Where your data sits, who can touch it, how long it stays.

Storage and processing in Swiss data centres, with location, operator and certifications stated. No transfer to third countries without the client's express written instruction.

Access on the least-privilege principle, time-limited to the mandate, with two-factor authentication and logging. Named individuals accountable for each mandate.

Retention periods are set contractually for each mandate. On expiry, deletion is documented with a record; storage media are erased to a recognised standard.

A complete, dated list with purpose and location. Changes are announced in advance.

Reporting routes, deadlines and contacts in the event of a security incident — including our commitments on notifying you.