AI & privacy: is your data really safer in Switzerland?

1. A Swiss server is not a shield

Cyberattacks can affect organisations in Switzerland just as elsewhere. A server in Zurich can be reachable from the internet just like one in Frankfurt or Virginia. The attack surface, secure settings and protected access matter, not just the data centre’s address.

2. Security takes more than a location

Ask about encryption in transit and at rest, multi-factor authentication and clear access rights. Who can see which data? How are incidents detected? Is there ongoing monitoring, tested emergency planning and backups with verified restoration? And who can access the keys?

3. Certifications are evidence, not guarantees

ISO 27001 certifies an audited information security management system. A SOC 2 Type II report assesses defined controls over a period. Both help with selection but do not make a system immune to attacks. Check the services covered, how current the evidence is and any documented exceptions.

4. Data transfers need a case-specific legal basis

A processing agreement (AVV or DPA) governs processing on your behalf. It does not by itself permit every international transfer. For Swiss data, the Swiss–U.S. Data Privacy Framework is relevant where the US recipient is appropriately certified and the transfer is covered. The EU–U.S. framework concerns the EU context. Depending on the case, other grounds such as standard contractual clauses and additional assessments are needed. Professional secrecy and sector-specific rules may impose stricter requirements.

5. Data sovereignty means real control

Banks and insurers also sometimes use international cloud providers. That does not replace a review of your own situation. Can you export and delete your data? Who has access? Which subprocessors are involved? Can data be used to train AI models?

Don’t look away. Ask questions.

I once avoided this topic myself. Today, I check security evidence before even drinking my coffee. As an entrepreneur and AI consultant, I take clients along that path: control of your data, deliberate access approvals, clear contracts and planned backups. You don’t need to know every technical term to ask the right questions.

At nowly, we agree the necessary access with you beforehand. Targeted support access happens only at your explicit request, after approval and within the agreed scope, with a confidentiality agreement and, where required, a processing agreement. Confidential data is not sold or shared with competitors; necessary technical providers and legal obligations are transparently taken into account.

What matters most to you when trusting an AI tool?

If you don’t know what to ask, ask me. I’ll explain until it makes sense.