Swiss data hosting: what it changes for an SME

"Is our data in Switzerland?" The question comes up more and more often, asked by a client, a partner or an insurance questionnaire. Swiss data hosting makes real sense for an SME: a familiar legal framework, simpler contracts and a clear answer to what certain sectors expect.

It does not solve everything, though. A poorly protected server in Geneva is still poorly protected. This guide sorts things out: what data location changes, what it does not guarantee on its own, and the questions to ask before choosing a hosting provider.

Hosting your data in Switzerland: what does it change?

Data stored in Switzerland, with a Swiss provider, falls under Swiss law, in particular the Federal Act on Data Protection (nFADP), in force since September 1, 2023. The contract, any dispute and requests for access by the authorities follow Swiss rules.

The nFADP does not require data to be hosted in Switzerland. It does, however, regulate disclosure abroad: to a country whose legislation ensures adequate protection, according to the list drawn up by the Federal Council, or with contractual safeguards. Keeping data in Switzerland limits the transfers you have to document, provided backups, support and administration tools also stay in Switzerland.

Which sectors care most about it?

In several professions, Swiss data location is a client expectation before it is a legal obligation.

• Medical practices, therapists and nursing homes, which process health data.
• Lawyers, notaries and fiduciaries, bound to confidentiality toward their clients.
• Municipalities and companies working for public bodies, whose tenders may require data to be located in Switzerland.
• Suppliers to large companies, which receive detailed security questionnaires.
• Human resources in any company: salaries, medical certificates, performance reviews.

What data location does not guarantee on its own

Location answers the question "where?", not the question "how?". The most common causes of data loss or leaks are the same everywhere: an account without multi-factor authentication, a missed patch, a backup never tested, access left open after someone leaves.

• Access security: multi-factor authentication, limited permissions, accounts closed when employees leave.
• Backups: copies on several sites, one of them immutable, and tested restores.
• Availability: redundancy, a backup connection and a written service commitment.
• Monitoring: someone has to see the alerts and act on them.

Data in Switzerland: which level are we talking about?

"In Switzerland" can mean different things. An international provider may offer a Swiss region: the data is stored there, but the company remains subject to the law of its home country, which in some cases can compel it to hand over data (this is what the US CLOUD Act covers). This is not a flaw in itself; it is a factor to know about and document.

What questions should you ask a hosting provider?

Under the nFADP, the hosting provider is a processor: you remain responsible for choosing it and must be able to show that it offers sufficient guarantees. Ask for written answers: in the contract, its appendices or a dated information sheet provided before signing.

• Where are the servers, in which data centers, and are they certified (for example ISO 27001)?
• Where are the backups? They are sometimes replicated to another country without this being stated.
• Which subcontractors are involved, and from which country?
• Who in support can access your data, and from where?
• Is the data encrypted, and who holds the keys?
• How do you get your data back at the end of the contract, in what format and how quickly?

How SysPros does it

At SysPros, the cloud and backups we operate are hosted in Switzerland. Our backups can be spread across three ISO 27001 certified sites in Geneva, Gland and Lucerne, with an immutable copy; the offer sets out the location, number and type of copies. Some monitoring, support or security tools may involve access from abroad: we disclose this before the service starts. Location is a starting point: access, monitoring and any restore tests are defined with you.