Security, compliance and hosting

All data stays in Switzerland: identities, business data, files, backups and AI processing, at Infomaniak and at a second Swiss host.

• Hosting in Switzerland: Infomaniak Public Cloud, in Switzerland; a second independent Swiss host, Exoscale, keeps a copy of the backups. No data leaves Swiss territory, which the European Commission recognises as offering adequate protection: a useful point for French clients
• Each organisation is isolated: it sees only its own data, checked on every request and down to the database
• Controlled access: sign-in with the OpenID Connect standard, company single sign-on possible and enforceable, roles and rights by module
• Continuity of service: servers and database duplicated, a hardware failure does not cut the service; continuous backups, with locked retention that nobody can erase, not even a compromised account; restoration tested every quarter
• AI processed in Switzerland: open models hosted by Infomaniak, used for inference only; no data is used to train a model, nothing is kept from one call to the next; only the necessary text is sent, never an identity document, bank data or raw file
• The AI suggests, a person decides: no assignment or rejection decision is made by a model, there is no fully automated decision about a person
• Data protection (Swiss FADP, GDPR): retention periods, then automatic anonymisation or deletion; deletion or export of a person’s data on request; versioned consent texts, each acceptance dated
• Encryption in transit: HTTPS everywhere, administration over a private network, hashed passwords, protection against bursts of sign-in attempts
• innovhr places nobody: it is software, the temporary staffing licences under the Swiss placement act (LSE) remain those of the agencies that use it