Your website collects data every day. Enquiries, requests for quotes, perhaps job applications. And you probably don’t know which country the data is stored in.
You’re not alone in this. Most business owners I speak to don’t know. Not because they’re careless, but because nobody ever told them. The website was built back then, it’s up and running, and exactly where it’s hosted was never an issue.
Until someone asks, that is.
Who is asking, and why?
In my experience, it’s mainly three types of customer who ask me this question.
Fiduciary firms, because they process their own clients’ payroll data and accounts. Medical practices, because patient data requires a particularly high level of protection. And law firms, because they are bound by professional confidentiality.
For these three, the question of where data is stored is not a matter of curiosity, but part of their duty of care. If their client asks and they simply shrug their shoulders, they’ve got a problem. And so does their web service provider.
What’s really behind it
This isn’t about patriotism. It’s about which law applies.
If the data is stored on a server in Switzerland and the provider is a Swiss company, Swiss data protection law applies. One regulatory framework, one point of contact, one place of jurisdiction.
If they are held by a foreign group, further legal systems come into play. This is the case even if the server is technically located in Switzerland. A US company remains subject to US law, regardless of where the hard drive is located.
For an online shop selling trainers, this is rarely a critical issue. For the three mentioned above, it’s the difference between «I can take responsibility for this» and «I can’t».
The five questions you should ask your web service provider
Whether you’re with me or somewhere else, send these questions to the person who looks after your website:
- Where exactly are the servers that host my website located?
- Who is the provider behind this, and where are they based?
- Where are the backup copies kept, and for how long are they retained?
- Which external services are integrated, and where do they process their data?
- Who has administrative access, and how is it secured?
If you receive a specific reply within a day, you’re in good hands. If the reply is evasive or doesn’t come at all, that tells you something too.
And if you’re reading these questions for the first time and realise you can’t answer a single one of them: that’s normal. It’s just not a situation you should let continue.
How I handle it
All the client websites I manage are hosted on a managed server at a Swiss provider. No middlemen, no routing via foreign data centres.
That wasn’t a marketing decision. It’s simply the option that allows me to answer your question about your data in a single sentence.
To be honest, if you’re processing payments, sending out newsletters or analysing statistics, there’s really no getting round using international providers. It’s exactly the same for me. The difference is that I know where each component is hosted, and I can tell you before you even ask.
What the labels have to do with it
As of this month, Swiss Media Design has been awarded two further honours:
- swiss made software for software developed in Switzerland
- swiss digital services for digital services with Swiss added value
The requirements for this include, amongst other things, a Swiss value share of at least 60 per cent of the manufacturing costs, the main manufacturing process taking place in Switzerland, and an entry in the Commercial Register. In the case of a business that I have been running on my own from Buchs for twelve years, this share is well above the minimum.
I deliberately did not take a third label: swiss hosting. Its conditions require all data, including all backups, to be stored with providers that are not subject to any foreign access. My backups run via Microsoft 365 with data stored in Switzerland. This is fine for day-to-day use, but it does not, with absolute certainty, meet this particularly strict requirement.
Wearing a label that I’d have to justify is out of the question for me. I’d rather have two that are right than three with a footnote.
In conclusion
A label is a shortcut. It tells you in two seconds that someone has looked into the subject.
The real work takes place beforehand, when choosing the hosting provider, the tools and the partners. A label merely serves to validate these decisions to the outside world.
Send the five questions above to your web service provider. What you get back will tell you more than any logo in the footer. Even more than mine.
And if that answer doesn’t convince you: I’ll answer all five for you, each in a single sentence.