Security and trust
Three principles, and the facts that back them.
Tsuno knows your teams, your sites and your procedures. Here is how it treats people, where your data lives, and how to check every answer it gives.
The public demo runs on made-up data. Questions and transcripts are not kept. Only aggregated technical counters are recorded. If you request a trial, the contact details you enter are recorded in our CRM to handle your request.
The doctrine
The tool reminds. People decide.
-
Tsuno lines up the facts. It never judges a person.
What is allowed, what is refused, and why nothing runs without you.
Details -
Your data stays separated. Access follows your organization and your locations.
Who sees what, where your data is hosted, how you get it back.
Details -
No black box. Answers can show the facts and sources behind them.
Where each fact comes from, and what Tsuno says when data is missing.
Details
Page contents
Principle 1
Tsuno lines up the facts. It never judges a person.
It puts facts side by side: validated training, checklist done or not, incident, hours, agreed goal. When something does not hold, it looks first at the process, the training, the schedule. Not for someone to blame.
What Tsuno does with people
- Dated facts, with a note of where they come from.
- Training status: what is validated, what is still to validate.
- Hours, as declared or recorded.
- Incidents, tasks and agreed goals, with their history.
- Fact-based one-to-one prep: what happened, what had been agreed, nothing else.
- A suggested next action that you accept, change or ignore.
What Tsuno refuses to do
It is not a setting you switch on or a module you buy. Tsuno is built not to do it.
- Scoring a person in place of their manager.
- Predicting who will resign.
- Recommending who to dismiss.
- Inferring a person’s motivation, honesty, loyalty or mood from their messages.
- Sending a sanction or applying an adverse HR decision without a person confirming it.
- Cross-referencing sensitive data to profile someone.
From your AI assistant, too
Tsuno exposes no ranking of people to your assistant, and the instructions it gives the assistant ask for dated facts, never a judgment about someone.
Fictional examples, for illustration.
“Give each of my servers a score out of 10.”
I don’t score people. I can show you the dated facts by role instead: validated training, completed checklists. Would you like to see where training is missing on the evening shift?
“Tell me who is going to quit before summer.”
I don’t predict departures or guess anyone’s intentions. I can remind you of the facts: overdue one-to-ones, goals still open. Would you like to prepare those one-to-ones?
Nothing runs without your confirmation
In Tsuno or from your AI assistant, an action always follows the same path.
-
Tsuno prepares
It drafts the action from what you ask.
-
It sums up the effect
What will change, for whom, and where.
-
You confirm
Nothing goes out until you say yes.
-
It runs and logs
The action is carried out, then written to the log.
- Access is checked again when you confirm: if a right was removed in the meantime, the action does not go through.
- The log keeps who, when and what, with the state before and after the action.
Out of reach for the AI assistant, even when confirmed: payroll, invoicing and permanent data deletion.
Principle 2
Your data stays separated. Access follows your organization and your locations.
Tsuno is organized like your business: a brand, its locations, their teams. Everyone sees what their role and their locations open up to them, and nothing more.
Who sees what
- Checked on the server: every read and every write checks the brand, the location and the role, not just that someone is signed in.
- One brand never sees another, even with a guessed identifier.
- Removed access takes effect right away: roles are re-read continuously, and removing a site, a role or a person ends their open sessions.
- A tablet only sees its own location: the shared device in the kitchen or on the floor is limited to the site it is installed in.
- Separation is tested: automated tests across brands, sites and roles run with every change to the app.
Where your data lives
- Hosted in the European Union: the app and its data are hosted in Germany.
- The AI models (assistant, voice note transcription) come from providers based in the United States. The privacy policy details these transfers and their safeguards.
- Clock-in check photos are deleted seven days after they are taken.
- Our own team’s access is limited to authorized people, strictly as their work requires.
Demo and trial: never your real data in front of an audience
- Public demo: a separate environment, no account, made-up data. Questions and transcripts are not kept. Only aggregated technical counters are recorded. If you request a trial, the contact details you enter are recorded in our CRM to handle your request.
- Trial with 3 documents: an isolated environment, built from non-sensitive operational documents.
- No personal data in the trial: no employee or HR documents. Schedules are anonymized.
- Limited access, dated deletion: only the people you name get in, and the environment is deleted on the agreed date.
The trial walkthrough is on the Setup page.
Your data belongs to you
- You remain in charge of your data: for your teams and your customers, we act as a processor, on your instructions.
- When your subscription ends, your data stays available to you for thirty days, in a standard format.
The details are in our terms of service (in French).
A question before you decide? Write to us: [email protected]
Principle 3
No black box. Answers can show the facts and sources behind them.
A Tsuno answer rests on facts you can open. And not all facts are equal: Tsuno tells six kinds apart, and never mixes them up.
-
Recorded fact
Logged without input: a timestamp, an action Tsuno itself recorded.
-
Declared fact
Someone says it is done. Useful, but declared.
-
Attached proof
A photo, a document, a delivery note tied to the fact.
-
Observation
What a manager saw and noted, with its date, its author and its origin: seen first-hand, reported, written message.
-
AI inference
A link suggested by the AI, flagged as such, never presented as a fact.
-
No data
Nothing was recorded. Tsuno says so instead of filling the gap.
When an answer is fragile, it says so
- Missing data: what should be there and is not.
- Conflicting data: two sources that do not say the same thing.
- Low reliability: facts declared without proof, or filled in by the batch.
- Too little history: Tsuno won’t call something a habit after two occurrences.
Never “all good” when the reality is “no reliable data.”
Your AI assistant
Ask Tsuno from the assistant you already use
You can connect Tsuno to Claude, ChatGPT or another compatible assistant, and ask your questions where you already work. Three rules frame that connection.
- A connection tied to your rights: your assistant only sees and does what you can already see and do in Tsuno.
- Two-step actions: the assistant prepares, you read the summary, you confirm in a new message.
- No bulk extraction: reads are capped, so the connection cannot be used to pull out your data wholesale.
Governance
No figure without a measurement protocol.
No numerical result is published here without its written protocol, so you can judge the method and not just the number.
What we will publish, with its protocol
Among the indicators we track:
- Time to autonomy at opening
- Manager reporting time
- Recurring incidents closed
- Food waste
- Time from an anomaly to action
Each result will be published with its protocol.
Frequently asked questions
Can a manager see another site’s data?
Only if that site is assigned to them. Access follows the locations given to each person: a supervisor or an owner sees the sites in their scope, never those of another brand.
What happens when an employee leaves?
Their access is cut: deactivating them or ending their contract closes their open sessions. Their history (validated training, tasks, dated facts) stays in your workspace for traceability.
Is my data used for demos?
No. Demos run on made-up data, in a separate environment. What is in your workspace exists only in yours.
See Tsuno on your own documents.
Send three operational documents. We set up an isolated environment, walk you through it, then delete it on the date we agree together.
Non-sensitive documents only: recipe, procedure, checklist, anonymized schedule. No personal data.