How we handle your details in the MyCSO demonstration.
This page covers the MyCSO demonstration environment operated by Rokos.io Corp. It describes what this environment actually does with your details — not what a policy template says it might.
This environment is invite-only. There is no sign-up form and no way to create yourself an account: sign-in is restricted to a list of approved email domains, and an address outside that list is refused before any account can exist.
To sign in you give us your work email address, and we email you a one-time code. That address is what we hold. We do not ask for your name, your company, your role, your phone number or anything else, and there is no form here that collects them.
Once you are signed in we record what you did: which reports you opened, which charts you opened or exported, and the questions you typed to Scarlett, the AppSec Analyst. We also record when you signed in, and the IP address and browser you arrived from.
We use it for two things: to run the demonstration, and so that a follow-up conversation can start from what you were actually interested in rather than from a blank page. The IP address is not used to work out who you are — you are signed in, so we already know.
When you first open this site we give your browser a random identifier and store it in a cookie, so that we can tell whether the same browser came back. It identifies a browser, not a person, and on its own it tells us nothing about who you are. When you sign in, that earlier activity is connected to you. We think you should know that plainly.
There are no third-party analytics or advertising scripts here, and nothing is shared with an advertising network. If your browser sends a Global Privacy Control or Do Not Track signal, nothing is recorded at all — no identifier is created and no request is sent. Clearing your cookies resets the identifier.
If you are in the EU, the EEA, the UK or Switzerland we ask you first. Nothing is recorded and no identifier is created until you choose “Accept”, and declining costs you nothing — the demonstration works exactly the same either way.
Questions you type to the AppSec Analyst are sent to a large language model to produce an answer, along with the structure of the demonstration data. They are not used to train anybody's model. Because every figure in this environment is synthetic, no real security information is involved in any of it.
Rokos.io Corp staff working on this demonstration. We do not sell it, and we do not share it with anyone for their own purposes. It is held in cloud infrastructure we operate in a dedicated account used for nothing else.
For as long as the demonstration is running and while we are in conversation with you about it. When the demonstration is retired, the accounts and the activity records go with it.
Email myceo@rokos.io and ask. We will tell you what we hold about you, or delete it, without requiring a reason. Deleting it removes your access to the demonstration, because the two are the same record.
Rokos.io Corp is the controller of this information. MyCSO is a product of Rokos.io Corp. Contact: myceo@rokos.io.
Last updated 22 September 2026.