Project with sensitive personal data: host in Switzerland (Infomaniak, Hostpoint) or the European Union (OVHcloud, Scaleway)?
Choice is not just the datacenter flag. It is read in the full chain: production, backups, logs, admin support, subcontractors and connected SaaS tools.
Many teams compare two countries on a slide. Auditors compare the weakest link in the chain — often a forgotten US backup, not the main datacenter on the marketing page.
Switzerland: outside EU, framed by adequacy
Switzerland offers recognised legal stability, documented datacenters and an EU adequacy decision for data transfers — under conditions and regulatory evolution to monitor.
Infomaniak publishes carbon reporting and ISO 27001 certification, but does not offer French HDS health hosting. Hostpoint and other Swiss vendors fit if clients accept documented Swiss residence and clear contractual requirements — not if the tender mandates strict EU jurisdiction or SecNumCloud.
Switzerland is not the EU: Swiss FADP and GDPR converge on many points, but French sector certifications (HDS) and sensitive public contracts may exclude Switzerland from the first contract paragraph.
EU: native GDPR and sector certifications
French, German or Dutch hosts are directly under GDPR. Depending on vendor, you access French HDS health, SecNumCloud or other sector attestations absent at a general Swiss host.
EU jurisdiction does not guarantee absence of US subcontractor: a Paris datacenter with US CDN, support or backup dilutes the "100% EU" promise exactly as Swiss prod with US backup dilutes Switzerland.
| Criterion | Switzerland | EU |
|---|---|---|
| Framework | FADP + EU adequacy | GDPR |
| French HDS health | No (Infomaniak) | Yes (scope) |
| Cloud Act | Off US if pure CH | Risk if US subcontractor |
| Proof | Infomaniak reports | Sector attestations |
Map the chain — not just main datacenter
Request flow diagram, DPA, backup copy location and admin support access. Swiss prod + US backup + US CDN dilutes "100% Swiss" promise. French prod + uncontrolled US SaaS dilutes the European Union.
Ask concrete questions: where are access logs? Who can administer the server from abroad? Which subcontractors handle tickets or backups? A vague answer to any of these often invalidates the country choice, whichever it is.
See Infomaniak GDPR and Schrems II to frame transfers and contractual guarantees.
Use cases: when Switzerland suffices, when EU mandates
Switzerland relevant: Swiss or European SMB accepting CH residence, corporate site, media, SaaS without HDS or SecNumCloud requirement, client valuing stability and Infomaniak transparency.
EU relevant: French public sector, HDS health, operator requiring strict EU jurisdiction, contract naming SecNumCloud or forbidding transfer outside EU without Schrems II guarantees.
The right choice is not what reassures your technical team — it is what your client and DPO can sign without reservation.
Schrems II and US subcontractors
Schrems II mainly targets transfers to countries without adequacy — notably the United States. Switzerland remains framed by adequacy, but a Swiss chain with undocumented US SaaS recreates the same risk as a French host with the same SaaS.
Document guarantees, contractual clauses and absence of Cloud Act chain where clients require it. Main datacenter country is not enough if CRM, monitoring or backup leave the promised perimeter.
The peak: sensitive residence is the weakest link
Decide and move forward without blind spots
Require a data flow diagram, signed DPA and written location of backups and logs. Verify subcontractors, admin support access and SaaS tools connected to production. Align choice with client requirements: HDS, SecNumCloud, strict EU jurisdiction or accepted Swiss residence.
See Infomaniak GDPR, Schrems II and the directory to compare documented vendors before signing.
Frequently asked questions
Is Switzerland "GDPR equivalent"?
Switzerland benefits from an EU adequacy decision for transfers, under conditions and regulatory evolution to monitor. It is still not the European Union: verify DPA, subcontractors and sector certifications your clients require before promising full equivalence.
Infomaniak or French host for sensitive data?
Infomaniak fits if Swiss residence and ISO 27001 suffice for your client and no French certification (HDS) or SecNumCloud requirement applies. A French or EU host fits if clients explicitly require EU jurisdiction or sector attestations absent in Switzerland.
Does Schrems II change Switzerland choice?
Schrems II mainly targets transfers to countries without adequacy, notably the United States. Switzerland remains framed, but you must document guarantees and absence of Cloud Act chain via US subcontractors or SaaS. Datacenter country is not enough without full mapping.
Backups outside Switzerland?
Critical point: ask location of copies, logs and admin support. Swiss production with backup in the European Union or United States sometimes invalidates "100% Swiss" claim — exactly as EU prod with US backup invalidates the European promise.
Sensitive data: the right residence is the one you can draw end to end — not the slogan.