Hosting in Switzerland

Legal context

Swiss law treats telecommunications data as protected under articles 13 and 36 of the Federal Constitution. Surveillance requires a federal court warrant under the BÜPF and metadata retention is capped at six months. The revised Federal Act on Data Protection (revFADP) mirrors GDPR rights and adds criminal penalties for breach of professional secrecy, including by hosting providers.

Switzerland is not a member of the European Union and not a member of the European Economic Area. The country is politically neutral, outside the Five-Eyes intelligence-sharing alliance, and outside the formal Fourteen-Eyes expansion. The practical consequence for a hosting customer is that a foreign subpoena does not arrive via a treaty fast-lane; it arrives via a mutual-legal-assistance request that a Swiss federal court evaluates on its own terms, against a body of case law that takes telecommunications secrecy seriously.

Telecommunications data is treated as protected under articles 13 and 36 of the Federal Constitution. Surveillance requires a federal court warrant under the BÜPF — the federal act on the surveillance of correspondence by post and telecommunications — and the standard for issuing the warrant is not the same as the administrative-subpoena standard familiar from US law. The leading precedent on what the BÜPF applies to — ProtonMail v UVEK (2021) — held that an end-to-end-encrypted application is not a "full" telecommunications provider for the heavier duties the statute imposes. Metadata retention is capped at six months for ISP-level subscriber data and the cap is not a minimum that providers are encouraged to exceed; it is a ceiling.

The revised Federal Act on Data Protection (revFADP), in force since September 2023, mirrors the substantive rights of the GDPR and adds criminal penalties for breach of professional secrecy — including by hosting providers and their staff. A hosting operator who discloses subscriber data outside the warrant process is exposed to personal criminal liability, which is a structural disincentive against the informal cooperation patterns common in less rigorous jurisdictions.

There is no Swiss equivalent to the DMCA. Copyright disputes are resolved through the civil courts on a case-by-case basis, and the intermediary-liability safe-harbour analysis for an intermediary host is meaningfully more protective of the host than the equivalent US framework. Switzerland additionally carries a long-standing data adequacy decision with the European Union, renewed in 2024, which makes the jurisdiction practically usable for any subscriber processing EU personal data.

Datacenter and network context

The facility sits in the Zurich metropolitan area, on the carrier spine that serves the Swiss financial-sector datacentres. The carrier mix at the facility includes Init7, Swisscom, Lumen, NTT, and Hurricane Electric — direct peering at the Community-IX (CIX) and SwissIX exchanges puts the facility one short hop from the majority of European eyeball networks. Latency to Western European endpoints is in the 5-15 millisecond range; latency to North-American endpoints via the major transatlantic routes is in the 80-110 millisecond range.

Certifications carried by the operating facility include ISO 27001, ISO 27017, PCI-DSS, and FINMA-aligned controls — the latter being the Swiss financial-supervisory authority's framework for operational resilience, which a non-financial host meets voluntarily because the controls are appropriate to the threat model. Power is sourced from the Swiss grid, which is itself predominantly hydroelectric and nuclear.

Carriers terminating at the facility include Init7, Swisscom, Lumen, NTT, Hurricane Electric.

Certifications carried by the facility: ISO 27001, ISO 27017, PCI-DSS, FINMA-aligned.