Guide
Swiss web hosting and data sovereignty: a guide for SMEs
Hosting in Switzerland is reassuring, but it does not settle everything. This guide explains what the FADP actually requires of a host, what a Swiss host does not guarantee, which question to ask for each risk, and gives an example offer with dated facts.
Hosting in Switzerland: which data are we talking about?
For an SME, “hosting” covers three things that are best kept apart, because they carry different risks and different requirements.
- The website: public pages, a contact form, perhaps a shop. Personal data there mostly concerns your visitors and contacts.
- Mail and working files: exchanges with clients, contracts, attachments.
- Invoices and accounting records: names, addresses, bank details, sometimes salaries. Here retention (10 years, art. 958f CO) and traceability (Olico) come on top of data protection.
A well-chosen web hosting plan suits the first case. For the third, the question is not only “where are the servers?” but “can I prove the integrity of the records, export the archive and find out who accessed what?”. Our retention guide details these requirements.
What the law says: the FADP does not require Switzerland
The revised Federal Act on Data Protection (FADP, nLPD in French), in force since 1 September 2023, does not ask for hosting in Switzerland. It sets four rules that apply to any host, Swiss or not.
- Security (art. 8): the controller and the processor ensure, through appropriate organisational and technical measures, a level of data security appropriate to the risk.
- Processing by a processor (art. 9): processing may be entrusted to a processor if a contract or the law provides for it, if only processing that you would be entitled to carry out yourself is performed, and if no statutory or contractual duty of confidentiality prohibits it. You must in particular make sure the processor is able to guarantee data security.
- Disclosure abroad (art. 16): possible to a State whose legislation the Federal Council has found to ensure adequate protection; otherwise, if appropriate protection is guaranteed, for example by a treaty or standard data protection clauses.
- Exceptions (art. 17): express consent of the data subject, a direct link with the performance of a contract, and a few other cases listed exhaustively.
For accounting records, art. 958f CO sets the retention period (ten years from the end of the financial year) and allows electronic media. It does not impose a location either.
The reference authority is the Federal Data Protection and Information Commissioner (FDPIC), whose website publishes up-to-date guidance.
What a Swiss host does not guarantee
Three other limits are checked in the contract, not in a brochure.
- Subcontractors: a host may use providers (payment, mail, support, backup) located elsewhere. Ask for the named list and the location of each processing.
- Backups: where production data sits says nothing about where the copies are. Ask where they are, how long they are kept and how they are restored.
- Encryption: what the host cannot read, it cannot hand over in clear. Ask what is encrypted, and who holds the keys.
The sovereignty page applies the same honesty to Dossivio: location of each processing, named providers, and what we do not promise.
A showcase website is not an accounting archive
Web hosting is for publishing a website. An accounting archive is for proving, ten years later, that a record has not been altered. The requirements differ: on a modifiable medium, Olico requires a process that guarantees integrity, a tamper-proof timestamp, documented procedures and an access log (art. 8 and 9 Olico).
Dropping your invoices into a web hosting folder therefore does not make it a compliant archive, whatever the country. For records, look for an archiving process that answers the questions in the table of the retention guide, or a solution such as Dossivio Capture, which archives each record with its log without replacing your reference archive.
Selection grid: five criteria to compare hosts
The grid applies to any host, Swiss or not. Ask for the answers in writing: what is in the contract counts for more than what is on the sales page.
| Criterion | Question to ask | Why |
|---|---|---|
| Data location | Where are production data and backups hosted? In which countries, with which data centre operator? | Determines whether a disclosure abroad takes place (art. 16 and 17 FADP). |
| Subcontractors | What is the named list of subcontractors, with their country? How are you told of a change? | You remain responsible for choosing the processor (art. 9 FADP). |
| Backups | What frequency, retention and location? How long to restore? Is a restore ever tested? | A backup never restored is a hypothesis, not a guarantee. |
| Exit from the contract | How to retrieve all data, in which format and within what time? When is it erased at the host? | Reversibility matters as much as entry, especially for records kept ten years. |
| Support and security | Which channels, which hours, from which country? Which certifications, and on what exact scope? | A certification only covers its scope: ask for it. |
Two points deserve a check before signing: the renewal price, often different from the introductory rate, and the commitment period.
Example offer: Infomaniak web hosting
To illustrate the grid on a real case, here is the web hosting offer of Infomaniak, a provider established in Switzerland. This is not a ranking: other Swiss hosts exist, and the right choice depends on your need. The facts below are those the provider states on its page, noted on 29 September 2026.
The full details are on the Infomaniak Web Hosting page (affiliate link). Apply the grid above to it: where are the backups, who are the subcontractors, how do you get your data out. And remember that this offer hosts a website, not an accounting archive within the meaning of Olico.
Transparency: this link is commercial
FAQ
Frequently asked questions
Does the FADP require hosting in Switzerland?
No. It governs processing by subcontractors (art. 9) and disclosure abroad (art. 16 and 17). Professional secrecy or a client contract may nevertheless require Switzerland.
Does a Swiss host protect against any request from a foreign authority?
No. A Swiss company remains subject to Swiss law, and a foreign authority can use mutual legal assistance. Hosting in Switzerland reduces exposure; it does not remove it.
Can I archive my invoices on a web hosting plan?
That is not what it is for. An accounting archive must guarantee integrity, timestamp and log access (art. 8 and 9 Olico). See the retention guide.
Which questions should I ask a host before signing?
Location of data and backups, the named list of subcontractors, restore, exit from the contract, support and the scope of certifications.
Why does this guide contain an affiliate link?
Because we may receive a commission if you subscribe to the example offer through this link, at no extra cost to you. It does not influence the content, and other Swiss hosts exist.
Are the features of the example offer guaranteed?
They are provider statements noted on 29 September 2026. Check them, along with the price and commitment, on its page before ordering.
Sources
- Federal Act on Data Protection, FADP, art. 8, 9, 16 and 17 (Fedlex)
- Code of Obligations, art. 958f, retention of accounting records (Fedlex)
- Ordinance on the Keeping and Retention of Accounting Records, Olico/GeBüV, SR 221.431 (Fedlex, German)
- Federal Data Protection and Information Commissioner, FDPIC
- Infomaniak, Web Hosting page (provider statements, viewed on 29 September 2026)
Sources checked on 29 September 2026
Request an assessment
Describe a process, we will scope it
Tell us which flow costs you the most time, which software it touches, and how many files go through each month. We reply within two working days, in English, French or German.
- Swiss engineering
- Reply within two working days
- French, German, English
Email Dossivio
Describe the flow that costs you the most time and we will tell you whether it is worth automating.
Email Dossivio