Your ISMS belongs in European hands.
Varmo stores your ISMS data in a data centre in Switzerland, backups included – with a Swiss provider without a US parent company. We run the database, sign-in and malware scanning ourselves. So you always know where your most sensitive information is held and who can access it.
An ISMS is a map of your weak points.
Hardly any other system records so precisely where an organisation is vulnerable. That is exactly why it should be clear who can access this data.
Risks and vulnerabilities
Which systems are critical, which gaps are still open and which risks you knowingly accept.
Security incidents
What happened, which data was affected and how you responded – often before it becomes public.
Suppliers and dependencies
Which service providers you rely on and how your systems are connected.
Evidence and policies
Internal rules, audit reports and documents that are not meant for outside eyes.
What the US CLOUD Act means.
The CLOUD Act is a US law from 2018. It requires providers subject to US law to disclose data in their possession, custody or control when ordered to by US authorities – regardless of whether that data is stored in the US or in another country (18 U.S.C. § 2713).
A data centre in Frankfurt or Zurich therefore does not answer the question on its own. What also matters is who controls the provider. If it belongs to a group headquartered in the US, such an order can also cover data in Europe – and may then conflict with the Swiss Federal Act on Data Protection (FADP) or the GDPR.
For an ISMS this is more than a legal technicality: public authorities, banks, hospitals and many SMEs have to set out in their supplier assessment who could gain access to their data.
Source: 18 U.S.C. § 2713 (Cornell Law School). Not legal advice.
How Varmo keeps your data in Switzerland.
Not promises, but an architecture you can verify.
- Data centre in SwitzerlandContent, accounts, uploaded files, logs and backups are held exclusively in a data centre in Switzerland.
- Provider without a US parent companyOur hosting provider is a Swiss company whose voting majority is held by a foundation; there is no parent company in the US.
- Run by usThe database, sign-in, malware scanning and error tracking run on our own servers – without cloud services from US providers.
- No trackers, no AI servicesNo web analytics, no fonts or scripts from third-party servers. Varmo does not pass your content to any AI service.
- We see nothing without your approval eitherFor support, you grant access yourself: for no more than 24 hours, read-only, with every access logged.
- No lock-inExport all of your organisation’s data as a ZIP file at any time. Varmo is built on proven open-source technology; we can change hosting provider without changing the software.
What you gain.
Data sovereignty is not an end in itself. It saves you effort and makes your answers to auditors, customers and supervisors simpler.
- Faster supplier assessmentISO/IEC 27001 (A.5.19–A.5.23), NIS2 and DORA require you to assess your service providers. Location, ownership and every service involved are on a single page with us – instead of in long questionnaires.
- Simpler data protection for organisations in SwitzerlandYour ISMS data is stored and processed in Switzerland. This simplifies your record of processing activities and your assessment of disclosures abroad (Art. 16 FADP).
- Straightforward for organisations in the EUThe European Commission recognises Switzerland’s level of data protection as adequate (Art. 45 GDPR). You therefore do not need standard contractual clauses to transfer your data to Switzerland.
- A good fit for the public sector and regulated industriesWhere rules require or recommend keeping data in Switzerland, the location makes it easier to demonstrate – especially together with the frameworks ICT baseline protection (Switzerland), FINMA Circular 2023/1 and data security under the FADP.
- Trust with your own customersWhen your customers ask where you keep your security information, you have a clear answer you can back up.
Every service involved.
Which services are used for what, where they are based and which data they receive – for your supplier assessment.
Data centre and backups
mandatory- Purpose
- Operation of Varmo and storage of all data, including daily backups
- Provider and location
- Swiss hosting provider without a US parent company, data centre in Switzerland
- Data
- All of your organisation’s content, accounts, uploaded files, logs and backups
Self-operated services
mandatory- Purpose
- Database, sign-in, malware scanning, error tracking and web application firewall
- Provider and location
- On our own servers in the same data centre (in Switzerland)
- Data
- As above; not passed on to third parties
Email delivery
mandatory- Purpose
- System emails such as invitations, password links and invoices
- Provider and location
- Swiss provider, sent from Switzerland
- Data
- Names, email addresses and the content of system emails
Payment service
card payments only- Purpose
- Card payment for a plan
- Provider and location
- Stripe Payments Europe Ltd., Ireland, part of a US group
- Data
- Company name, billing address and billing email, plan and amount; you enter card details directly with Stripe. No ISMS content
Integrations you switch on
optional, from Pro- Purpose
- Microsoft Entra ID (single sign-on), Teams, Intune, JIRA, ServiceNow
- Provider and location
- With the respective provider, often based in the US
- Data
- Intune, JIRA and ServiceNow only deliver data to Varmo (read-only). Teams receives notifications without titles or content, only an ID and a link
Calendar subscription you switch on
optional, all plans- Purpose
- Your deadlines from “My tasks” in Outlook, Google Calendar or Apple Calendar
- Provider and location
- With your calendar service, often based in the US
- Data
- Deadlines with ID and link, titles only if you choose
For the domain, certificates, malware signatures and software updates, we also use services and software from providers outside Switzerland, some of them in the US. None of your organisation’s content goes to these providers. System emails are delivered to the recipients’ own email providers.
Also possible in your own infrastructure: Varmo runs entirely in containers. For the Ultimate plan, we agree the prerequisites, operation and updates with you. Custom solutions
What we deliberately do not promise.
No provider can seriously make absolute claims such as “protected from any access”. That is why we are open about where the limits are:
- Swiss and European providers also have to comply with orders from authorities, for example through mutual legal assistance. Nobody can assure protection from every form of access by authorities.
- If you pay by credit card, our payment provider Stripe (Stripe Payments Europe Ltd., Ireland, part of a US group) receives your billing details, never your ISMS content. If you buy on invoice, no data goes to Stripe.
- Integrations you switch on yourself (e.g. Microsoft Entra ID, Teams, Intune, JIRA, ServiceNow, calendar subscription) connect Varmo with the respective provider; that provider’s terms apply.
- For the domain, certificates, malware signatures and software updates, we also use services from providers outside Switzerland, some of them from the US – without any content of your organisation.
Frequently asked questions.
- Does Varmo protect my data from access under the CLOUD Act?
- No provider can seriously make such a promise, because the reach of foreign laws is a legal question. What we can show: your ISMS data is held in Switzerland, our hosting provider has no US parent company, and we run the database, sign-in and malware scanning ourselves – without cloud services from US providers.
- Are the backups also kept in Switzerland?
- Yes. Backups of the database and files are also held in Switzerland; retention 7 days (daily backup on the server and a daily copy of the data storage at the hosting provider, both in Switzerland).
- Does this also apply to organisations in the EU?
- Yes. Switzerland has an adequacy decision from the European Commission. Data from the EU may therefore be transferred to Switzerland without additional safeguards such as standard contractual clauses.
- Who at Varmo can access our data?
- Only the people in your organisation, according to their permissions. As the operator, we only see content if you grant support access – limited to no more than 24 hours, read-only and logged.
- Can we run Varmo in our own infrastructure?
- Varmo runs entirely in containers. For the Ultimate plan, we work out the requirements, operation and updates with you.
Your ISMS. Your data. In Switzerland.
Try it free for 30 days with every feature, or let us show you the solution in a demo.