Hosting in Switzerland: what it really changes for your data

What Swiss hosting guarantees

Data stored on a server located in Switzerland and run by a Swiss company falls under Swiss law. The Data Protection Act applies. The authorities that can access the data are Swiss and they have to go through Swiss procedures.

For your clients, it’s also an easy argument to grasp: their data never leaves the country and there is no contractual clause to explain.

What it doesn’t guarantee

Where the server sits is only part of the question. Two other points matter just as much.

• Who runs the server. A provider subject to US law can be required to hand data over to the authorities of its country, even if the data is stored elsewhere. That’s what the CLOUD Act, passed by the United States in 2018, is about.
• Who else touches the data. A website hosted in Switzerland can send its emails through a foreign service, load its fonts from a third party or measure its audience with a tool that transfers IP addresses abroad.

A website is only Swiss if its whole chain is: server, operator, emails, audience measurement, backups. One link is enough for data to leave the country.

Transfers are still possible

Sending data abroad is not forbidden. The law allows it to countries whose level of protection the Federal Council considers adequate, including the member states of the European Union. For the others, contractual safeguards are required (Art. 16 FADP).

For the United States, the Federal Council has recognised an adequate level of protection since 15 September 2024 for companies certified under the Swiss-U.S. Data Privacy Framework. The transfer is then allowed without further safeguards. This only applies to a certified company: you can check it on the programme’s public list.

Questions to ask a hosting provider

1. 01Where are the data centres, backups included?
2. 02Is the company that runs them subject to foreign law? What about its parent company?
3. 03Which subprocessors have access to the data and where are they based?
4. 04What happens to my data when the contract ends and how soon is it deleted?
5. 05How will I be notified if there is an incident?

Our choice

Our websites and the applications we deliver are hosted in Switzerland by a Swiss hosting provider. When a third-party service is still needed, our privacy policy names it along with the country where it processes the data. The rest of our approach is on the Building in Switzerland page.