Security & Compliance

Enterprise-grade security built for Swiss educational institutions. Your data is protected by industry-leading encryption, strict access controls, and Swiss data protection compliance.

AES-256At RestTLS 1.3In Transit99.9%+Uptime Guarantee

Last updated: February 2026

Infrastructure & Hosting

Swiss & European Data Residency

Our platform infrastructure is hosted on European servers with Swiss data residency. We use enterprise-grade cloud providers with ISO 27001 certification and SOC 2 Type II compliance, ensuring your data never leaves trusted jurisdictions.

High Availability Architecture

Our infrastructure employs multiple availability zones with automatic failover, ensuring 99.9%+ uptime. Database backups are performed continuously with point-in-time recovery capability. All backups are encrypted and stored in geographically separate locations within Europe.

Content Delivery

Static assets and public school profiles are served through a global edge network for fast load times worldwide, while all dynamic data processing and storage remains within European infrastructure boundaries.

Encryption

Data in Transit

All data transmitted between your browser and our servers is encrypted using TLS 1.3 with modern cipher suites. We enforce HTTPS across all endpoints and implement HTTP Strict Transport Security (HSTS) with a minimum 1-year duration.

Data at Rest

All data stored in our databases is encrypted at rest using AES-256 encryption. Encryption keys are managed through dedicated key management services with automatic rotation. Backup data is encrypted with separate encryption keys.

Sensitive Data Handling

Authentication credentials are hashed using bcrypt with appropriate cost factors. API keys and webhook secrets are encrypted with application-level encryption before storage. Payment card data is never stored on our servers—it is handled entirely by Stripe (PCI DSS Level 1 certified).

Access Controls

Role-Based Access Control (RBAC)

The platform implements granular role-based access control with four permission levels: Owner (full control), Admin (management access), Editor (content editing), and Viewer (read-only). Each role has precisely defined permissions enforced at both application and database levels.

Row Level Security (RLS)

Our database implements PostgreSQL Row Level Security, ensuring that every query is filtered at the database level. Schools can only access their own data—inquiries, bookings, analytics, and settings are isolated per institution with cryptographic user verification.

Authentication Security

We support email/password authentication with enforced password policies, magic link authentication for passwordless access, and team invitation flows with secure token-based verification. All sessions use short-lived JWT tokens with automatic refresh.

Audit & Monitoring

Activity Logging

All significant platform actions are logged, including authentication events, data access, profile modifications, and administrative operations. Logs are immutable and retained for 12 months, available for compliance auditing purposes.

Real-Time Monitoring

Our infrastructure is continuously monitored for performance, availability, and security anomalies. Automated alerts trigger our incident response process for any detected irregularities, including unusual access patterns or potential security threats.

Compliance & Certifications

Swiss Federal Act on Data Protection (FADP)

Our platform is fully compliant with the revised Swiss Federal Act on Data Protection (nFADP/revFADP), effective September 1, 2023. This includes implementing privacy by design principles, maintaining a register of processing activities, and conducting data protection impact assessments for high-risk processing.

EU General Data Protection Regulation (GDPR)

We comply with the GDPR for all processing of EU residents' personal data. This includes honoring data subject rights (access, rectification, erasure, portability), maintaining lawful bases for processing, and implementing data protection by design and by default.

Industry Standards & Roadmap

Our infrastructure providers maintain SOC 2 Type II and ISO 27001 certifications. We conduct annual third-party security assessments and are actively working toward our own SOC 2 Type II certification. Our security practices align with the OWASP Application Security Verification Standard (ASVS).

Incident Response

Response Process

Our incident response plan follows a structured process: Detection & Triage (within 15 minutes), Containment (within 1 hour), Investigation & Remediation, Recovery, and Post-Incident Review. All incidents are classified by severity level with corresponding response priorities.

Notification Commitment

In the event of a data breach affecting your institution, we will notify you within 72 hours of confirmation, consistent with FADP and GDPR requirements. Notifications include the nature and scope of the breach, actions taken, and recommendations for your own notification obligations.

Continuous Improvement

Every security incident triggers a post-mortem review. Findings are used to improve our security controls, update our threat model, and enhance our monitoring capabilities. We publish an annual transparency report summarizing security incidents and improvements.

Responsible Disclosure

Security Research

We welcome responsible security research. If you discover a potential vulnerability, please report it to security@swissprivate-schools.ch. We commit to acknowledging reports within 24 hours and providing an initial assessment within 5 business days.

Safe Harbor

We will not pursue legal action against security researchers who act in good faith, follow responsible disclosure practices, and give us reasonable time to address reported vulnerabilities before public disclosure.

Swiss-Hosted Guarantee

Swiss Private Schools is committed to the highest standards of data security and privacy. All personal data is processed within European infrastructure with Swiss data residency, protected by Swiss and EU data protection laws.

Our security practices are regularly reviewed and updated to address evolving threats and regulatory requirements. For security inquiries, contact our team at security@swissprivate-schools.ch.