SecretSafe
FR Français

Secrecy checker

Answer four questions. We filter the directory against the published scores and give you a printable due-diligence checklist.

Informational only, not legal advice. Results reflect vendors’ public statements on the date checked and our scoring rules. Verify contracts yourself before using any tool with client data.

1. Where is your firm subject to professional rules?
2. Do you act for banks, insurers or other FINMA-supervised clients?
3. How sensitive is the data you would put into the tool?
4. Do you need all AI processing to stay in Switzerland?

Due-diligence checklist

  1. Data storage: In which country and data centre are our documents, prompts, outputs and backups stored?
  2. Data storage: Can we contractually fix storage in Switzerland?
  3. Where the AI runs / sub-processors: In which countries do the AI models process our prompts, including fallback or peak-load routing?
  4. Where the AI runs / sub-processors: Please provide the full sub-processor list with locations, and how we are notified of changes.
  5. US Cloud Act exposure: Is your company or any sub-processor in the processing chain a US company or a subsidiary of one?
  6. US Cloud Act exposure: How would you respond to a foreign government request for our data, and will you notify us?
  7. Art. 321 SCC auxiliary terms: Will you contractually accept auxiliary-person (Hilfsperson) status under Art. 321 SCC and pass it to sub-processors?
  8. Art. 321 SCC auxiliary terms: Who at your company or at sub-processors can access our content in clear text?
  9. revFADP / GDPR processing agreement: Please send your DPA. Does it reference the Swiss revFADP as well as the GDPR?
  10. revFADP / GDPR processing agreement: Which transfer mechanism covers any processing outside Switzerland/EEA?
  11. No training on customer data: Is it contractually excluded that our data trains or fine-tunes any model, including the model providers’ models?
  12. No training on customer data: What is retained by model providers (abuse monitoring, logs), and for how long?
  13. ISO 27001 / SOC 2: Please send your current ISO 27001 certificate and scope, or SOC 2 Type II report.
  14. ISO 27001 / SOC 2: When was your last independent penetration test?

Informational only, not legal advice. Results reflect vendors’ public statements on the date checked and our scoring rules. Verify contracts yourself before using any tool with client data.

PDF