In a board meeting, figures are put on the table before they are published, along with personnel decisions, acquisition plans and ongoing legal cases. The documents behind them are among the most confidential a company has. With every digital tool a board uses, the question therefore arises where this data is kept and who can access it.
Data sovereignty means that an organisation decides, and can trace, where its data is stored and processed, under which law that happens and who has access to it. (This article does not replace legal advice.)
What data is created around a board meeting
It used to be the invitation, the documents and the minutes. With AI tools, quite a lot is added: the recording of the meeting, the full transcript, AI summaries of the documents, members' notes and the questions they ask an AI chat.
The transcript deserves particular attention. Minutes record resolutions and the main arguments. A transcript contains every sentence, including the one that was said openly in the meeting precisely because it was not meant to end up in the minutes. Where this transcript is created and stored is not a technical side issue for a board.
The US CLOUD Act, simply explained
The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US federal law from 2018. It allows US authorities to require providers that are subject to US law to hand over data in their possession, custody or control. Where the data is physically stored does not play a decisive role.
For Swiss companies this means that a data centre in Switzerland does not settle the question on its own. What counts is who operates the service and whether that company or its parent company is subject to US law. According to a widely held view, this also applies to Swiss subsidiaries of US groups.
There is also a common misunderstanding. For transfers of personal data to certified US companies, the Swiss Federal Council recognised an adequate level of protection in 2024 (Swiss-U.S. Data Privacy Framework). This governs data protection during the transfer, but it does not change the access rights of US authorities under the CLOUD Act.
How likely such access is in any individual case is hard to say. For the board, it is less about probability than about the duty of care it owes the company (Art. 717 of the Swiss Code of Obligations): it should be able to explain why it entrusts the company's most confidential documents to a particular provider.
What the revised FADP requires of boards and AI
The revised Federal Act on Data Protection (revFADP) has been in force since 1 September 2023. It protects the personal data of natural persons, not trade secrets. It is still relevant for a board, because board documents contain a great deal of personal data, from the assessment of the executive board to salary matters and personnel cases, and because a recording contains the voices of all participants.
In 2023, the Federal Data Protection and Information Commissioner (FDPIC) stated that the current data protection act applies directly to AI-supported data processing. Four provisions are particularly important when boards use AI:
- The company remains responsible when a provider processes data on its behalf, and must ensure that the provider guarantees data security (Art. 9 FADP).
- Data security must be appropriate to the risk (Art. 8 FADP).
- Personal data may only be disclosed abroad under certain conditions (Art. 16 FADP).
- Whoever collects personal data informs the persons concerned (Art. 19 FADP). On a board, this means in practice that everyone knows the meeting is being recorded.
Where AI processing comes in
Storage is one thing. When an AI writes minutes or summarises a document, the content is passed to a language model, and that does not necessarily run in the same place as the storage. With closed models from large providers, the content goes to their infrastructure. Models with open weights, on the other hand, can be run on in-house or Swiss infrastructure. For the question of where data is located, what counts is therefore not only where the files are kept but also where the model does its computing.
What "hosting and AI processing in Switzerland" means in HeyEla
In HeyEla, the platform data is kept in Swiss data centres at Nine Internet Solutions AG. Nine is certified under ISO 27001 and ISO 9001. AI processing runs in Switzerland by default, partly on HeyEla's own GPU infrastructure, partly with specialised partners. Optional models in the EU can be deactivated per customer.
Customer data is not used to train AI models, and this is contractually excluded. Data is stored with AES-256 encryption and transmitted with TLS 1.2 or higher. Each organisation is logically separated from the others, with its own database on request. Recordings can be deleted immediately after transcription on request. The list of sub-processors and the data processing agreement are available in the Trust Center.
Need-to-know down to the agenda item
Data sovereignty also has an internal side. Not every member of the executive board should see the documents on the CEO's succession, and a guest who joins for one agenda item needs that item's documents and nothing else.
In HeyEla, access is controlled with access management through roles and groups, down to the individual agenda item. The same applies to folders and documents in the document hub. And the AI respects the same rights: AI search and AI chat only see what the person in question is allowed to see anyway. More on this in our article on access rights in the board.
The following short film shows what groups, permissions and a guest for a single agenda item look like in HeyEla.
Questions to ask a provider
Regardless of the tool, these questions help when choosing. How generic note-taking tools differ from what a board needs on these points is described in a separate article.
- With which company is the data kept, and is that company or its parent subject to US law?
- Where does AI processing take place, and can processing outside Switzerland be switched off?
- Is it excluded that content is used to train models, and where is that written down?
- Is there a current list of sub-processors and a data processing agreement?
- Can recordings be deleted after transcription?
- Do the access rights also apply to AI answers?
- How does the data get out at the end of the contract, and in which format?
Frequently asked questions
Does the US CLOUD Act also apply to servers in Switzerland? Yes, if the provider is subject to US law. The CLOUD Act is tied to control over the data, not to the location of the servers. What matters is therefore who operates the service.
May a board use AI for its minutes? Yes. No law prohibits it. The data protection act also applies to AI-supported processing, participants should know that a recording is being made, and responsibility for the minutes remains with the board: the chair and the minute-taker review and sign them under Art. 713 para. 3 CO.
What difference does a Swiss data centre make if the provider is a US company? It improves the starting position in terms of data protection, but it does not remove the possibility of access under the CLOUD Act. Anyone who wants to rule out this risk needs a provider that is not subject to US law.