Everything a security review will ask. In one place.

Customer data stays on Swiss soil, under Swiss jurisdiction — by architecture, not by policy. The public-data intelligence layer runs on EU infrastructure and holds no customer data. Institutional contracts make residency a contractual term.

Processing follows the revised Swiss Federal Act on Data Protection. Enquiry data is kept only as long as needed; no tracking runs without consent. The plain-language policy is on the Legal page.

Encryption in transit and at rest, role-based access on least privilege, audit logging on data access, and separated environments. Security documentation is available under NDA.

We operate to ISO 27001-aligned controls today; formal certification is targeted for Q4 2027, and its status will be published here. We do not claim what an auditor has not signed.

Institutional plans carry a contractual SLA with defined availability, support response times, and an escalation path. A public status page ships with the production platform.

A complete, current list of sub-processors — Swiss-hosted for customer data, EU-hosted for public-data processing — is provided with every institutional agreement and will be published here at launch, with change notifications.

DPA, security questionnaire, sub-processor list — on request.

Institutional agreements include a data-processing agreement, our security documentation, and contractual Swiss data residency. One contact, one business day.

Found a vulnerability? Report it responsibly via the procurement contact — we acknowledge within one business day.