Swiss Knowledge Hub

GDPR overview

The privacy policy, in force since 22 April 2026, is headed "Datenschutzerklärung — DSG & DSGVO-konform" and claims a dual regime: the revised Swiss FADP and the GDPR "so far as applicable". It lists access, rectification, erasure, restriction, portability, withdrawal of consent, objection and complaint; the Swiss supervisory authority named is the EDÖB, and rights are exercised by e-mail. In the standard configuration, documents and queries stay in Switzerland under the publisher's DPA, supplied on request within one business day with a subprocessor list and a security whitepaper. Under BYOK to a provider outside Switzerland or the EU, standard contractual clauses, the transfer impact assessment and supplementary measures fall entirely to the customer, and the provider may apply its own policy. No Art. 27 EU representative is named. Swiss law and the Bern courts apply exclusively, and the publisher notes that no formal FADP certification exists.

Who owns the data?

Swiss Knowledge Hub GmbH (Könizstrasse 161, Liebefeld, UID CHE-219.860.750) is the declared controller, but in the standard setup it acts as a processor under a DPA for the documents an organisation uploads and for the vector embeddings derived from them. Article 7 of the terms makes the customer responsible for the lawfulness of uploaded content, while article 4 keeps all rights in the platform itself — source code, design, trademarks and documentation — with the publisher. Personal fields such as names and e-mail addresses are encrypted at field level. Under BYOK the chosen provider is not a subprocessor of the publisher but an independent processor engaged directly by the customer organisation.

Reuse rights

The terms assign the rights in the platform to the publisher and make the customer responsible for uploaded content; nothing in them restricts how an organisation reuses its own documents or the answers it obtains, though the privacy policy asks that results be validated by a human. The publisher states it processes data only to deliver and bill the service, to operate the platform, detect abuse and analyse errors, and to communicate with prospects, citing both art. 31 revFADP and art. 6 GDPR for each purpose. There is no automated individual decision-making. Every access and every query is written to a tenant-isolated audit log; technical cookies (session, language, theme) run without consent, while analytics and marketing cookies require explicit, revocable consent. In the Swiss standard setup, inference runs on enterprise API tariffs that contractually exclude any training use of submitted content — and the publisher itself notes that "no training" cannot be enforced technically, it is a contractual commitment by the provider. Under BYOK, training, retention and location depend exclusively on the contract between the customer organisation and the provider it selects, which may follow a different policy.

Data retention & training

Hosting summary

Product data and the marketing website sit in two different countries, and the distinction matters. By default, all core data — uploaded documents, the database, the pgvector store and the Azure Service Bus — runs on Microsoft Azure in the Switzerland North region, as does inference on the standard models via Azure AI Foundry and audio and video transcription via Azure Video Indexer. The publisher states that in the standard configuration documents and AI queries do not leave Switzerland, covered by its own DPA. Databases are isolated per tenant, with encryption at rest and AES-GCM-256 field-level encryption on selected sensitive columns. The public marketing website, by contrast, is hosted by Hostinger in Germany, and front-end assets partly transit an Azure West Europe region or CDN which, according to the publisher, carries no customer content. Billing runs through Stripe Payments Europe (Ireland) and observability through Datadog (US and EU), anonymised and without document content. Vector store residency is configurable: pgvector in Azure CH by default, LanceDB locally or in Azure CH, managed Pinecone in the US or EU, self-hosted ChromaDB. Under BYOK, query payloads go straight to the customer's chosen provider, outside Switzerland where that applies.