Security and Data Protection

• Database and primary storage in a certified Swiss data centre in Zurich
• The vector indexes for AI search are held in Switzerland as well
• Audit logs in Switzerland with 10-year retention
• Processing exclusively in Switzerland and the EU, no transfer to the US or other third countries

• AES-256 for all stored data, TLS 1.2+ for every connection
• Field-level encryption for particularly sensitive details: AHV numbers, dates of birth, IBAN, policy numbers, claims reports
• Hardware-backed key management with regular rotation
• Key sovereignty rests with a Swiss company, the database can be rendered cryptographically unreadable at any time

• Private networking, the database is never reachable over the public internet
• Private cloud connectivity, the database is not reachable over the public internet, only via a private, internal network tunnel
• Network-isolated infrastructure in Switzerland
• Private DNS resolution, addresses are resolved only within the internal network

• Processing exclusively in Switzerland and the EU, never in the US
• No training on customer data, contractually excluded
• No storage at the AI provider and no human review
• Designed for revDSG, GDPR and the requirements of the EU AI Act
• Every analysis stays traceable and is logged in an audit-proof manner

• Multi-Factor Authentication (MFA) for all employees
• Role-Based Access Control (RBAC) on the principle of least privilege
• Strict tenant isolation, multi-tenant separation at the data layer
• Separate service accounts with minimal permissions
• Dedicated KMS service accounts for encryption operations
• Separate database users for app, analytics and backup

• Hash-chain logging of all functional mutations and all accesses to particularly sensitive data (read_sensitive); additionally server-side database auditing at the infrastructure layer
• Central log platform with long-term retention
• Immutable audit bucket with 10-year retention
• 24/7 monitoring of the infrastructure

• Continuous backups with point-in-time recovery
• Backups in Switzerland, no cross-region replication outside CH/EU
• Encrypted backups using the same keys as the production system
• Versioned storage buckets (ransomware-resistant)

• Public Access Prevention enforced
• Uniform access control at container level, no accidentally public files
• Own encryption keys for file storage as well
• Signed URLs with short validity (max. 15 minutes for uploads)
• Lifecycle rules for temporary data
• Access logging in a separate audit bucket

• revDSG (Swiss Federal Act on Data Protection) compliant
• GDPR compliant
• ISO 27001 + SOC 2 Type II, the entire server and pipeline infrastructure on which SOTHURA SAFE runs operates in data centres certified to ISO 27001 and SOC 2 Type II
• FINMA Circ. 2018/3 outsourcing, aligned with the requirements for insurer clients
• Standard Contractual Clauses (SCC) where required

• Access, rectification and deletion within ≤ 30 days
• Data portability, export of your own data possible at any time
• Incident reporting to supervisory authorities and data subjects, as quickly as possible (Art. 24 nFADP); for EU-related incidents additionally within 72 hours (GDPR Art. 33)
• Public sub-processor list on the website (always up to date)
• Cryptographic deletion via key revoke

• Data processing agreements (DPA) with all sub-processors
• Documented data protection impact assessment (DPIA)
• Records of processing activities (ROPA) maintained
• Employee training on data protection and security
• Background checks for individuals with productive data access

• SG-001, unauthenticated access to protected portal routes is rejected (E2E redirect tests)
• SG-002, tenant fail-closed: no data access without tenant context (integration tests)
• SG-003, cross-tenant access strictly denied (integration and E2E negative tests, 403)
• SG-004, logout invalidates the active session server-side
• SG-005, tokens not used as the primary strategy in browser storage
• SG-006: AI endpoints only authenticated and tenant-scoped (401/403)
• SG-007, signed-URL access is tenant-scoped (401/403)
• SG-008, build and test pipeline green (tsc, lint, integration tests, E2E tests)
• SG-009, runtime smokes on the deployed revision (HTTP 401/403/redirect against prod and staging)

Controller: SOTHURA SAFE GmbH, Wassergasse 5, 4573 Lohn-Ammannsegg, Switzerland.

Security reports: security [at] sothura [dot] com, encrypted preferred. Data protection enquiries: datenschutz [at] sothura [dot] com.

We respond to qualified reports within three business days. Please provide a clearly described reproduction path, the affected component and — where possible — an assessment of the impact.

Safe Harbor. We will not pursue security researchers under civil or criminal law as long as (i) the report is made in good faith, (ii) only your own test accounts are used, (iii) no third-party customer data is viewed, copied or disclosed, (iv) no denial-of-service tests or social-engineering attacks against employees take place, and (v) a reasonable period for remediation is granted before public disclosure. Unauthorised penetration tests, exploitation of vulnerabilities beyond what is necessary for reporting and the harvesting of third-party data are not permitted and will be prosecuted under criminal law (Art. 143, 143^bis, 144^bis CC).