CSIRT-Sim

Terms of use

Version 1.0 of 3 October 2026, effective from the day it is published on the site. This is a translation; if it differs from the Polish version, the Polish version prevails.

In short

  • The service is free and needs no account. We do not guarantee that it will always be available.
  • It is for people aged 16 and over.
  • Do not type real personal data or unlawful content into the game.
  • The game is a teaching exercise. It is not legal advice, and the score is not a formal grade.
  • Send complaints to contact@ksiezopolski.pl. We reply within 14 days.

1. Provider

The service at https://bsi.ksiezopolski.pl is run by Bogdan Księżopolski (the "provider", "we"). Contact: contact@ksiezopolski.pl.

How we process personal data is described in the privacy notice. How the service uses artificial intelligence is described on the page How CSIRT-Sim uses AI.

2. What the service is

CSIRT-Sim is a simulator for cybersecurity crisis exercises. A team plays roles in a fictional organization and takes decisions during an incident. The game ends with a score and a report. The source code of the service is open: https://github.com/U55-BK/csirt.

There are three ways to play:

  • Solo demo. You play one role, and the computer plays the other roles as simulated colleagues. You can send a friend a link, and they take over one of those roles.
  • Group session. A facilitator creates it on the /host page. They get a secret link to the session panel and codes for the teams. Participants join the game with a code.
  • Classes run by the provider. The provider runs their own classes on the service, in a separate panel. Any additional rules for these classes are given in class.

The companies, people and events in the scenarios are fictional. Real laws, authorities and media appear in them only as background to the exercise.

3. Agreement and technical requirements

  • You enter into the agreement to use the service when you start a demo, create a session or join one. By doing so, you accept these terms.
  • The agreement ends when the session ends or when you stop using the service. You can stop at any time, without giving a reason and at no cost.
  • The service is free. No account is needed.
  • You need a current web browser with JavaScript and cookies enabled. The game does not work without the player cookie (details in the privacy notice).
  • The service is intended for people aged 16 and over.

Using the internet carries common risks, such as malware or sites that impersonate well-known services. The service never asks participants for passwords or payment details.

4. Availability and limits

The service comes without any availability guarantee (no SLA). It may be interrupted, for example by a failure, maintenance or heavy load. We may change features and limits and may restrict access to the service temporarily.

To keep the service working for everyone and within budget, it has limits:

  • Games at the same time. Only a limited number of games can run on the service at once. When the limit is reached, start a new game later.
  • Session length. A demo ends on its own at the latest one hour after the planned end of the game, or earlier if nobody has had it open for 60 minutes. A group session ends on its own at the latest 2 hours after the planned end of the game.
  • Team size. In a group session, the number of people per team and the number of teams are limited.
  • AI per session. The number of AI uses in one session is limited, for example the number of questions to the advisor.
  • Daily AI budget. Demos and group sessions share a daily budget for AI. When it runs out, the game carries on without AI features and the report is built from a template. The budget resets at midnight UTC.

5. Rules of use

  • Do not enter real personal data, neither yours nor anyone else's: not in decisions written in your own words, not in questions to the advisor, not in the survey. Your nickname does not have to be your real name. The game is fiction.
  • Do not enter content that is unlawful, offensive or infringes other people's rights.
  • Do not attack the service, disrupt it or try to get into other people's sessions.
  • Do not collect the service's content automatically (scraping). Do not use scripts or bots to play, create sessions or send requests to the AI.
  • Do not try to get around the limits or to make the AI model do things unrelated to the game.
  • Report a security issue according to our disclosure policy. Do not exploit it.

If someone breaks these rules, we may end their session, remove content they entered or restrict their access to the service.

6. Facilitators of group sessions

  • The facilitator link works like a password. Anyone who has it sees the same as the facilitator and can control the session. Do not share it with participants or publicly.
  • Remind participants not to enter real personal data in the game.
  • If you use the results outside the service, for example for grading, you do so on your own responsibility. You then become a separate controller of that personal data (details in the privacy notice).
  • The score should not be the only basis for a course grade.

7. Nature of the exercise and the results

  • CSIRT-Sim is a teaching tool. It is not legal advice, compliance advice or any other professional advice. Descriptions of laws and deadlines in the game are simplified for the exercise.
  • Do not base decisions about real incidents on the game. In a real case, get help from a lawyer or another specialist.
  • The score is computed by a fixed algorithm from the crisis indicators. It is a teaching aid, not a formal grade.
  • AI-written content, such as the commentary in the report and the advisor's answers, can be imprecise or wrong. More on the page How CSIRT-Sim uses AI.

8. Copyright and licences

  • The software of the service is licensed under the GNU Affero General Public License, version 3 or later (AGPL-3.0). Source code: https://github.com/U55-BK/csirt.
  • The scenario content, including the descriptions of the fictional organizations, consists of JSON files in the same repository. It is part of the repository and is shared under the same licence as the software, unless a file says otherwise.
  • The texts you type in the game and in the survey remain yours. You grant us a non-exclusive, free licence to process them as far as needed to run the game, prepare the report and compile aggregate survey results. This includes the AI processing described in the privacy notice and on the page How CSIRT-Sim uses AI. The licence lasts as long as we keep these texts.
  • We do not publish your texts. Only the people named in the privacy notice see them, for example your team and the session facilitator.

9. Liability

To the extent permitted by law, we are not liable for:

  • interruptions to the service or its unavailability,
  • loss of data after the retention periods described in the privacy notice,
  • decisions taken on the basis of the game, the score or AI-written content, or their consequences.

The service is not an archive. If you want to keep a report, save it yourself.

These limitations do not apply to damage caused intentionally or to any other liability that the law does not allow to be excluded or limited. They also do not limit your rights as a consumer.

10. Complaints

Send a complaint about how the service works to contact@ksiezopolski.pl. Describe the problem and, if you can, give the session code and the date. We will reply within 14 days of receiving the complaint, to the email address it came from.

If you are a consumer, you can also use out-of-court ways to resolve disputes, for example by asking a district or municipal consumer ombudsman (rzecznik konsumentów) or a regional office of the Trade Inspection (Inspekcja Handlowa) in Poland for help.

11. Changes to these terms

We may change these terms, for example when the service or the law changes. Changes are published on this page, with a new version number and date. Sessions created before a change finish under the previous terms. All previous versions are in the public source code repository of the service (https://github.com/U55-BK/csirt), in the legal folder.

12. Governing law

These terms and the agreement are governed by Polish law. If you are a consumer living in another country, you keep the protection given to you by the laws of that country that cannot be excluded by agreement.