Infomaniak
Hosting, PostgreSQL, S3 storage, sovereign LLM — in Switzerland.
Sovereignty
Data, database and files at Infomaniak, in Switzerland. A single AI gateway, sovereign by default: a foreign model is called only on your explicit, revocable consent.
Not a label, a setting. Every organisation picks its sovereignty mode; the backend enforces it. In strict mode, features that require processing outside Switzerland are disabled — and the flows that remain are listed here, not buried in small print.
Public sub-processor register →sovereignty modes
strict · sovereign by default · international
years of audit log
append-only, PostgreSQL trigger
interface languages
FR · DE · IT · EN
Mechanisms
Infomaniak
Hosting, PostgreSQL, S3 storage, sovereign LLM — in Switzerland.
AI gateway
Every LLM call goes through it. Every call is logged.
RLS isolation
PostgreSQL Row-Level Security forced on every tenant-scoped table.
Audit log
Append-only, kept ten years, IP addresses truncated.
03 modes
SWISS_STRICT
Features that require processing outside Switzerland are disabled. Operational data, resources, schedules, rules and the core engine stay processed in the Swiss infrastructure provided for that purpose.
SWISS_PREFERRED
default modeAll core features run on sovereign AI (Infomaniak, Switzerland) or on self-hosted models. Some advanced features can use optional international services: enabling them requires clear information and the organisation’s explicit agreement.
INTERNATIONAL_AI_ENABLED
The organisation has explicitly enabled international providers (for example Anthropic — inference may run outside the EU/CH, covered by standard contractual clauses and the Data Privacy Framework) for advanced features such as photo schedule import. The foundation — hosting, data, core engine — stays in Switzerland.
How it is enforced
For every AI feature, the API resolves an access decision server-side — allowed or denied, with the reason — from the organisation’s sovereignty mode and its recorded consents. As defence in depth, the AI gateway itself refuses any non-sovereign provider when strict mode is active. The interface toggles only reflect those decisions; they cannot bypass them.
Disclosed flows
This table is generated from the sub-processor register versioned in the code (version 2026-09-15) — the same source as the legal pages.
| Sub-processor | Service | Country | Strict mode | Status |
|---|---|---|---|---|
| Infomaniak Network SA | Hosting, PostgreSQL, S3 object storage, backups, sovereign LLM | Switzerland | Active | Mandatory |
| Stripe Payments Europe, Ltd | Billing and payments (cards, TWINT)Billing remains active: this contractual flow is disclosed, it carries no scheduling data and no employee data. | Ireland | Active | Mandatory |
| Infomaniak Mail (SMTP) | Transactional emails (invitations, publications, onboarding) | Switzerland | Active | Mandatory |
| Expo (650 Industries, Inc.) | Mobile push notifications (exp.host)In strict sovereign mode, content is minimised: generic notification with no scheduling data in the body of the message. | United States | Active | Optional |
| Anthropic Ireland Ltd | Claude frontier LLM (vision, document extraction) | Ireland | Cut off | Optional |
| OpenAI Ireland Ltd | Alternative frontier LLM | Ireland | Cut off | Optional |
| Square (Block, Inc.) | Point-of-sale connector (turnover read) | Ireland | Cut off | Optional |
| Plain (plain.com) | Customer support tool (core-api.uk.plain.com)In strict sovereign mode, requests go out by internal email instead of Plain. | United Kingdom | Cut off | Optional |
| Error tracking (Sentry or self-hosted compatible) | Application error reportsTo be enabled in strict mode only with an instance self-hosted in Switzerland (GlitchTip/Bugsink). | United States | Cut off | Optional |
| PostHog (self-hosted) | Product analytics | Switzerland | Active | Optional |
“Mandatory” means the contractual flows required for the service to run (billing, hosting). Optional entries are only active if the corresponding feature is configured and, where applicable, consented to.
Not a generic HR tool repainted red. An instrument built for Switzerland, Germany and Austria: francs, labour law, languages, execution on the ground.
Cantons, Swiss collective agreements, public holidays, four interface languages.
Hosting, database and files at Infomaniak. Sub-processors published, version by version.
Rest, caps, breaks and the active agreement: flagged before publication, never guaranteed on your behalf.
Grid, rule engine, solver, authentication: built in house.
Hosting, AI gateway, isolation and audit log: four verifiable mechanisms, not a slogan.
The full sub-processor register — data categories, transfer mechanisms, location — and the security documentation are public.