Privacy Policy

Safe Swiss Cloud (Hosting, Storage and Swiss LLM Processing)

The platform runs on Safe Swiss Cloud's ISO 27001-certified infrastructure in Switzerland, where all content data is stored. Safe Swiss Cloud is a Swiss provider and is not subject to the US CLOUD Act. The selectable Swiss LLM mode as well as document comparison, document splitter, case files, timeline, text recognition (OCR) and anonymisation also run via Safe Swiss Cloud. The basis is a data processing agreement pursuant to Art. 9 FADP.

Microsoft Azure (AI Processing via Azure OpenAI)

Microsoft Azure is used in standard mode for processing AI requests. The main location is the Switzerland North region, so that personal data remains in Switzerland. For certain functions, Microsoft may use other data centers within the selected geography (Switzerland/EU). Azure OpenAI (Model Provision): Processing preferably takes place in Switzerland (Switzerland North region); if a specific model is not available regionally, processing occurs in the selected geography (CH/EU). No model training with our content; prompts/outputs may be stored for up to 30 days for abuse monitoring; zero data retention is possible upon request. We optionally use customer-managed keys (CMK) via Azure Key Vault.

• Accountability obligation (Art. 5 para. 2 GDPR): Microsoft supports us in fulfilling our proof obligations through appropriate documentation and audit reports for the duration of the contract.
• Use of sub-processors (Art. 28 para. 2 GDPR): Microsoft may only use sub-processors with prior authorization. In case of general authorization, Microsoft informs – to the extent permitted – of changes in advance so that we can object.
• Adherence to instructions (Art. 28 para. 3 GDPR): Microsoft processes data exclusively according to our documented instructions. Transfer to third countries or international organizations only occurs if there is a legal basis. If Microsoft is legally obligated to disclose data, Microsoft informs – to the extent permitted.
• Confidentiality: All persons employed by Microsoft who come into contact with personal data are bound to confidentiality.
• Technical and organizational measures (Art. 32 GDPR; Art. 1-3 DPO): Microsoft ensures a level of protection appropriate to the risk through encryption, access controls, pseudonymization, backup and recovery procedures, and regular security audits.
• Assistance for data subject rights and DPIA (Art. 28 para. 3 lit. e-f GDPR): Microsoft helps us, as far as possible, to respond to requests for access, deletion, or portability and to conduct data protection impact assessments.
• Return/Deletion (Art. 28 para. 3 lit. g GDPR): Upon contract termination, all personal data is, at our choice, deleted or returned, unless a legal retention obligation precludes this.
• Evidence and audits (Art. 28 para. 3 lit. h GDPR): Microsoft provides us with necessary information and enables audits, including independent reviews.
• Liability for sub-processors (Art. 28 para. 4 GDPR): Microsoft ensures that engaged third parties comply with the same data protection obligations and is responsible for their compliance.
• Data security level (Art. 32 GDPR): Microsoft and we jointly take appropriate technical and organizational measures to ensure the integrity, confidentiality, availability, and resilience of systems.
• Data breach notification (Art. 33 GDPR; Art. 24 FADP): If Microsoft becomes aware of a personal data breach, Microsoft informs us immediately and provides all available information pursuant to Art. 33 para. 3 GDPR, so that we can fulfill our notification obligation to the FDPIC.

Google Firebase (Authentication)

For user account management (registration, login, password reset), we use Google Firebase Authentication. Google Ireland Limited (for EEA/Switzerland) or Google LLC (USA) acts as processor pursuant to Art. 9 FADP and Art. 28 GDPR.

• Data types:: Email addresses; Passwords (encrypted, hash method); User-Agent strings and IP addresses (to increase security and detect abuse)
• Retention:: Authentication data remains in the system until user account deletion. Thereafter, data is removed from live and backup systems within a maximum of 180 days.
• International data transfer:: Firebase Authentication is operated in the USA. Transfer of personal data to the USA is secured by: Standard Contractual Clauses (SCCs, 2021 version) pursuant to Art. 16 FADP and Art. 46 GDPR; Swiss-U.S. Data Privacy Framework (status 2023); Supplementary technical measures such as encryption and access restrictions
• Certifications and security standards:: Firebase Authentication is certified according to the following standards: ISO 27001 (Information Security Management); ISO 27017 (Cloud Security Controls); ISO 27018 (Data Protection in Public Clouds); SOC 1, SOC 2, SOC 3 (regular audit reports)
• Adherence to instructions: Google processes data exclusively on documented instruction from the customer.
• Confidentiality: Only authorized employees with corresponding confidentiality obligations have data access.
• Technical and organizational measures: Google implements comprehensive TOMs including encryption, access controls, and regular security audits.
• Assistance for data subject rights: Google helps us respond to requests for access, deletion, and portability under FADP/GDPR.
• Assistance for DPIA: Google ensures that necessary information is available to conduct data protection impact assessments.
• Sub-processors: Google may use sub-processors but informs transparently about their use. These are contractually obligated to comply with the same data protection standards.
• Return/Deletion: After account closure, data is completely deleted or anonymized, unless a legal retention obligation precludes this.

Technical measures (excerpt):

• Encryption at rest/in transit (e.g., AES-256, TLS 1.2+), key management with HSM/Key-Vault, rotation.
• Access controls (MFA, SSO), network segmentation, least privilege, endpoint hardening.
• Logging of security-relevant events (e.g., authentications, role changes); SIEM monitoring, alerts, evidence retention according to DPO.
• Secure software development (code reviews, secrets management, dependency scans), vulnerability and patch management, regular penetration tests.
• Backup/recovery strategy (regularly tested), business continuity and disaster recovery.

Organizational measures (excerpt):

• Role and authorization concept (JML process), four-eyes principle and separation of duties in sensitive processes.
• Data protection and security policy, employee training, confidentiality commitments.
• Contractually regulated data processing (SCCs/DPF where necessary), sub-processor governance with change notifications.
• Incident response process including notification system according to FADP/DPO; regular exercises.
• Data classification, data minimization, pseudonymization/anonymization where possible; retention and deletion concept.

Process controls, evidence, and effectiveness:

• Implementation and documentation obligation: We ensure that all described processes and measures are actually implemented and documented (TOM evidence, processor contracts, DPIA reports, action plans).
• Effectiveness control: Regular reviews/audits (internal/external), technical controls (e.g., log analysis, access reviews, pen-test reports), management reviews, and continuous improvement.
• Accountability artifacts: Record of processing activities, TOM inventory, training evidence, sub-processor list, risk register including CAPA measures (Corrective/Preventive Actions).
• DPIA process: In case of high risk, we conduct a data protection impact assessment according to Art. 22 FADP: results, residual risks, and decided TOMs are documented, regularly reviewed, and updated if necessary.

Notes on logging and retention (clarification):

Security-relevant logs (accesses/processing) are kept so that it can be subsequently verified whether data was processed in accordance with its purpose; retention occurs in a risk-appropriate manner and in accordance with DPO requirements. Rationale and guidance: The above additions correspond to the FDPIC's guidance on TOMs (governance, implementation, evidence, effectiveness verification) and operationalize the DPO/FADP requirements for a SaaS environment.

Specific timelines:

• Security logs according to Art. 4 DPO (accesses/processing) are retained for at least 12 months.
• Operational/application logs without personal reference: 90 days.
• Business-relevant documents/correspondence according to CO 958f: 10 years.
• AI content data: no permanent storage without consent; in Azure OpenAI use, abuse monitoring on the service side for up to 30 days, without model training.

Archiving:

If there is a legal obligation, personal data is kept exclusively for archiving purposes pursuant to Art. 6 para. 4 FADP. Archiving occurs exclusively in compliance with legal requirements and with appropriate technical and organizational protective measures (e.g., access restriction, encryption).