roadmap, but no such attestations exist today.

4. Security, how your data is protected

Workspace is built on managed cloud infrastructure with the following controls. These are descriptions of current product behavior, not certifications or guarantees.

• Encryption. All traffic is served over HTTPS/TLS. Database and file storage are encrypted at rest by our infrastructure provider.
• Tenant isolation. Every asset, template, document, folder, and audit entry is scoped to an organization ID and enforced with row-level security in the database, not just in the app. A member of one organization cannot query another organization's rows.
• Domain-locked organizations. A workspace can only be created for the email domain the creating user has verified, which prevents someone from claiming a domain they do not control. Later signups on the same domain require admin approval, and invites expire after 14 days.
• Role gating. Roles are stored separately from user profiles and checked server-side. Only organization admins can restructure or delete folders, approve members, transfer admin rights, release document versions, or download backing artwork.
• Sticker claim codes. Editing a scanned sticker requires the printed claim code, so scanning alone never grants write access. Claim tokens are rotated when a sticker is claimed.
• Private file storage. Uploaded PDFs, images, and videos are stored in private buckets and served through short-lived signed URLs issued only to authorized members. Files are not publicly listable.
• Shared snapshots. Read-only document links at /v/:token expose a frozen snapshot through an unguessable token and no edit surface. Treat those links as sensitive and share them deliberately.
• Immutable audit log. Reads, edits, quantity changes, releases, and approvals are recorded append-only with actor, timestamp, and action.
• Multi-factor authentication. Members can enable TOTP MFA on their account; admins are strongly encouraged to do so.
• Payments. Card data is handled entirely by our PCI-compliant payment processor. We never see or store card numbers.

What we do not claim. Workspace is not HIPAA-, PCI-, ITAR-, FedRAMP-, or 21 CFR Part 11-certified, and we do not sign BAAs. We do not offer a contractual uptime SLA during beta. Do not treat anything on this page as a certification, audit result, or legal advice.

Report suspected vulnerabilities to hello@stickylink.io. We will acknowledge reports and ask that you avoid accessing other organizations' data while testing.

4a. Incident response and breach notification

We maintain a written incident response process covering detection, triage, containment, customer notification, and post-incident review. A summary of that process, including our severity levels and target response times, is published at stickylink.io/incident-response and forms part of these Terms.

• Notification. If we confirm a security incident that has compromised, or is reasonably likely to have compromised, your organization's data, we will notify the organization admin by email without undue delay and in any case within 72 hours of confirmation, with what we know at the time, what we are doing, and what you should do.
• Follow-up. We will provide a written post-incident summary within 30 days of resolution, including root cause and corrective actions, to affected organizations on request.
• Your obligations. You must keep at least one reachable admin email address current, notify us at hello@stickylink.io promptly if you suspect an account compromise, credential leak, or misdirected share link, and remove access for departed members. Compromises caused by shared passwords, leaked/v/:token links, or missing MFA on your side are your responsibility to contain.
• Regulator notices. Because Workspace prohibits regulated data, we do not act as a HIPAA business associate and do not file breach notices on your behalf. Where we process personal data as your processor under GDPR-style rules, we will assist you with the information you reasonably need to make your own notifications.

4b. Availability, backups, and recovery

Workspace data is stored in a managed Postgres database with automated daily backups and point-in-time recovery retained by our infrastructure provider; uploaded files are stored in redundant object storage. Our internal targets during beta are a recovery point objective (RPO) of 24 hours and a recovery time objective (RTO) of 24 hours for a full-service outage. These are targets and internal commitments, not a contractual SLA, and no uptime credit is offered during beta. Because backup restores return the workspace to a point in time, you should keep your own Excel/PDF exports of any record you cannot afford to lose.

5. AI features

Document autofill and the AI review helper send the content you submit (uploaded PDFs, spreadsheets, documents, or images, and the document text being reviewed) to a third-party model provider through our AI gateway to produce suggested field values, spelling corrections, and improvement notes. AI output is suggestive only: it can be wrong, incomplete, or misread a drawing. You remain responsible for reviewing and approving every field before release. Do not submit content you are not permitted to process with a third-party service, and do not rely on AI output for safety, regulatory, or engineering sign-off.

6. Documents, revisions, and releases

Documents may be saved as revisions and promoted to releases. Releases are intended as controlled records: once released, a version snapshot is retained and cannot be edited in place. Sign-off fields and approval names are recorded as entered by your team. Stickylink provides the recordkeeping mechanism, it does not validate that your process meets any quality standard, and released documents are not a substitute for a validated QMS.

Printed and emailed copies. Documents you print, download as PDF, or send by email are stamped with a StickyLink QR code in the page header. Scanning that code opens the live record so a reader can confirm the current revision. A printed or emailed copy is a point-in-time snapshot and may become out of date after a later release; the record in Workspace is the controlling copy. You are responsible for how printed copies are distributed and withdrawn within your own document-control process.

7. Upload limits and acceptable files

Attachments include PDFs, spreadsheets, documents, images, and short videos. Video clips are limited to 3 per asset, 10 seconds, and 25 MB each. We may enforce additional storage or rate limits, and may remove files that violate these Terms.

8. Prohibited data (IMPORTANT)

You may not upload, transmit, or store the following categories of data in Stickylink Workspace:

• Protected Health Information (PHI) subject to HIPAA
• Payment card data subject to PCI DSS (cardholder numbers, CVV, etc.)
• Classified national security information, at any level
• ITAR- or EAR-controlled technical data
• Clinical trial records subject to 21 CFR Part 11 or FDA electronic-records rules
• Raw experimental data, pre-publication research findings, patent-sensitive lab notebooks, or proprietary formulations and compositions
• Any data your organization is contractually or legally required to keep in a certified environment (ISO 27001, FedRAMP, HITRUST, validated GxP/GLP systems, etc.)

8a. Labs, research, and controlled technology

Stickylink Workspace is intended for operational lab workflows — equipment checklists, calibration logs, sample custody travelers, SOP sign-offs, reagent inventory, and safety inspections. It is not an Electronic Lab Notebook (ELN), LIMS, or primary research-data repository. Keep your controlled research records, raw experimental data, novel methods, and proprietary compositions in your own validated or institution-managed systems, and use Stickylink only for the sticker-linked operational layer on the floor.

If your research involves export-controlled technology, defense funding, citizenship or data-residency restrictions, or GLP/GMP/GxP validation requirements, Stickylink is not appropriate. You are responsible for confirming that your use of Workspace complies with your institution's policies, grant requirements, and applicable laws before uploading any research-related content.

If you cause us to receive such data, we may suspend your account and delete the data without notice. You indemnify us against any resulting regulatory action.

9. Domain-based accounts

Workspace organizations are keyed to your corporate email domain. The first user on a given domain becomes the organization admin; subsequent signups on the same domain require admin approval. You represent that you are authorized to bind the entity that owns your email domain to these Terms.

10. Immutable audit log

The audit log is append-only by design and is not editable, exportable-with-deletions, or removable except through account termination. This is a feature, not a bug, intended to support your inspection cycles.

11. Data retention & archival

"Deleted" assets are archived rather than hard-deleted so historical records remain queryable. On account termination, we retain data for up to 90 days for restoration, after which it may be permanently removed. Excel export is available on every plan so you can take your records with you.

12. Governing law

These Terms are governed by the laws of the United States, without regard to conflict of law principles. Disputes will be resolved in the state and federal courts of your principal place of business unless the parties agree otherwise in writing.

13. Disclaimers

Workspace is provided "as is" and "as available" without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant uninterrupted availability or that data will be preserved without loss.

14. Limitation of liability

To the maximum extent permitted by law, Stickylink and its team will not be liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, or data arising out of your use of Workspace. Our total liability for any claim relating to Workspace will not exceed the greater of $100 or the amount you paid us for Workspace in the 12 months preceding the claim.

15. Indemnification

You agree to defend and indemnify Stickylink from any claim arising out of the data you upload (including any prohibited data listed above), your use of Workspace, or your violation of these Terms or any law.

16. Changes

We may update these Terms. Material changes will be announced in-app or by email. Continued use after the update constitutes acceptance.

Questions? Contact us at hello@stickylink.io.