Topic
The questionnaire asks where the data is, who touches it, how it is backed up and what the certification proves. Here is how to answer without promising anything the evidence does not support, and how to present the choice of a Swiss host.
A supplier security questionnaire almost always asks the same five hosting questions: in which country the data is stored, which subcontractors can access it, where and how backups are made, which certification covers the infrastructure, and what legal basis the processing rests on. The buyer is not after a sovereignty slogan, but a dated, named and verifiable answer.
Choosing a Swiss host simplifies several of these answers without replacing them. The Sovereignty page explains what Certenor claims and what it does not promise; this page takes the side of the company that has to fill in or assess the questionnaire.
For shared web hosting, Swiss providers publish their own information, for example Infomaniak's web hosting offeraffiliate link, presented below as an example to assess with the grid, not as a recommendation.
A wording for the answer and the evidence to attach, for each of the five most frequent questions.
| Questionnaire question | What to answer | Evidence to attach |
|---|---|---|
| Where is the data hosted? | The country, data centre or region, and the host's name, as the contract states them. Writing "in Switzerland" without naming the provider is not enough. | Contract extract or provider page, with the date it was consulted. |
| Which subcontractors can access the data? | A named list: hosting, backup, mail, support, AI models where relevant, with each one's processing location. The Swiss Data Protection Act (art. 9) says a processor may pass processing on to a third party only with the controller's prior authorisation. | Subcontractor register kept current, with the date of the last review. |
| How and where are backups made? | Frequency, retention, location (another site, same country or not) and the restore test. Do not confuse the host's restore feature with an independent backup. | Procedure description and the date of the last restore test. |
| Does an ISO 27001 certification cover the hosting? | Yes or no, and for which scope. A certification covers a management system bounded by a scope: it does not guarantee that every service or measure is inside it. | The host's certificate: issuing body, scope, statement of applicability if it can be shared, validity date. |
| How are transfers outside Switzerland governed? | State whether there are any. If so, the Act (art. 16 and 17) sets the conditions for disclosure abroad: an adequate level of protection established, or appropriate safeguards, or an exception. | Contract clauses, the applicable adequacy decision, or a "no transfer" statement. |
Four arguments, each tied to a requirement the buyer recognises. None replaces the evidence.
The processing location is written in the contract and checkable on the host's page. Data that stays in Switzerland avoids having to show the safeguards for disclosure abroad (art. 16 and 17), but subcontractors and copies still need checking.
Art. 8 requires organisational and technical measures appropriate to the risk. The file describes the host's measures and those you add on top: encryption, access, logs.
Art. 9 requires making sure the processor can guarantee data security. The hosting contract, its annexes and the list of its own subcontractors are the documents to include.
A Swiss-law contract with a Swiss venue is simpler for a Swiss buyer to assess. It does not rule out mutual legal assistance, covered below.
A Swiss company remains subject to Swiss law: the law can require it to hand over data it holds, and a foreign authority can act through mutual legal assistance, which the Swiss authorities review. Real protection also depends on architecture: encryption with keys only you hold, minimisation, control of copies. So write down in the file what choosing Switzerland brings, and what it does not.
The text of the Federal Act on Data Protection (in force since 1 September 2023) is published on Fedlex, whose authentic versions are French, German and Italian. Articles used here: art. 8 (data security), art. 9 (processing by processors), art. 16 (disclosure abroad, principles) and art. 17 (exceptions).
The supervisory authority's guidance and positions are on the site of the Federal Data Protection and Information Commissioner (FDPIC). For our own evidence pieces, see the Data protection page and the Questionnaires page.
Request an assessment
Tell us who is asking, by when, and what usable evidence you already hold. We reply within two working days, in English, French or German.
A questionnaire on your desk and a short deadline? That is the right moment to write to us.
Email Certenor