Up to CHF 7 billion: Switzerland moves to keep sensitive government cloud data at home

Switzerland’s federal government is tightening control over its data, launching a tender for the Swiss Government Cloud on Tuesday, 20 October. Sensitive information will have to remain in Switzerland, with the most sensitive data held in federally owned data centres. Five providers are being sought across three security tiers. Operations are scheduled to begin in autumn 2027, with a maximum financial envelope of CHF 7 billion over 14 years.

The project reshapes how the federal administration decides where its information can be stored. It currently uses cloud services from companies including Amazon, Alibaba and IBM, whose infrastructure is distributed worldwide. Under the new approach, the sensitivity of the data will determine whether it can still be stored abroad or must remain within Switzerland.

Opening the tender does not mean contracts have been awarded. The companies that will deliver the services have yet to be selected. But the direction is clear: tighter geographical and operational boundaries for sensitive information, without abandoning international cloud services for everything else.

Three security tiers, not one cloud for everything

The Swiss Government Cloud is not designed as a single repository with identical rules for every file. Its three-tier structure recognises that publicly available information requires a different level of protection from confidential financial or tax records.

The first tier covers the least sensitive information, such as weather data. This can continue to be stored anywhere in the world. Two providers will be selected for this category, making clear that the government is not planning to bring all federal data back to Switzerland.

The second tier covers more sensitive information and imposes a firm location requirement: the data must stay in Switzerland. The government is seeking two providers for this category as well. Alongside the restriction on storage location, specific requirements concerning data protection and sovereignty will apply.

The third tier has the strictest conditions. Information requiring particularly strong protection, including financial or tax data, must remain in federally owned data centres. This is the project’s most tightly controlled layer, with just one provider envisaged. The distinction is important: a Swiss location alone will not be enough. The information must also be held within the federal government’s own infrastructure.

Foreign providers can still compete

The project reflects the growing importance of data security. With cloud services, the physical location of a server is only part of the picture. The law governing its operator also matters, as do the circumstances in which foreign authorities can demand access to stored information.

American rules on official access to data, in particular, and security concerns surrounding Chinese providers have heightened awareness among Swiss authorities and businesses. Storing information in Switzerland therefore does not automatically resolve every question about who can exercise control over it. The additional requirements for the two higher security tiers are intended to address that distinction.

Nevertheless, the federal government is not imposing a blanket exclusion on companies from the United States or China. The tender must comply with World Trade Organization rules, so access to the procurement process will not be restricted simply on the basis of a company’s country of origin.

Instead, the data protection and sovereignty conditions will narrow the field of eligible providers for tiers two and three. For bidders, the decisive question will be whether they can meet the requirements of the relevant category. This is a cloud designed for Swiss public authorities, but it will not necessarily be delivered exclusively by Swiss companies.

CHF 7 billion is a ceiling, not a committed bill

The scale of the financial framework makes this a substantial, long-term procurement exercise. Up to CHF 7 billion is envisaged over 14 years. That figure is not, however, the same as spending already committed: the government will pay only for services it actually uses.

If less storage capacity is needed, for example, the cost of that service will fall accordingly. The ceiling defines the potential scope of the procurement rather than a bill already due. Final expenditure will depend on actual demand.

That distinction matters when assessing the project. Launching the tender neither releases CHF 7 billion immediately nor fixes every future purchase. At the same time, the 14-year horizon shows that the government is establishing a lasting framework for the administration’s data storage, rather than arranging a short-term service.

Cantons and municipalities can opt in

The new cloud will also be open to Switzerland’s cantons and municipalities, its regional and local levels of government. They will be able to store their data there, but participation will be voluntary. Each will retain the choice of whether to use the service.

For residents, the project concerns a fundamental question about digital public administration: under what conditions is sensitive information handled by authorities kept? The three security tiers are intended to reflect different protection needs. The most sensitive records will have to be held not merely within the country, but in federally owned data centres.

The tender process must now establish which providers can deliver the required services and meet the safeguards. Selecting them remains a crucial step before the planned launch in autumn 2027. The federal government has set out the structure it wants for protecting its cloud data; the companies responsible for putting that structure into practice are still to be chosen.