Swisslex AI
Data storage 3/3
What the vendor states (our summary):
Dedicated servers in Swiss data centres, accessible only to Swisslex
What this means: Switzerland only, or customer on-premises. Where data rests decides which law and which authorities can reach it. Swiss firms often require Swiss residency for client matters.
Where the AI runs / sub-processors 3/3
What the vendor states (our summary):
Own servers in Switzerland, adapted open-source models; no data exchange with AI manufacturers
What this means: Switzerland only, own or non-US models. Storage and AI processing are often in different places. A tool can store data in Zurich and still send prompts to models in another country.
US Cloud Act exposure 3/3 ⚖︎
What the vendor states (our summary):
Swiss vendor; no external AI provider per vendor
⚖︎ Judgment call: Swiss company running own models on own Swiss servers; no US provider named in the AI chain.
What this means: Non-US vendor, non-US infrastructure and models. The US CLOUD Act lets US authorities require US providers to disclose data in their possession, custody or control, wherever it is stored. This score is always an editorial judgment call.
Art. 321 SCC auxiliary terms 2/3
What the vendor states (our summary):
General confidentiality (staff confidentiality agreements); AGB s.7 tells users not to enter client data unless a function is intended for it; no auxiliary-person term
What this means: General confidentiality claim, no auxiliary-person term. Under Art. 321 SCC, auxiliaries of a lawyer are bound by professional secrecy, and Art. 13 para. 2 BGFA/LLCA makes the lawyer responsible for ensuring they respect it. Written auxiliary terms help document that.
revFADP / GDPR processing agreement not disclosed
What the vendor states (our summary):
not disclosed · No DPA offered or referenced; Swisslex acts as controller under its privacy policy and the AGB (s.7) ask users not to enter client data unless a function is intended for it.
What this means: Art. 9 revFADP and Art. 28 GDPR require a contract (or legal basis) when a processor handles personal data on your behalf.
No training on customer data 3/3
What the vendor states (our summary):
No training of AI models with user data
What this means: Contractual no-training, including model providers. If customer data trains a model, confidential content could surface elsewhere. Look for a contractual ban that also binds model providers.
ISO 27001 / SOC 2 not disclosed
What the vendor states (our summary):
not disclosed
What this means: Independent audits (ISO 27001, SOC 2 Type II) give evidence that security controls exist and are tested.
What to ask this vendor
- Art. 321 SCC auxiliary terms Will you contractually accept auxiliary-person (Hilfsperson) status under Art. 321 SCC and pass it to sub-processors?
- Art. 321 SCC auxiliary terms Who at your company or at sub-processors can access our content in clear text?
- revFADP / GDPR processing agreement Please send your DPA. Does it reference the Swiss revFADP as well as the GDPR?
- revFADP / GDPR processing agreement Which transfer mechanism covers any processing outside Switzerland/EEA?
- ISO 27001 / SOC 2 Please send your current ISO 27001 certificate and scope, or SOC 2 Type II report.
- ISO 27001 / SOC 2 When was your last independent penetration test?
Informational only, not legal advice. Results reflect vendors’ public statements on the date checked and our scoring rules. Verify contracts yourself before using any tool with client data.