Cloud and data in Switzerland: why it matters

When you entrust your company’s data to a cloud service, one often overlooked question becomes decisive: where does that data physically reside? For a Swiss SME this is not a technical detail, but a matter of compliance, legal certainty and control. Let’s look at why the storage location matters and what to consider before choosing.

The cloud is not “nowhere”

The phrase “in the cloud” suggests an abstract place. In reality, every piece of data is stored on physical servers, located in a specific country, subject to the laws of that country. This is where the concrete implications arise: the jurisdiction to which your data is subject depends on where it is located and who manages it.

For a Swiss company this means making a conscious choice: data stored in Switzerland remains under the protection of Swiss law; data stored elsewhere may be subject to foreign regulations and access powers.

Data protection: the Swiss framework

Swiss data protection law requires the careful handling of the personal information of clients and staff. Storing data in Switzerland simplifies compliance for several reasons:

• Clarity on jurisdiction: Swiss law applies, with no uncertainty over the competent forum.
• Controlled cross-border transfers: taking data outside Switzerland requires the destination country to offer adequate protection, or specific safeguards. Staying in Switzerland avoids this complexity.
• Reduced foreign authority access: data on Swiss servers is not directly exposed to the access powers of third-country legal systems.

It is not an ideological question, but one of reducing legal risk. Fewer variables outside your control means less exposure.

The ten-year retention obligation

There is also a requirement that concerns every business: the Code of Obligations requires that accounting books, supporting documents and business correspondence be kept for ten years. Electronic archiving is fully permitted, but throughout that period it must guarantee:

• Integrity: documents must not be alterable without a trace.
• Legibility: they must remain accessible even years later, regardless of technological changes.
• Availability: they must be retrievable when needed, for example in the event of an audit.

A cloud used for accounting must therefore also be assessed against these requirements, not just on price and convenience. Knowing where the data is located is the first step to guaranteeing its availability over time.

Data sovereignty: who is really in charge

Beyond compliance, there is the issue of control. Entrusting data to a provider means trusting it, but without becoming its hostage. Some questions to ask yourself:

• Can I export my data at any time, in a usable format?
• What happens to the data if I change provider or if the provider shuts down?
• Who can access the data besides me, and with what safeguards?
• Is the data encrypted, both in transit and at rest?

Data sovereignty means that the company remains the owner of its own information: it can take it away, it knows where it is and it controls who touches it.

A Swiss cloud alone is not enough

Be careful not to stop at the label. A server in Switzerland is a good starting point, but security also depends on how the service is configured: personal access, traceability of operations, redundant backups, procedures in the event of a breach. Location is a necessary condition, not a sufficient one.

Why it matters for an SME

For a small business the stakes are high precisely because resources are limited. A compliance problem or a loss of data weighs more heavily than on a large company. Choosing from the outset an infrastructure that keeps data in Switzerland, compliant with the retention obligations and with full portability, avoids costs and risks that only emerge when it is too late.

How we work

At SIH ONE, the data and documents you entrust to us are stored in Switzerland, encrypted and accessible only to those entitled to them, with archiving compliant with the ten years required by the Code of Obligations. Your data remains yours: you can consult and export it at any time, with full transparency about where it is and who accesses it. Sovereignty over information is a principle of the way we work, not a marketing promise.

Do you want to know where your company’s data ends up and how to protect it? Let’s look into it together.