Security & data
Where Your Documents Live
You are handing a stranger your salary, your assets and your family circumstances. This page says plainly what protects them — and what does not.
Where your data is held
Your account, your messages and the record of every document are stored in Google Cloud’s Zürich region. The documents themselves are held in Google Drive under our Google Workspace account.
Encrypted in transit and at rest
TLS on every connection, AES-256 on stored data. Encryption keys are managed by the cloud provider, not held on our laptops.
Separated per client, on the server
Your file is readable only by you, anyone you have explicitly added, and your advisor. That rule is enforced by the database itself, so it holds even if a page in the interface has a bug.
Every privileged action recorded
Granting access, removing it, and changes to who can see a file are written to an audit trail with who did it and when.
Recoverable, and protected from deletion
The database can be restored to any point in the last seven days, and is configured so that it cannot be deleted outright.
Swiss professional secrecy
As a Swiss tax advisory we are bound by professional confidentiality, alongside the Swiss Data Protection Act and the GDPR where it applies to you.
Plainly
What we do not claim
Tax firms routinely advertise protections they have not implemented. These are the ones we are asked about and do not have.
We cannot promise your documents never leave Switzerland
Your account and records sit in a Swiss data centre. Your documents are in Google Drive, and Google does not let us pin Drive to Switzerland. Any firm telling you otherwise about a Drive-based system is describing something they have not checked.
We are not end-to-end encrypted, and cannot be
End-to-end encryption would mean we could not read your documents. Reading them is the service. Anyone offering both is describing one of the two inaccurately.
Two-factor authentication is not available yet
It is being added for staff accounts first, then offered to clients. Until it ships, we will not list it here.
We hold no security certification
We are a boutique firm and have not been audited against ISO 27001 or SOC 2. The protections above are real; a certificate attesting to them is not something we have.
Questions about your data
You can ask what we hold about you, ask for it to be corrected, or ask for it to be deleted once our retention obligations allow. Write to us and a person will answer.