Security and Data Protection

• Database and primary storage in a certified Swiss data centre in Zurich
• AI processing exclusively in a European data centre in Belgium
• Audit logs in Switzerland with 10-year retention
• No data transfer to the US or other third countries

• AES-256 encryption at rest for all stored data
• TLS 1.2+ encryption in transit for all connections
• Customer-Managed Encryption Keys (CMEK) with your own HSM key (FIPS 140-2 Level 3)
• Client-Side Field Level Encryption (CSFLE) for particularly sensitive fields: AHV numbers, dates of birth, IBAN, insurance policy numbers, claim notifications
• HSM-protected keys with automatic rotation every 90 days
• Your own key sovereignty — the master keys are held exclusively by us, not by the operator of the data centre; the database can be made cryptographically unreadable at any time (key revoke)

• Private networking — the database is never reachable over the public internet
• Private cloud connectivity — the database is not reachable over the public internet, only via a private, internal network tunnel
• Network-isolated infrastructure in Switzerland
• Private DNS resolution — addresses are resolved only within the internal network

• AI models exclusively in European data centres (Belgium)
• Automatic anonymisation through an upstream DLP filter (Data Loss Prevention) before every AI request
• Pseudonymisation of sensitive data (AHV, names, IBAN, addresses) before it reaches the AI
• No training on customer data — contractually excluded
• Swiss custom patterns (AHV number, UID) are detected and masked

• Multi-Factor Authentication (MFA) for all employees
• Role-Based Access Control (RBAC) on the principle of least privilege
• Strict tenant isolation — multi-tenant separation at the data layer
• Separate service accounts with minimal permissions
• Dedicated KMS service accounts for encryption operations
• Separate database users for app, analytics and backup

• Hash-chain logging of all functional mutations and all accesses to particularly sensitive data (read_sensitive); additionally server-side database auditing at the infrastructure layer
• Central log platform with long-term retention
• Immutable audit bucket with 10-year retention
• 24/7 monitoring of the infrastructure

• Continuous backups with point-in-time recovery
• Backups in Switzerland — no cross-region replication outside CH/EU
• Encrypted backups using the same self-managed HSM keys
• Versioned storage buckets (ransomware-resistant)

• Public Access Prevention enforced
• Uniform access control at container level — no accidentally public files
• Customer-Managed Encryption Keys also for file storage
• Signed URLs with short validity (max. 15 minutes for uploads)
• Lifecycle rules for temporary data
• Access logging in a separate audit bucket

• revDSG (Swiss Federal Act on Data Protection) compliant
• GDPR compliant
• ISO 27001 + SOC 2 Type II — the entire server and pipeline infrastructure on which SOTHURA SAFE runs operates in data centres certified to ISO 27001 and SOC 2 Type II
• FINMA Circ. 2018/3 outsourcing — aligned with the requirements for insurer clients
• Standard Contractual Clauses (SCC) where required

• Access, rectification and deletion within ≤ 30 days
• Data portability — export of your own data possible at any time
• Incident reporting to supervisory authorities and data subjects — as quickly as possible (Art. 24 nFADP); for EU-related incidents additionally within 72 hours (GDPR Art. 33)
• Public sub-processor list on the website (always up to date)
• Cryptographic deletion via key revoke

• Data processing agreements (DPA) with all sub-processors
• Documented data protection impact assessment (DPIA)
• Records of processing activities (ROPA) maintained
• Employee training on data protection and security
• Background checks for individuals with productive data access

• SG-001 — unauthenticated access to protected portal routes is rejected (E2E redirect tests)
• SG-002 — tenant fail-closed: no data access without tenant context (integration tests)
• SG-003 — cross-tenant access strictly denied (integration and E2E negative tests, 403)
• SG-004 — logout invalidates the active session server-side
• SG-005 — tokens not used as the primary strategy in browser storage
• SG-006 — AI endpoints only authenticated and tenant-scoped (401/403)
• SG-007 — signed-URL access is tenant-scoped (401/403)
• SG-008 — build and test pipeline green (tsc, lint, integration tests, E2E tests)
• SG-009 — runtime smokes on the deployed revision (HTTP 401/403/redirect against prod and staging)

Controller: SOTHURA SAFE GmbH (in formation), Wassergasse 5, 4573 Lohn-Ammannsegg, Switzerland.

Security reports: security@sothura.ch — encrypted preferred. Data protection enquiries: datenschutz@sothura.ch.

We respond to qualified reports within three business days. Please provide a clearly described reproduction path, the affected component and — where possible — an assessment of the impact.

Safe Harbor. We will not pursue security researchers under civil or criminal law as long as (i) the report is made in good faith, (ii) only your own test accounts are used, (iii) no third-party customer data is viewed, copied or disclosed, (iv) no denial-of-service tests or social-engineering attacks against employees take place, and (v) a reasonable period for remediation is granted before public disclosure. Unauthorised penetration tests, exploitation of vulnerabilities beyond what is necessary for reporting and the harvesting of third-party data are not permitted and will be prosecuted under criminal law (Art. 143, 143^bis, 144^bis CC).