Server location

What we check

We use the IP address of the website to determine in which country the server is located. From the responses of the server and from the DNS records we also recognise whether the website is delivered via a content delivery network (CDN) such as Cloudflare, Fastly or Amazon CloudFront.

• Switzerland: fine.
• EU or EEA: note. Permitted, but belongs in the privacy policy.
• Outside Europe: warning. This has to be stated in the privacy policy and as a rule needs additional safeguards.
• CDN: note. Visitor data passes through this provider, the location depends on the visitor.

This is an automatic preliminary check, not legal advice.

Why it matters

Every visit to the website transmits personal data to the server, at least the IP address, often form input as well. The revised Data Protection Act requires the privacy policy to state to which countries personal data is disclosed.

• Switzerland, EU and EEA: the Federal Council recognises these countries as states with adequate data protection. Disclosure to them is permitted without further safeguards, but has to be named.
• USA: since September 2024 the Swiss-US Data Privacy Framework has applied. With certified providers disclosure is permitted, with others additional safeguards such as standard contractual clauses are needed.
• Other countries: as a rule standard contractual clauses or comparable safeguards are needed here.

Many websites are with international providers without the operators knowing, for example because the agency chose a cheap server abroad. For some industries such as health, law or fiduciary, a location in Switzerland can also be an argument of trust towards customers.

How to fix it

Complete the privacy policy

In every case name:

• the hosting provider,
• the country of the server location,
• with a CDN the provider, and that data may be processed worldwide,
• for countries without adequate data protection, the safeguards relied on.

Consider hosting in Switzerland

Swiss providers such as Hostpoint, Infomaniak, Cyon, Metanet, green.ch or Nine offer hosting with the server located in Switzerland. For simple websites a move is usually done in a few hours. With website builders such as Wix or Squarespace the location cannot be chosen. Here the correct statement in the privacy policy is enough.

Use a CDN deliberately

A CDN makes a website faster and protects against attacks. If one is used, it belongs in the privacy policy. If none is needed, for example because the visitors come almost only from Switzerland, Swiss hosting without a CDN is the simpler solution.

How to check it yourself

Ask the hosting provider or look in the customer area to see in which data centre the website is located. Online IP lookup services show the country for the IP address of the domain.

Frequently asked questions

May a website be hosted in the USA?

In principle yes, if the disclosure of data is safeguarded, for example because the provider is certified under the Swiss-US Data Privacy Framework or uses standard contractual clauses. And it has to be stated in the privacy policy.

Why does the check show a different country from the one the hosting provider states?

We determine the location via the IP address. With a CDN or an upstream protection service we see its server, not the actual hosting server. Databases of IP origin are also not always exact.

Is this legal advice?

No. We show where the server is technically located. What obligations arise from this is for a professional to judge.