What Does 'Swiss-Hosted AI' Actually Mean?

“Swiss-hosted” is showing up on more and more AI landing pages — including ours. It sounds reassuring. But the label is doing a lot of work, and not every vendor means the same thing by it. If you are evaluating AI tools for a company that handles client data, contracts, HR files, or patient records, you need to know what is actually behind the flag.

This article unpacks the term: what Swiss hosting covers, what it often does not, and the questions that separate a marketing badge from a real data sovereignty guarantee.

Why the question matters

Since September 2023, the revised Swiss Federal Act on Data Protection (FADP, or DSG) has been in force. It brings Swiss law close to the GDPR and puts real obligations on companies: you must know where personal data is processed, by whom, and under which jurisdiction. Transfers to countries without adequate protection require specific safeguards.

For many Swiss businesses the bar is even higher than the law. Banks answer to FINMA guidance on outsourcing and cloud. Law firms and doctors are bound by professional secrecy. Manufacturers protect trade secrets that took decades to build. When employees paste that kind of information into a chatbot, “where does this go?” stops being a theoretical question.

Hosting is more than a server location

When a vendor says “Swiss-hosted”, there are actually four separate layers to check. A green checkmark on one layer says nothing about the other three:

• Storage: Where is your data at rest — documents, embeddings, chat history, backups? A Swiss primary database with backups replicated abroad is not Swiss data residency.
• Processing: Where does computation happen? This includes the AI model itself. Some tools store your files in Switzerland but send every prompt to a model API in the US.
• Jurisdiction: Who operates the infrastructure, and which legal system can compel them to hand over data? A server in Zurich run by a US corporation is not outside the reach of US law.
• Data lifecycle: What happens to your data after processing? Is it used to train models, retained indefinitely, or deleted on schedule?

The jurisdiction problem: a Swiss data center is not enough

This is the layer most often glossed over. Under the US CLOUD Act, American authorities can require US companies to produce data they control — regardless of where the servers stand. A hyperscaler region in Switzerland changes latency and helps with some compliance requirements, but the operating company still answers to a foreign legal system.

Genuine Swiss data sovereignty means the infrastructure is operated by a company incorporated in Switzerland and subject to Swiss law. That is the difference between “our servers are in Switzerland” and “your data is governed by Swiss law, full stop.”

The blind spot: where does the AI model run?

AI platforms have a layer that classic SaaS never had: model inference. Every question your team asks, and every document passage retrieved to answer it, passes through a language model. If that model is a third-party API abroad, your most sensitive content crosses the border on every single request — no matter how Swiss the storage layer is.

A related question is training. Some AI providers use customer inputs to improve their models. For business data this should be a hard no: your contracts and policies must never become part of a model that serves other companies. Ask for a written guarantee, not a settings toggle.

Six questions to ask any AI vendor

• Where is our data stored at rest, including backups and vector embeddings?
• Where does model inference happen, and which sub-processors are involved?
• Is the infrastructure operator a Swiss legal entity, or a subsidiary of a foreign one?
• Is our data ever used to train or fine-tune models? Is that excluded contractually?
• What is deleted when we leave, and how quickly — including backups?
• Can we see who accessed what? Are there audit logs and source citations for every AI answer?

A serious vendor answers all six in writing. Vague answers on any layer usually mean the honest answer is one you would not like.

How yeos answers them

We built yeos for exactly these requirements, so we hold ourselves to the same checklist. yeos is hosted by Infomaniak, an independent Swiss infrastructure provider — customer data is stored and processed in data centers physically located in Switzerland, under Swiss jurisdiction.

• Customer data is never used to train or fine-tune AI models — this is a contractual guarantee, not a preference setting.
• Data from different customers is never combined, and your data is used exclusively for your own processing sessions.
• Every agent answer cites the documents it used, and audit logs record what was asked, which sources were retrieved, and what actions were taken.
• When you leave, your data is irreversibly deleted from production systems and backups after the export period.

Processing complies with the Swiss FADP and the GDPR — the full details are in our privacy policy, in plain language.

The label is the start, not the answer

“Swiss-hosted” is a useful signal, but it is only the headline. The substance is in the four layers: storage, processing, jurisdiction, and lifecycle. Ask the six questions above of every AI vendor — including us. If the answers are specific and in writing, you can put AI to work on your real documents and workflows with a clear conscience.