CoSec
CoSec is a Swiss business AI for private security, event safety and crisis management professionals. It turns their questions into signature-ready French deliverables: security concepts, risk analyses, emergency action sheets. Hosting and inference stay entirely in Switzerland.
What is CoSec?
CoSec is a Swiss business-specific AI platform for private security, event safety and crisis management. It runs in the browser at app.cosec.ch, with no mobile application, and is published by OlOxOn Sàrl, a very small company based in Thônex, near Genève. The interface, the skills and every document produced are in French, in the terminology used in French-speaking Switzerland.
The product is built around skills: reusable professional competences pairing an expert prompt with reference material. The ready-made catalogue covers security concepts, risk analyses, fiches réflexe (emergency action sheets), meeting minutes, security instructions, crisis statements, crowd flow management and people density. The right skill is routed automatically from the question asked, or triggered by hand from the chat's slash menu, and any skill can be switched off and back on. With Magic Skill, a few sentences describing a need are enough for the AI to write a complete skill: title, description, expert prompt with its workflow, and professional guardrails. Skills import and export as plain Markdown .md files, in a format compatible with Claude Skills (Markdown with YAML frontmatter).
Every request goes through a four-phase guided workflow — Understanding, Collection, Validated summary, Deliverable — and the AI writes nothing until the user has approved the summary. Uploaded PDF, DOCX, XLSX, MD and TXT files feed a retrieval layer combining vector and full-text search, with answers citing their source by name, section number and page. Alongside it, a real-time multi-user main courante (running incident log) records timestamped entries with photos, a G1/G2/G3 severity dashboard, .xlsx and .csv exports and an AI-written end-of-mission Word report. Work is organised by project, one space per mandate, event or site, and an organisation memory injects house terminology, chain of command and writing standards into every answer. Word exports carry the organisation's logo from the Team plan upwards.
Inference runs on open-source models operated by Infomaniak AI Services in Genève and Zurich: Qwen3.5-122B-A10B-FP8 for the main chat, Mistral-Small-4-119B-2603 for routing and draft tasks, and BGE Multilingual Gemma 2 for retrieval embeddings. Against hallucination the vendor claims three guardrails: a strict “I do not know” rule, the mandatory four-phase workflow and sourced retrieval. It states plainly that human verification of the final deliverable remains indispensable, because you are responsible for what you sign.
What it does
- Draft a concept de sécurité (security concept) for a site, an event or a mission
- Produce a risk analysis together with its criticality matrix
- Generate fiches réflexe (emergency action sheets) and written security instructions
- Keep a timestamped main courante (running incident log) and turn it into an end-of-mission report
- Write a crisis statement and the minutes of a meeting
- Size a venue capacity and analyse crowd flows and people density
- Audit an existing document: a specification, an evacuation plan, a concept due for revision
When to use CoSec / When not to
A quick filter to help you decide if CoSec is the right fit.
When to use CoSec
- Swiss private security and event safety professionals who have to produce written deliverables — a concept de sécurité (security concept), a risk analysis, a fiche réflexe (single-page emergency action sheet) — in French and ready to sign.
- Independent consultants running several mandates at once, who need one workspace per assignment and a low monthly entry price (Solo plan).
- Security firms, engineering consultancies and event agencies of up to five people sharing a credit pool and a single house terminology (Team plan).
- Municipalities, public services, local police forces and fire services that buy on quotation and invoice and need a DPA adapted to their own legal framework (Enterprise plan).
- Organisations that must be able to state exactly where their data sits and under which law, including security and continuity managers who want a crisis workspace independent from corporate IT.
When not to use CoSec
- Consumers and anyone under 18: CoSec is a strictly business-to-business service reserved for professionals.
- Teams working in any language other than French — the interface, the skills and the generated documents exist in French only, in the terminology of French-speaking Switzerland.
- Anyone after general-purpose writing, translation, coding or idea generation; the site itself points those uses back to mainstream assistants.
- Developers and IT teams needing a public API, packaged software integrations or a native mobile app: no API documentation is published, there is no iOS or Android application, and SSO and business integrations sit on the Enterprise plan only.
- Buyers looking for a permanently free tier, or intending to publish AI output without review: there is none, and the vendor insists that the person who signs the deliverable stays responsible for it.
How to use CoSec
A typical end-to-end flow, from setup to results.
- Sign up online at app.cosec.ch and start the 7-day trial straight away: the vendor advertises no appointment and no prior sales conversation on the Solo and Team plans.
- Log in through the magic link sent by email; passkeys and 2FA recovery codes are available, and sessions last seven days at most.
- Enter a payment method at sign-up: nothing is charged before day 7, a reminder email arrives two days before the trial ends, and cancellation takes one click from app.cosec.ch/settings/billing.
- Create a project for the mandate, event or site you are working on.
- Upload your reference documents — internal regulations, earlier security concepts, professional standards, specifications — which are indexed within seconds.
- Fill in the organisation memory so that your terminology, chain of command and writing standards carry into every answer.
- Ask your question in plain language: the right skill is routed automatically, or picked by hand from the chat's slash menu.
- Work through the four phases — Understanding, Collection, Validated summary, Deliverable — approving the summary before the AI drafts anything, then export to Word.
- During an event or a mission, log timestamped entries in the main courante (running incident log), close it, and have the end-of-mission Word report generated.
- Add your own skills by writing them, importing an .md file or letting Magic Skill generate them; Team includes a 30-minute video onboarding, while Enterprise starts with a free one-hour scoping workshop (answer within 48 hours), then a quotation and an adapted DPA, then a pre-configured go-live.
Pros & Cons
Pros
- Hosting and inference entirely in Switzerland with Infomaniak Network SA, in datacentres the host owns and operates directly: Genève az-1 and az-2, Zurich az-3.
- Swiss law only and jurisdiction in Genève, with a claimed immunity from the US CLOUD Act, FISA 702 and the Patriot Act.
- No training on customer data, backed by a contractual undertaking from the AI provider.
- Unusually complete public legal documentation for a company this size: terms, privacy policy, DPA, named subprocessor list and legal notice, all downloadable as PDF with no sign-up and no form.
- Subprocessors named (Infomaniak Network SA, Stripe Payments Europe Ltd., Let's Encrypt) and excluded providers listed just as explicitly (OpenAI, Anthropic, Google Gemini, AWS, Azure, GCP, Cloudflare, Google Analytics, Hotjar, Mixpanel, Meta Pixel), with 30 days' notice before any addition and a right to terminate free of charge.
- Skills designed by a practitioner rather than a generalist: the founder has over 25 years in the field and has been safety coordinator of the Course de l'Escalade since 2019.
- Public prices in CHF with no commitment and cancellation at any time without penalty, and claimed portability: skills in standard Markdown, plus export of conversations, incident log and documents whenever you want.
Cons
- No permanently free plan — only a 7-day trial, which the site states plainly.
- French only: the interface and the generated deliverables exist in no other language, and none is documented.
- No public API and no API documentation, no native iOS or Android application, and SSO and business integrations reserved for the Enterprise plan.
- Credit system: one credit equals one complete conversation, and monthly credits do not roll over from one month to the next; only purchased top-ups are permanent.
- Team is capped at five users, beyond which you move to a quotation; the organisation logo in Word exports is not included on Solo; and during the trial, Word exports carry a red Document d'essai, ne pas utiliser en production (trial document, not for production use) banner.
- The ISO 27001, 9001, 14001 and 50001 certifications and the annual penetration tests shown on the product page are Infomaniak's, the host's — not CoSec's and not OlOxOn Sàrl's. No security certification or audit of CoSec's own is published.
- A very young and very small publisher: the company was entered in the commercial register in 2026 and has a single managing officer, who also answers support himself. TWINT is announced as a payment method but is not yet available, pending Stripe approval.
Pricing & Plans
There is no permanently free plan. CoSec offers a free 7-day trial on the Solo and Team plans, with 0 CHF charged during the trial and cancellation in one click. Paid access starts at 39 CHF/month for Solo, or 390 CHF/year with two months free. Team costs 149 CHF/month or 1,490 CHF/year for up to five users; the site presents it against five Solo seats, 149 CHF instead of 195 CHF, a 23% saving. The Enterprise plan is quoted individually, with user and credit volumes matched to the organisation and payment on invoice by bank transfer. All prices are published in Swiss francs, excluding tax, with no commitment and no minimum term. Credit top-ups are permanently available at 19 CHF for 50 credits, 49 CHF for 150 credits and 129 CHF for 500 credits. Solo and Team are paid by Visa, Mastercard, American Express or Apple Pay through Stripe, and European customers are billed in CHF, their bank applying the conversion.
- 1 user
- 100 AI credits a month
- 2 GB of storage
- the CoSec skills catalogue
- custom skills
- organisation memory
- Word export
- the four-phase guided workflow and email support within 72 hours.
- up to 5 users
- 500 shared AI credits a month
- 50 GB of storage
- everything in Solo plus the organisation's logo in Word exports
- unlimited projects
- roles and permissions
- an official PDF invoice
- priority support within 24 hours and a 30-minute video onboarding session.
- everything in Team plus a free one-hour video scoping workshop before subscribing (answer within 48 hours)
- user and credit volumes matched to the organisation
- a DPA customised to its legal framework
- standard invoicing
- pre-configured skills and organisation memory
- and priority support within 24 working hours.
Data, GDPR & hosting
A consolidated view of how CoSec handles your data.
GDPR overview
CoSec makes no GDPR compliance claim anywhere. OlOxOn Sàrl declares the service subject exclusively to Swiss law — the LPD and its ordinance OPDo — under the supervision of the PFPDT in Bern, with Genève as the place of jurisdiction, while stating the service is open worldwide. For customers in the European Union it relies on Switzerland's adequacy decision, which allows transfers from the Union without additional safeguards, not on GDPR conformity. Rights are listed by LPD article: access (25), rectification and erasure (32), release of data (28) and objection (30), handled within the 30-day statutory deadline (OPDo art. 18). Contact point: legal@cosec.ch; no formal data protection adviser is appointed, optional under Swiss law for private controllers (art. 10 LPD), and no representative under art. 27 GDPR exists. A DPA is published and downloadable, customisable on the Enterprise plan. Documents are Version 0.1, last updated 1 May 2026.
Who owns the data?
Clause 10.4 of the terms states that User Content — uploaded documents, conversations, notes, custom skills, projects and vault files — remains the customer's exclusive property, including skills written through Magic Skill or the skill editor. The customer grants OlOxOn Sàrl only a non-exclusive, worldwide, royalty-free licence, limited to the hosting period and to what is strictly necessary to run the service: chunking, embedding, indexing, storing, backing up and returning the content. The software, source code, interface, system skills, templates and knowledge bases remain OlOxOn Sàrl's property, and the system prompt is never disclosed. Under the DPA the client organisation stays the controller and OlOxOn Sàrl acts only on documented instructions, with strict isolation between organisations.
Reuse rights
Customers keep full freedom over their own material: conversations, the main courante (running incident log), documents and skills can be exported at any time, the Word deliverables are theirs to use, and custom skills travel as standard Markdown files — no permission to ask. On the vendor's side the only declared purpose is running the service. Clause 9.6 of the terms, the DPA and section 5 of the privacy policy rule out any training, retraining or model improvement on customer data; the underlying undertaking not to reuse client requests for training is a contractual commitment of Infomaniak AI Services, which OlOxOn Sàrl carries over into its own terms. No third-party analytics or marketing pixels are used, Google Analytics, Hotjar, Mixpanel and Meta Pixel being explicitly ruled out; only an anonymised technical audience-measurement cookie exists, with opt-out from the banner and from the footer Cookies link, while strictly technical server logs are retained under art. 31(2)(a) LPD. Aggregated, non-identifying internal reporting (API call volumes, performance metrics) is provided for in the DPA. Billing data — email address, name and address, technical identifiers, amounts, card brand and last four digits — is passed to Stripe; the full card number never reaches CoSec. Newsletter unsubscription removes the address from the mailing list immediately.
Data retention & training
Hosting summary
All service data — uploaded documents, AI conversations, embeddings, accounts, logs and backups — is hosted exclusively in Switzerland by Infomaniak Network SA, with no transfer abroad. Infomaniak owns and runs its datacentres directly, in Genève (az-1, az-2) and Zurich (az-3), and is a Swiss company with no foreign subsidiary (IDE CHE-103.167.648, Rue Eugène-Marziano 25, 1227 Les Acacias). The stack uses Infomaniak Web Hosting for the static site, Node.js Hosting for the application, Public Cloud OpenStack for the Postgres VM, block and Swift object storage, plus AI Services, transactional SMTP and kSuite. OlOxOn Sàrl claims immunity from the US CLOUD Act, FISA 702 and the Patriot Act: access would require a Swiss judicial order, and the user is informed unless expressly forbidden. Encrypted backups are kept seven days locally and 90 days in object storage, in Switzerland. Two qualifications matter: billing data (email, name, address, Stripe identifiers) is stored by Stripe Payments Europe Ltd., mainly in Ireland and the EU, with group infrastructure spread across the United States for high availability; and Let's Encrypt, in the United States, issues the TLS certificates but processes no user data.
Things to keep in mind
Risks and trade-offs to weigh before adopting CoSec.
- Attribution: the ISO 27001, 9001, 14001 and 50001 certifications and the annual penetration tests appear in a “Conformité & certifications” block on the product page, but they belong to Infomaniak, the host, not to CoSec or OlOxOn Sàrl. No certification of the publisher's own is published, and reading them as CoSec's would be a mistake.
- The site itself warns that human verification of the final deliverable remains indispensable and that you are responsible for what you sign. In security and crisis work a plausible but wrong risk analysis or emergency action sheet has real consequences, and leaning on generated text out of habit can quietly erode the professional judgement those documents are supposed to embody.
- The homepage figures — a four-hour end-of-mission report reduced to one minute, up to 50% time saved, “10+” ready-made skills — are the publisher's own claims. The site pairs them with a reminder that verification stays with the user; they are not independently verified.
- The service operates under Swiss law (LPD, OPDo) and not under the GDPR, which it never claims to comply with, relying instead on Switzerland's adequacy decision for EU customers. No representative under art. 27 GDPR is appointed even though the service is declared open worldwide, and no formal data protection adviser exists — optional in Swiss law under art. 10 LPD — only the single contact point legal@cosec.ch.
- Billing data transits through Stripe in Ireland and the EU, with group infrastructure spread across the United States under the Swiss-U.S. Data Privacy Framework. That nuance sits alongside the “100% Swiss” message and is worth reading with it.
- Legal documents are marked Version 0.1, last updated on 1 May 2026, so they are young and liable to change. OlOxOn Sàrl is not liable for VAT while its turnover stays below the Swiss legal threshold of CHF 100'000, and VAT will be added once it becomes liable. Monthly credits are not carried over either: only credits bought as top-ups are permanent.
- The cosec.ch domain has been registered since 2004 and its first Wayback capture, in 2016, is a 279-byte filler page unrelated to the product. The domain was taken over second-hand, so neither date says anything about the age of the publisher or of the tool.
Setup & Integrations
Technical difficulty
Very low. CoSec runs in a browser: nothing to install and no prior configuration, the vendor stating that the official standards and the risk matrix are already built in. Solo and Team users sign up on their own and start the trial immediately, with no appointment. Login uses an emailed magic link, with passkeys and 2FA available. No prompt engineering knowledge is needed, since Magic Skill writes the skills for you; Markdown helps only for importing or exporting your own. Team includes a 30-minute video onboarding, and Enterprise adds a scoping workshop and a pre-configured go-live.
Deployment
Integrations
Supported languages
Behind CoSec
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement CoSec.
Frequently asked questions
Is there a free plan?
Where is my data hosted?
Which AI models does CoSec use?
Are my documents used to train the models?
How do the AI credits work?
Which languages are supported?
Is there an API or a mobile app?
Is a DPA available, and are the subprocessors disclosed?
Can I cancel, and what happens to my data afterwards?
Who publishes CoSec and who answers support?
Should you pick CoSec?
CoSec is a deliberately narrow product: one profession — private security, event safety and crisis management — one country and one language. That focus is the whole argument. Where a general-purpose assistant hands you a blank page, CoSec hands you a catalogue of professional skills, a four-phase workflow that makes you validate a summary before anything is written, and a Word export ready to sign.
The differentiator is checkable rather than merely declared. The hosting and inference chain sits entirely in Switzerland with Infomaniak Network SA, the models are open source, and the providers deliberately kept out are named as explicitly as the ones actually used. The legal documentation — terms, privacy policy, DPA, subprocessor list — is public, downloadable and unusually complete for a company of this size, though still labelled Version 0.1 and last updated on 1 May 2026.
The counterweight is the publisher's youth and size: OlOxOn Sàrl was entered in the Genève commercial register on 13 July 2026 and has a single managing officer, who also answers support. There is no public API, no mobile application and no permanently free plan, and everything, interface and deliverables alike, exists only in French. One point deserves particular care: the ISO 27001, 9001, 14001 and 50001 certifications and the annual penetration tests displayed on the product page belong to Infomaniak, the host, not to CoSec. No certification or audit of CoSec's own is published.
At 39 CHF a month, with a 7-day trial and no commitment, the cost of finding out is low. For a French-speaking Swiss security professional who has to justify where the data sits and under which law, CoSec is worth the detour. Outside that frame — another language, another jurisdiction, a need for integrations — the case is much weaker.
- Choosing a selection results in a full page refresh.
- Opens in a new window.