Swiss hosting or EU hosting: where Swiss companies should keep their data
Updated: 2026-10
Legally, EU hosting is usually permissible for Swiss companies, because the Federal Council recognises EU and EEA states as adequate. Swiss hosting pays off when clients, sector or contract require it or very sensitive data is involved. EU hosting offers a broader choice of services. Client expectations and provider structure matter more than server location alone.
Server location is one of the most frequent questions in Swiss software projects. It is often answered emotionally: Switzerland sounds safer, the EU sounds more pragmatic. Both fall short, because location is only one of several questions that decide actual control over data.
This comparison describes the legal position, client expectations and the technical and organisational consequences. It does not replace legal advice for regulated institutions with their own outsourcing rules.
Head to head
| Criterion | Hosting in Switzerland | Hosting in the EU |
|---|---|---|
| Position under the Swiss FADP | No disclosure abroad, as long as operations, support and sub-processors also stay in Switzerland. | Disclosure to a state the Federal Council recognises as adequate; permissible without additional safeguards. |
| Client expectations | Strong with clients in finance, health, law, the public sector and private wealth. | Accepted by most Swiss SME and B2B clients, especially with clear communication. |
| Service choice | Growing, but not every cloud service or AI model is available in a Swiss region. | Broad choice of services, regions and managed services, often available earlier. |
| Control through provider structure | Depends on whether the provider is Swiss or a subsidiary of a foreign group; location alone does not decide. | Same question: with US-parented providers, US law such as the CLOUD Act can reach EU data centres too. |
| Latency for users in Switzerland | Minimal. | With nearby regions such as Frankfurt, negligible for most applications. |
| Regulated institutions | Eases compliance with outsourcing and confidentiality requirements, without replacing their review. | Possible, but regularly requires additional contractual and technical safeguards. |
When Hosting in Switzerland wins
- —Your clients are banks, asset managers, family offices, law firms, healthcare providers or authorities, and Swiss data residency is part of the trust question or the contract.
- —You process sensitive personal data at scale, such as health data or data on criminal proceedings, and want to avoid any disclosure abroad.
- —You deliberately position your product on Swiss data residency and can maintain it for backups, support and sub-processors too.
When Hosting in the EU wins
- —Your clients are mainly SMEs or companies in Switzerland and the EU for whom EEA data residency is sufficient.
- —You need services, regions or AI models not available, or only partly available, in Switzerland.
- —You serve EU clients and want one infrastructure for both markets.
Our take
Do not decide by server location alone but by three questions: what do your clients expect, who legally controls the provider, and where do backups, support and sub-processors actually sit? A Swiss data centre with support from a third country is less Swiss than it sounds.
For products serving wealthy families, law firms or regulated institutions, we recommend data residency in Switzerland; that is how we run our own products for these audiences. For most other applications an EU region is legally sound and pragmatic. Either way, location and sub-processors belong in the privacy notice and the contract.
Parent service: Data Protection Consulting
Matching offers
revFADP implementation for SMEs: from status quo to evidence
A bounded package that takes a Swiss SME from uncertainty to a documented state: capture data flows and providers, determine obligations, review contracts and international transfers, provide privacy-policy groundwork and set clear procedures for data breaches and access requests.
GDPR & revDSG audit for SaaS
A data protection audit for SaaS checks whether data flows, processing agreements, deletion concept, and technical measures are GDPR- and revDSG-compliant. The output is a concrete finding with prioritised fixes — from people who run SaaS themselves.
FAQ
Is EU hosting permitted for Swiss companies under the FADP?
In principle yes. The Federal Council recognises EU and EEA states as having adequate data protection, so disclosure there is permissible without additional safeguards. Information duties and a data processing agreement remain.
Does a Swiss data centre protect against foreign access?
Not automatically. What matters is who controls the provider and where operations and support sit. For groups headquartered in the US, US law can reach data outside the US.
What applies to data in the US?
Since 15 September 2024, disclosure to companies certified under the Swiss-US Data Privacy Framework has been possible without additional safeguards. Non-certified providers require safeguards such as standard contractual clauses.
Do I have to name the location in my privacy notice?
For disclosure abroad, the recipient states must be named. Even without a duty, clear information on location and sub-processors builds trust.