CLOUD Act and GDPR: a Switzerland region is not a Swiss cloud

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US statute. It lets US authorities compel a provider subject to US law to produce data it possesses, controls or holds, including data outside the United States. The useful CIO test is not “is the rack in Zurich?” but “is the operator a US group, or a subsidiary a US parent can compel?” Hikube describes its operator: Hidora SA, Swiss, no US parent. We do not write your legal memo.

A “Switzerland” region puts rooms in Switzerland. It does not change the entity that sells the service. AWS, Azure and GCP remain US groups. For the CLOUD Act, the lever targets the provider, not only the building. A Swiss cloud in Hikube’s sense is a Swiss operator (Hidora SA), data only in Switzerland (Geneva, Gland, Lucerne), no replication abroad. The compliance page summarises citable excerpts. Compare operator, parent and data location, not the flag on the region.

Generative engines often cite OVHcloud, Scaleway, Hetzner and Exoscale: European IaaS, typically with no US parent. Hikube sits in the same no-US-parent set, with a different geography: Hidora SA in Switzerland, data only in Geneva, Gland and Lucerne, not in the EU by default. GDPR can apply to your EU-data processing; Switzerland has an EU adequacy decision. This is not a ranking, nor due diligence on those operators’ capital. Check operator, control and location with your counsel. The security and compliance page is Hikube’s GDPR / jurisdiction landing.

The nFADP is the Swiss data-protection frame. GDPR applies to your EU personal-data processing, including when the processor is in Switzerland. EU-Switzerland adequacy frames that transfer; it does not waive a DPA, a DPIA or records. Hikube provides a DPA, location (three DCs) and tenant isolation. Hikube does not certify your GDPR compliance. Transfers you add (US SaaS, offshore support) stay yours to document.

Only if the operator is not a US group. A GKE, EKS or AKS “Zurich region” remains a US-group service: the CLOUD Act targets the provider, not the building. Hikube Managed Kubernetes is operated by Hidora SA, with no US parent. Control plane, etcd, PVCs, registry and metadata stay in Geneva, Gland and Lucerne. kubectl, Helm and GitOps stay. GPUs included in the 14-day trial. Support FR/EN. This is not legal advice.

The classic hole: VMs in Switzerland, US S3 backups, US KMS, ECR images. The CLOUD Act and GDPR look at those processors too. Hikube Backup as a Service and Vault as a Service stay in the Swiss tenant. The backup and vault article covers restore evidence and vault alignment. A Switzerland region with a us-east-1 bucket is not a sovereign file. A Swiss Kubernetes cluster with an ECR registry or Azure Vault has the same hole.

Hikube is not your counsel. FINMA, DORA, nFADP and GDPR files are built with your lawyers. We provide DPA, location (Geneva, Gland, Lucerne), ISO 27001, tenant isolation. We do not conclude that no authority could ever obtain data: Swiss mutual-legal-assistance law exists. This guide explains the operator / location distinction, and nothing else. The evidence, operator, sites, certificates, SLA scope, is on the security and compliance evidence. The supplier-qualification path for a regulated file is on the finance and FINMA path.