Why before you sign
The Federal Act on Data Protection requires security to be built in from the design of the processing (Art. 7 FADP). When you entrust that processing to a provider, you must make sure they are able to guarantee data security (Art. 9 para. 2). Asking these questions is not distrust: it is your obligation.
1. Where does the data live and who can access it?
Server, cloud, the user’s computer: the answer must name a place and list the people who have access, the provider included. The fewer places and people, the fewer doors.
2. What is encrypted and where are the keys?
“The data is encrypted” means nothing until you know who holds the key. In Qompta, our accounting software, the database is sealed with AES-256-GCM. The key stays in the operating system’s keychain and is shown to you once as a recovery key: nobody else holds it, not even us.
3. Who can see what in the application?
Broken access control tops the OWASP Top 10 2025, the reference list of web application risks. An employee should only see what their role requires. The server must enforce that rule, not just hide things in the interface.
4. How do people log in?
Authentication failures are on that list too. Ask whether two-factor authentication is planned, at least for administrator accounts. Ask too how a forgotten password is reset without opening a back door. The NCSC recommends always enabling a second factor where a service offers it.
5. How are dependencies tracked?
Modern software relies on many libraries written by other people. Software supply chain failures are a new category in the 2025 Top 10, in third place. A good answer explains how versions are pinned, monitored and updated. It also says who does it after delivery.
6. What does the log record?
After an attack, the law may require you to describe what happened, sometimes within 24 hours. Without a log of logins and errors, that is impossible. OWASP also ranks missing logging and alerting among the ten biggest risks. See Cyberattacks: who must report them in Switzerland.
7. How do you restore?
A backup that has never been restored is only an assumption. Ask where the copies are, how many versions are kept and when a restore was last tested. The details are in Backups: the 3-2-1 rule.
8. Who tells you about an incident and can you read the code?
A provider that processes your data must notify you of any breach as soon as possible (Art. 24 para. 3 FADP). The contract must say how, to whom and within what time frame. It must also state whether you receive the source code: that is what lets you have the software audited or change providers. Qompta’s code is public on GitHub.
An answer that boils down to “it’s secure” is not an answer. A good answer names a place, a person, a deadline or a technique. And it can be checked.
Even before these questions, a clear project brief helps your provider price security in instead of forgetting it. Have a project? Describe it to us: we answer each of these questions in writing.