Swiss hosting under nFADP for healthcare institutions and vendors

Location (three Swiss DCs), operator Hidora SA with no US parent, DPA, tenant isolation, encryption available, Backup as a Service and Vault in the same jurisdiction, ISO 27001 SQS (attestation on request). Hikube does not certify your DPIA and is not your DPO. Retention, legal bases, processors you add and admin access stay your file. An engineer frames those items; they do not sign the DPIA.

Per project: network (VPC and subnets), storage, identities. Managed databases listen in the VPC. Kubernetes, if you use it: workers spread automatically across Geneva, Gland and Lucerne, you do not choose the DC; topology spread and PDBs for pods stay yours. Vault for application secrets. This is not a flat network shared across customers.

Not if you stay on Hikube Backup as a Service. Copies stay in Geneva, Gland and Lucerne. A US bucket or US KMS for health copies breaks the nFADP file. We do not publish an RPO. The application restore runbook stays yours. Detail: managed backup and backup, vault and compliance.

Rarely the electronic patient record itself, more often what orbits it: a research data warehouse, an image-analysis pipeline, an appointment portal, a vendor application deployed for one institution. The tipping point is almost always the same: from when is the data still health data, and how far does pseudonymisation hold.

• The scope of sensitive data, settled before deployment and not after the first incident: that is your analysis, not ours
• Per-project isolation, so that research and care share neither network nor identities
• Images and large volumes on object storage in the same tenant, S3 object storage
• GPU compute when image analysis is involved, without the datasets leaving Switzerland, the GPU catalog
• The retention period, which comes from your own framework and translates into a backup policy: no default setting implies it

A healthcare file is built by two parties, and the split is decided at the start. Hikube is neither your auditor nor your counsel: the platform supplies documents, the analysis stays with you.

• Requested from Hidora: the DPA, where data and backups live, the isolation description, the ISO 27001 attestation and its scope, the subprocessor list
• Produced by you: the impact assessment, the legal basis for processing, the retention period, the information given to data subjects
• Produced by your software vendor, if the application is theirs: the compliance of their product, which neither you nor the host can attest for them
• Tested together before going live: the restore of a backup, timed, on representative data

Hidora SA operates IaaS, the three DCs, the VPC, block replication (sync or async, not the same RPO), platform backup, vault and FR/EN support. You keep OS or cluster, line-of-business apps, clinician access, DPIA, retention and restore tests. Terraform integration in preparation: today, Hikube API and console.

Swiss healthcare institutions, cantonal networks, vendors that sell into Switzerland and must stay under nFADP. Not French HDS tenders. Not FINMA (see the finance and FINMA path). No published numbered case study.

A Hikube DPA is available on request, via engineer contact. It frames processing by Hidora SA as processor. The DPIA is your document: legal bases, retention, clinician access, processors you add. Hikube provides location, isolation, ISO 27001 SQS (attestation on request) and the DPA. Hikube does not certify the DPIA and is not your DPO. An engineer frames the technical facts; they do not sign the analysis.

Network NVMe, always geo-redundant across Geneva, Gland and Lucerne. Synchronous (real time) or asynchronous (improved performance) replication. Sync and async do not share the same RPO. No unreplicated local volume. We publish neither RPO nor IOPS. Terraform integration in preparation: today, Hikube API and console. Detail: block storage.

Engineer support FR/EN from Geneva. Desk 08:00–18:00 CET; infrastructure monitoring 24×7. A 14-day trial can follow for a technical pilot, not self-serve on health volumes. Published SLA 99.99%; credits and exclusions in the signed contract. Exclusive venue Geneva. Detail: the support scope.