# Secure and data-minimal

> Passkeys, sign-in warnings, roles and rights, complete log, encrypted credentials, servers in Germany – and only the cookies that are needed.

Tool data is business data: who had what and when, what it costs, which customer jobs belong to it. Tulz treats it accordingly – with passkey sign-in, roles and rights, a log that records every change, and servers in Germany.

What is not needed is not stored: no advertising, no tracking, only the cookies required for sign-in and security. Former employees are anonymised, the GDPR data disclosure comes at the push of a button.

## How it works in the workshop

1. **Sign in** – with password or passkey (fingerprint, face, security key); Microsoft 365 and Google Workspace can be connected ([Signing in with a passkey](https://tulz.work/en/help/article/sign-in-with-passkey-and-stay-signed-in)).
2. **Warning on anything unusual** – if an account signs in on an unknown device, a warning e-mail goes out; known devices can be viewed and removed in the profile.
3. **Grant rights** – roles, site binding, lending rules ([Roles and rights](https://tulz.work/en/help/article/roles-and-permissions)).
4. **Trace** – the log shows every change with name and time; entries can be copied and handed to support ([Log](https://tulz.work/en/help/article/log)).

## What comes with it

- Credentials for shops, brokers and services are stored encrypted in the database
- Password confirmation before sensitive actions, automatic sign-out after inactivity, lock after failed attempts
- Passwords are checked against lists of known leaked passwords
- Data disclosure and anonymisation under GDPR ([Data disclosure](https://tulz.work/en/help/article/data-access-report))
- Download all data – as an export with everything that belongs to the workshop ([Downloading data](https://tulz.work/en/help/article/download-all-data))
- Regular security reviews of the software, documented in the release notes ([Security](https://tulz.work/en/help/article/security))

## Who it is for

Every business – and especially franchised dealers whose manufacturer audits ask about data protection and access control.

## Frequently asked questions

### Where is my data?

On servers in Germany. The provider makes backups; in addition you can download a complete export at any time.

### What is a passkey?

A sign-in without a password: the device confirms with fingerprint or face, the secret key stays on the device. Phishing goes nowhere with it.

### Can support look into my workshop?

Only if you grant it – time-limited, read only or change as well, and every access is in the log by name.

---

Source: https://tulz.work/en/features/security-data-protection · As of 2026-10-14 · Tulz