The US CLOUD Act for Swiss law firms
Why “hosted in Switzerland” does not settle the question when the provider is American, and how SecretSafe scores it.
Informational only, not legal advice. Results reflect vendors’ public statements on the date checked and our scoring rules. Verify contracts yourself before using any tool with client data.
What the CLOUD Act does
The Clarifying Lawful Overseas Use of Data (CLOUD) Act was enacted in March 2018. Under 18 U.S.C. § 2713, a provider of electronic communication or remote computing services must comply with US legal process to preserve or disclose data within its possession, custody, or control, regardless of whether the data is located inside or outside the United States.
The Act also allows bilateral data-access agreements. The US Department of Justice lists agreements with the United Kingdom and Australia, and negotiations with Canada and the EU. Check the DOJ page for the current list.
Why it matters for Swiss secrecy
A Swiss data centre operated by a US company, or a Swiss vendor whose AI runs on a US-parent cloud, may be within reach of US process. Whether a given request could actually reach your data depends on corporate structure, contracts and facts. Specialist advice is needed for any specific case.
How we score it
Every Cloud Act score on SecretSafe is an editorial judgment call, marked ⚖︎ with a one-line rationale. We look at the domicile of the vendor and of the infrastructure and model providers it names publicly:
- 3: non-US vendor, non-US infrastructure and models (per the vendor).
- 2: Swiss storage, but US-parent compute, or exposure only through an optional feature.
- 1: non-US vendor relying on US-parent clouds or models.
- 0: US-domiciled vendor or US-only processing.
A low score is not a finding that data has been or will be disclosed. It indicates a question to put to the vendor.