The evidence a FINMA outsourcing file asks for

The operator is Hidora SA, a Swiss company, with no US parent. That is not the AWS, Azure or GCP situation. Switzerland North or a Zurich AZ does not change those groups’ nationality. We do not conclude that no authority could ever obtain data: Swiss mutual-legal-assistance law and transfers you control still exist. Your counsel remains the decision-maker. Guide: the CLOUD Act guide.

ISO 27001 (SQS) supports the operator ISMS: access, ops, risk. It is not a substitute for your DPIA or outsourcing memo. DORA, for in-scope entities, expects ICT, subcontracting and restore tests: Hikube provides the Swiss copy and can assist; evidence stays your runbook. SLA credits are in the contract, not on this page.

Rarely the core banking system itself, which moves little. More often what surrounds it and keeps growing: a regulatory reporting datamart, a payments back office, an adviser portal, a scoring platform. What they share is a relational database that must not leave Switzerland, and dependencies that have to follow it: that is where files break, not on compute.

• The database: managed PostgreSQL or MariaDB, inside the VPC, the five managed database engines
• Backups in the same Swiss tenant, not in a bucket elsewhere: managed backup
• Application secrets in Vault, not in a US KMS: a Swiss database with a US KMS leaves a hole in the file, the secrets vault
• The link to what exists: VPN or site-to-site from your premises or datacenter, the VPC private network
• The restore test, which is your deliverable and not ours: that is what an auditor asks for, not the backup policy

A qualification is prepared with documents, not with web pages. Here is what to ask for, and who produces it.

• Provided by Hidora on request: the DPA, the ISO 27001 attestation with its scope, the subprocessor list, the description of per-project isolation
• Publicly verifiable: the operator on the commercial register, the sites and their building certifications the three datacenters, platform state on status.hikube.cloud
• Produced by you, and by nobody else: the outsourcing memo, the impact assessment, the processing register, the exit plan and its test
• To settle with your counsel: the audit right, incident notification deadlines, onward subcontracting. These are clauses, negotiated in the contract and not on a product page

Hidora SA operates IaaS, the three DCs, the VPC, block replication (sync or async, not the same RPO), Backup as a Service, Vault as a Service and FR/EN engineer support (desk 08:00–18:00 CET; infrastructure monitoring 24×7). You keep schemas, ACLs, apps, GitOps, restore tests and the regulatory file. Terraform and Cluster API integration in preparation: today, Hikube API and console.

Application and data cores you do not want on a US group. Managed databases (PostgreSQL, MariaDB, Redis, MongoDB, ClickHouse; not FerretDB, no separate MySQL SKU) in the VPC. Backup and vault aligned on the same jurisdiction. Managed Kubernetes if workloads are already containerised (workers spread automatically, no customer DC choice). This is not HDS, not a French healthcare cloud, not a substitute for your counsel.

Published SLA objective 99.99% per service. Scope, measurement and exclusions: the SLA scope. Detail and any credits are in the signed contract. Public status: status.hikube.cloud. Exclusive venue Geneva, Swiss law, subject to the Federal Supreme Court.

Engineer support in French and English, from Geneva. Desk 08:00–18:00 CET; infrastructure monitoring 24×7. The right CTA is talk to an engineer. A 14-day trial can follow for a technical pilot. No instant self-serve. Detail: the support scope.