# Security and compliance > Processes, never people: redaction, limited retention, hosting in France, a works council kit, and a DPIA template to run compliant audits. Source : https://tellmehow.io/en/security-compliance · Updated on : 2026-10-18 A tool that listens to employees and sees their screen has to make its safeguards verifiable. Here is what TellMeHow does, what it refuses to do, and what remains your responsibility. The security and compliance policy of TellMeHow rests on rules built into the product: it assesses processes, never people, participants stay in control of what they say and show, and the client sponsor never sees raw recordings. The product gives firms the documents compliance work calls for (works council kit, DPIA template, data processing agreement, AI Act classification note), without replacing a lawyer’s advice. ### Seven product rules, not up for negotiation These rules are not configuration options. No firm and no client sponsor can switch them off. #### We assess processes, never people The product computes no rating, no score, no ranking, and no individual comparison, whether in the interface, the exports, or the chat. The chat declines questions like "who is the least efficient?" #### No emotion analysis Tone, stress, and hesitation are never analyzed. We work with what is said and shown, not with how it is said. #### Participants know they are talking to an AI It is stated in the invitation and on the interview welcome screen. The AI interviewer never claims to be human. #### Participants stay in control They can pause, mute the microphone or stop screen sharing, share a single window, correct or remove a point in their recap, and delete a segment of the recording. Only the chapters they have validated feed the analysis. #### What is removed is truly gone A removed point or deleted segment is erased from the analysis, the evidence, the deliverable, the search index, and the sharing between interviews. It is not merely hidden. #### No capture outside a session Nothing is installed on the employee’s computer. Nothing is captured unless the interview page is open and a session is running. #### The client sponsor never sees raw data The sponsor views the deliverable and only the evidence the consultant chose to publish, attributed by role rather than by name by default. They have no access to any full recording or full transcript. ### AI Act The EU AI Act classifies as high-risk the systems that monitor or evaluate workers’ performance or behavior. A tool that maps processes should fall outside that category, provided it produces no individual analysis, which is exactly what the first product rule guarantees. We design the product as if the high-risk obligations already applied, so that it never comes under them. - Transparency (Article 50): participants are told they are interacting with an AI, starting with the invitation. - Emotion recognition in the workplace, prohibited by Article 5: the product performs no emotion analysis. - A classification note documents why the product is not high-risk; it is reviewed with every feature that touches on people. ### GDPR The audited company and, depending on the case, the firm act as data controllers; we act as a processor, and our hosting and AI providers as listed sub-processors. The intended legal basis is the employer’s legitimate interest, since an employee’s consent to their employer is considered fragile. Acceptance on the welcome screen serves to inform and commit, not as a legal basis. - Data minimization: raw recordings are kept for 90 days by default, adjustable per workspace and then per engagement. - Access: through their link, participants can see everything that concerns them, including transcript, recording, pins, and artifacts. - Erasure: a request to delete all of a participant’s data is handled by the firm in one action, cascading through the analysis and the deliverable. - A data protection impact assessment (DPIA) is very likely required; a pre-filled template is provided. ### Labor law and works councils In France, a tool that records voice and screen may be considered a means of monitoring employee activity, even when its purpose is an audit. Informing and consulting the works council (CSE) is then required, and court rulings in 2025 suspended AI tool rollouts for lack of consultation, including at the pilot stage. - A ready-to-share works council kit describes the engagement’s purposes, the data collected, the safeguards, and the retention periods. - Each engagement has a "works council informed or consulted on…" field, which the launch assistant flags for French companies. - Participation relies on explicit acceptance at the start of the interview: an employee who declines does not take the interview. ### Data security and hosting The application, its databases, its files, and the real-time server that receives voice and screen are hosted in France, with OVHcloud. Each firm has an isolated workspace: every record belongs to a workspace, and every request is filtered by workspace. AI processing, however, goes through the providers the firm chooses: by default OpenAI, which processes data in the United States under standard contractual clauses. The product shows where each provider is located, and European options are available for analysis, chat, and vision. - Personal interview links: random tokens stored as hashes, with a limited lifetime, revocable at any time, and an optional emailed code for sensitive engagements. - Firm accounts: two-factor authentication is mandatory for admins, can be required for consultants, and is available to sponsors. - Encryption of data in transit; AI provider API keys are encrypted, never displayed, and never written to logs. - Access log: every playback of a recording or reading of a transcript is recorded (who, when, which segment) and visible to the workspace admin. ### Redaction of sensitive data A shared screen often shows IBANs, card numbers, or customer contact details. Redaction is on by default: before a screen image is sent to the vision model, a text recognition engine running on our own servers detects this data using rules and check digits, with no call to an outside service, and the matching areas are blurred. No detection is perfect, for instance with handwriting or badly formatted data, and the product says so on the welcome screen. - Detected categories: IBANs, card numbers, social security numbers, third-party emails and phone numbers, and password fields; they can be adjusted per engagement. - The recorded video is redacted after the session; no one can view it before that, and the unredacted version is then deleted. - Participants can mask an area of their own screen for the rest of the session. ### Documents provided to the firm Each document is generated from the engagement’s actual settings: recipients, retention periods, redacted categories, and the AI providers used along with their location. #### Works council kit An information note for employee representatives covering the audit’s purposes, the data collected, the absence of individual assessment, participants’ rights, and the sponsor’s access limited to the deliverable. #### DPIA template An impact assessment pre-filled with the description of the processing, the technical measures, and the retention periods, for the data controller to complete and approve. #### Data processing agreement (Article 28) The contract that governs our role as processor, including the list of sub-processors for hosting and AI. #### AI Act classification note The reasoning that places the product outside the high-risk category, and the list of technical safeguards that support it. This page describes what the product does to support compliance; it is not legal advice. The final legal assessment of each processing activity rests with the data controller and their counsel. ### Frequently asked questions **Can the client sponsor listen back to the interviews?** No. In TellMeHow, the sponsor sees the published deliverable and only the evidence the consultant has selected, such as a short excerpt or a screenshot, attributed by role by default. They have no access to any full recording or full transcript. **How long are recordings kept?** Raw recordings (audio and screen video) are deleted automatically after 90 days by default, a period adjustable per workspace and then per engagement. The admin is notified seven days before the purge. The deliverable and published evidence follow their own retention period. **Can an employee decline the interview or have their data deleted?** Yes. The interview starts with explicit acceptance, and an employee who declines does not take the interview. They can also request deletion of all their data: the firm handles it in one action, and it cascades through the analysis, the evidence, and the deliverable. **Does the vendor have access to interview content?** Not by default. The platform team accesses an engagement’s content only as part of a support request from the firm, with a mandatory reason, and every access is logged and visible to the workspace admin. **Where does data sent to AI models go?** To the AI providers the firm has chosen for each use (voice, transcription, vision, analysis). By default, that is OpenAI, which processes data in the United States; real-time voice conversation currently relies on OpenAI, with Deepgram or ElevenLabs as options. For analysis, chat, and vision, the firm can choose a European option such as Mistral. Screen images are redacted before they are sent. --- - Français : https://tellmehow.io/securite-conformite.md