Security and Data Protection

The German version is binding. This translation is provided for information only.

Encrypted data residency in Zurich · Swiss key sovereignty · revDSG, GDPR and the EU AI Act · operated on infrastructure certified to ISO 27001 and SOC 2 Type II

Your data stays in Switzerland

All client, contract and document data is held encrypted in a certified data centre in Zurich, including the data the search draws on. That data is not held in the US

Swiss key sovereignty

Key sovereignty rests with SOTHURA SAFE GmbH. The master key is held in a hardware-backed key vault in Zurich and is used only with our release. Revocable at any time

Built for particularly sensitive data

AHV numbers, health details, contract data: built for exactly the categories where other tools stop

Two laws, one standard

AI processing under applicable data protection law: the revised Swiss Data Protection Act, the European GDPR and the requirements of the EU AI Act

Provable without gaps

Every advisory step is logged in a cryptographic chain and retained for ten years. Tamper-evident, exactly the evidence your supervisory authority wants to see

Your data trains nothing

No model training on your data, contractually assured. For abuse prevention the AI provider may retain inputs and responses for a limited time, in the selected region and without model training

Download security one-pager (PDF)Contact the security team

What happens to your documents

Upload document

Stored encrypted in a Swiss data centre

Analysis

AI analysis in Zurich, an EU location only when Zurich is at capacity, without training on your data

Result in the file

The analysis stays in Switzerland and every step remains traceable

Data location and sovereignty

Everything that is stored stays encrypted in Switzerland.

Database and primary storage in a certified Swiss data centre in Zurich
The data the search draws on is held in Switzerland as well
Audit logs in Switzerland with 10-year retention
Storage 100 % in Switzerland; the AI analysis runs in Zurich and moves to an EU location only when Zurich is at capacity — processing therefore exclusively in Switzerland and the EU, client, contract and document data is not transferred to the US or other third countries

Encryption

Your own digital vault. Without our release, your AHV numbers and IBANs stay unreadable.

AES-256 for all stored data, TLS 1.2+ for every connection
Field-level encryption for particularly sensitive details: AHV numbers, dates of birth, IBAN, policy numbers, claims reports
Hardware-backed key management with regular rotation
Key sovereignty rests with a Swiss company, the database can be rendered cryptographically unreadable at any time

Network security

Our database is not reachable from the open internet.

Private networking, the database is never reachable over the public internet
Private cloud connectivity, the database is not reachable over the public internet, only via a private, internal network tunnel
Network-isolated infrastructure in Switzerland
Private DNS resolution, addresses are resolved only within the internal network

AI with data protection

The AI analysis runs in Zurich; only when that location is at capacity does it move to an EU location. Storage is 100 % in Switzerland, and your client, contract and document data is not transferred to the US or other third countries.

AI analysis in Zurich, moving to an EU location only when Zurich is at capacity; for client, contract and document data never in the US or other third countries
No training on customer data, contractually assured
For abuse prevention the AI provider may retain inputs and responses for a limited time, in the selected region and without model training
Designed for revDSG, GDPR and the requirements of the EU AI Act
Every analysis stays traceable and is logged in an audit-proof manner

Access control

Every tenant is technically separated. Two-factor login is mandatory.

Multi-Factor Authentication (MFA) for all employees
Role-Based Access Control (RBAC) on the principle of least privilege
Strict tenant isolation, multi-tenant separation at the data layer
Separate service accounts with minimal permissions
Access to the encryption keys is separated from all other system access and authorised in its own right
Separate database users for app, analytics and backup

Audit and monitoring

Every access is logged, immutable for 10 years.

Hash-chain logging of all functional mutations and all accesses to particularly sensitive data (read_sensitive); additionally server-side database auditing at the infrastructure layer
Central log platform with long-term retention
Immutable, hash-chained audit trail with no deletion path, held in Switzerland
24/7 monitoring of the infrastructure

Backups and disaster recovery

Daily backups, encrypted as well, stay in Switzerland.

Continuous backups with point-in-time recovery
Backups in Switzerland, no cross-region replication outside CH/EU
Encrypted backups using the same keys as the production system
Versioned storage buckets (ransomware-resistant)

File storage

Files are never public. Upload links are valid for a maximum of 15 minutes.

Public Access Prevention enforced
Uniform access control at container level, no accidentally public files
Own encryption keys for file storage as well
Signed URLs with short validity (max. 15 minutes for uploads)
Lifecycle rules for temporary data
Access logging in a separate audit bucket

Compliance frameworks

Audited infrastructure in line with Swiss, EU and international standards.

Aligned with the revDSG (Swiss Federal Act on Data Protection)
Aligned with the GDPR
Aligned with the requirements of the EU AI Act (Regulation 2024/1689)
ISO 27001 + SOC 2 Type II, the entire server and pipeline infrastructure on which SOTHURA SAFE runs operates in data centres certified to ISO 27001 and SOC 2 Type II
FINMA Circ. 2018/3 outsourcing, aligned with the requirements for insurer clients
Standard Contractual Clauses (SCC) where required

Legal bases and standards

Transparency and user rights

Access, deletion, export. Completed within 30 days.

Access, rectification and deletion within ≤ 30 days
Data portability, export of your own data possible at any time
Incident reporting to supervisory authorities and data subjects, as quickly as possible (Art. 24 nFADP); for EU-related incidents additionally within 72 hours (GDPR Art. 33)
Public sub-processor list on the website (always up to date)
Cryptographic deletion via key revoke

Organisational measures

Contracts, training and registers in line with Swiss data protection law.

Data processing agreements (DPA) with all sub-processors
Documented data protection impact assessment (DPIA)
Records of processing activities (ROPA) maintained
Employee training on data protection and security
Background checks for individuals with productive data access

Mandatory security-gate catalogue

Every product change is checked against a catalogue of fixed security gates before going live, automated and audit-proof.

SG-001, unauthenticated access to protected portal routes is rejected (E2E redirect tests)
SG-002, tenant fail-closed: no data access without tenant context (integration tests)
SG-003, cross-tenant access strictly denied (integration and E2E negative tests, 403)
SG-004, logout invalidates the active session server-side
SG-005, tokens not used as the primary strategy in browser storage
SG-006: AI endpoints only authenticated and tenant-scoped (401/403)
SG-007, signed-URL access is tenant-scoped (401/403)
SG-008, type check, linter and unit tests before rollout
SG-009, runtime smokes on the deployed revision (HTTP 401/403/redirect against prod and staging)

Security contact and responsible disclosure

A dedicated channel is available for security researchers and due diligence enquiries.

Controller: SOTHURA SAFE GmbH, Wassergasse 5, 4573 Lohn-Ammannsegg, Switzerland.

Security reports: security [at] sothura [dot] com, encrypted preferred. Data protection enquiries: datenschutz [at] sothura [dot] com.

We respond to qualified reports within three business days. Please provide a clearly described reproduction path, the affected component and — where possible — an assessment of the impact.

Safe Harbor. We will not pursue security researchers under civil or criminal law as long as (i) the report is made in good faith, (ii) only your own test accounts are used, (iii) no third-party customer data is viewed, copied or disclosed, (iv) no denial-of-service tests or social-engineering attacks against employees take place, and (v) a reasonable period for remediation is granted before public disclosure. Unauthorised penetration tests, exploitation of vulnerabilities beyond what is necessary for reporting and the harvesting of third-party data are not permitted and will be prosecuted under criminal law (Art. 143, 143^bis, 144^bis CC).

Further documents

Last updated: September 2026

April 2026: Initial publication of the security page.

The formalities

SOTHURA SAFE GmbH, Wassergasse 5, 4573 Lohn-Ammannsegg, Canton of Solothurn. Registered in the commercial register of the Canton of Solothurn, UID CHE-429.131.582. Management is held by Silvio Siegenthaler and Michel Di Vito, joint signature by two. The full provider identification is set out in the legal notice.