Swiss-Noxtua
Data storage 3/3
What the vendor states (our summary):
Swiss T Cloud Public (T-Systems Schweiz AG, Zollikofen)
What this means: Switzerland only, or customer on-premises. Where data rests decides which law and which authorities can reach it. Swiss firms often require Swiss residency for client matters.
Where the AI runs / sub-processors 2/3
What the vendor states (our summary):
Default Athena model processed in Switzerland; optional 'Minerva' routes to frontier models in EU or CH via named subprocessors
What this means: Switzerland plus EU/EEA. Storage and AI processing are often in different places. A tool can store data in Zurich and still send prompts to models in another country.
US Cloud Act exposure 3/3 ⚖︎
What the vendor states (our summary):
Default stack independent of US hyperscalers per vendor; Minerva option may use other providers
⚖︎ Judgment call: Vendor states default stack avoids US hyperscalers (T-Systems, German parent); Minerva option changes this.
What this means: Non-US vendor, non-US infrastructure and models. The US CLOUD Act lets US authorities require US providers to disclose data in their possession, custody or control, wherever it is stored. This score is always an editorial judgment call.
Art. 321 SCC auxiliary terms 3/3
What the vendor states (our summary):
Terms bind provider, staff and subprocessors as Hilfspersonen under Art. 321 StGB
What this means: Contractual auxiliary-person (Hilfsperson) status or external legal opinion. Under Art. 321 SCC, auxiliaries of a lawyer are bound by professional secrecy, and Art. 13 para. 2 BGFA/LLCA makes the lawyer responsible for ensuring they respect it. Written auxiliary terms help document that.
revFADP / GDPR processing agreement 3/3
What the vendor states (our summary):
Acts as Auftragsbearbeiter under DSG and GDPR; processing terms in AGB
What this means: Public DPA that names the revFADP. Art. 9 revFADP and Art. 28 GDPR require a contract (or legal basis) when a processor handles personal data on your behalf.
No training on customer data 3/3
What the vendor states (our summary):
Inputs used only to fulfil the request, not for training
What this means: Contractual no-training, including model providers. If customer data trains a model, confidential content could surface elsewhere. Look for a contractual ban that also binds model providers.
ISO 27001 / SOC 2 2/3
What the vendor states (our summary):
ISO 27001, 27017, 27018, 42001, BSI C5 listed for Noxtua (technology partner), not the Swiss entity
What this means: Claimed or partner-level. Independent audits (ISO 27001, SOC 2 Type II) give evidence that security controls exist and are tested.
What to ask this vendor
- Where the AI runs / sub-processors In which countries do the AI models process our prompts, including fallback or peak-load routing?
- Where the AI runs / sub-processors Please provide the full sub-processor list with locations, and how we are notified of changes.
- ISO 27001 / SOC 2 Please send your current ISO 27001 certificate and scope, or SOC 2 Type II report.
- ISO 27001 / SOC 2 When was your last independent penetration test?
Informational only, not legal advice. Results reflect vendors’ public statements on the date checked and our scoring rules. Verify contracts yourself before using any tool with client data.