Cloud & DevOps Company in Zurich

The outsourcing evidence FINMA expects is what shapes a Zurich cloud budget: a scoped Zurich cloud assessment plus FINMA Circular 18/3 outsourcing readiness pack, a production cloud migration for a Julius Baer-pattern private bank, a Vontobel-pattern asset manager, or a Helvetia-pattern insurer, or full multi-region UBS-scale cloud transformation programmes. Scope drivers include FINMA outsourcing documentation, ISAE 3402 Type II controls, exit-strategy artefacts, and tabletop testing. Zurich rates sit at the top of European cloud pricing, equal to London and Geneva, ahead of Frankfurt and Munich. We quote fixed-fee against a documented FINMA Circular 18/3 + 23/1 scope rather than open T & M.

FINMA Circular 2018/3 Outsourcing governs banks, securities firms, and insurers when delegating material functions to third parties, including cloud providers. It requires risk assessment, written outsourcing agreements with specific clauses (audit rights, data access, termination, sub-outsourcing approval), regulatory reporting via the FINMA outsourcing inventory, and a viable exit strategy. Our discovery produces the materiality assessment (critical vs significant vs other), the FINMA outsourcing register entry with full sub-outsourcing chain, and a written cloud agreement annex covering audit-right exercise, FINMA on-site inspection access to provider facilities (typically pre-negotiated via AWS Financial Services Addendum, Azure Financial Services Amendment, GCP Financial Services Contract), and termination assistance. Critical workloads ship with exit-tested-quarterly drills and documented evidence.

FINMA Circular 2023/1 Operational Risks and Resilience entered into force on 1 January 2024, replacing the 2008 Operational Risks circular. It mandates identification of critical functions, mapping of dependencies (people, processes, technology, third parties), setting tolerance for disruption (TfD) per critical function, scenario testing, and continuous improvement. For cloud workloads supporting critical functions (payments, custody, market access, wealth management onboarding), we deliver the dependency map, the TfD documentation, scenario tests (cloud-region failure, ransomware, third-party SaaS outage), and the lessons-learned register. Codazz aligns this with cloud-provider chaos engineering (AWS Fault Injection Service, Azure Chaos Studio, GCP Disaster Recovery) so the evidence is operational, not theatre. The Geschäftsleitung receives a quarterly briefing pack.

Yes. Swisscom Sovereign Cloud (built on VMware Sovereign Cloud principles, with later integrations to alternative stacks) is operated by Swisscom AG entirely on Swiss soil with Swiss-only personnel access — the strongest sovereignty story available short of self-hosted on-premise. For UBS, Julius Baer, Pictet, EFG, and FINMA-supervised entities where §47 Banking Act banking secrecy or contractual concentration risk rules out hyperscaler use, we architect deployments on Swisscom Sovereign Cloud or hybrid (sovereign for the secrecy-protected data, hyperscaler for non-sensitive analytics). For FINMA-mandated maximum-sovereignty workloads we also evaluate IBM Cloud Frankfurt as a non-hyperscaler EU bridge, and Hetzner Helsinki for cost-sensitive non-PII compute. Architecture decision records document the residency rationale per workload.

UBS’s 2023 acquisition of Credit Suisse created the largest private-bank integration in European history, with a multi-year IT and cloud consolidation programme running through 2027. Codazz is not a UBS prime vendor for the integration itself, but we have shipped adjacent work for clients moving off Credit Suisse legacy stacks, third-party vendors whose UBS contracts need re-papering, and FINMA-supervised entities adjusting their concentration-risk assessments now that UBS is the dominant counterparty in Swiss private banking. We track Credit Suisse legacy decommissioning timelines, the UBS Group Architecture standards, and the FINMA expectations on the merged entity. For UBS Wealth Management technology vendors we ship in FINMA Circular 18/3 + 23/1 outsourcing posture from day one.

The revised Federal Act on Data Protection (nFADP) entered into force 1 September 2023 and aligns Swiss data protection broadly with GDPR while retaining Swiss specifics. The FDPIC (Federal Data Protection and Information Commissioner, Bern) is the supervisory authority, with EU adequacy maintained in both directions. Our cloud architectures keep personal data inside Swiss regions by default (AWS eu-central-2, Azure Switzerland North, GCP europe-west6, Swisscom Sovereign Cloud), implement data minimisation and purpose limitation at the data model layer, and ship with an Article 12 nFADP processing inventory and an Article 22 DPIA where high-risk processing triggers apply. Cross-border transfers to EU rely on the adequacy decision; transfers to US use Swiss-US Data Privacy Framework. Penalties under nFADP can reach CHF 250,000 for responsible individuals — Geschäftsleitung personal liability is real.

Zurich private-bank cloud workloads typically require 99.95 percent availability during SIX Swiss Exchange operating hours (09:00 to 17:30 CET trading days) and 99.9 percent overall, with documented RTO of 2 hours and RPO of 15 minutes for critical functions under FINMA Circular 23/1. We deploy active-active across two Swiss-soil regions (AWS eu-central-2 Zurich AZs, or Azure Switzerland North + Switzerland West, or GCP europe-west6 + europe-west12 Turin for EU adequacy DR), with async standby in eu-central-1 Frankfurt for catastrophic events where the cross-border concentration assessment authorises it. On-call follows a Swiss Pikettdienst rotation with 15-minute response during trading hours. Quarterly chaos engineering drills, annual tabletop exercises with Geschäftsleitung participation, and exit-readiness tests are included in retainer scope.

Yes. Zurich and the German-speaking cantons run primarily in German (Schweizerdeutsch verbally, Schriftdeutsch in documents) and English. Geneva, Lausanne, and the Suisse romande lake-area private banks (Pictet, Lombard Odier, Mirabaud, Bonhôte) run primarily in French and English. Our delivery model pairs CET-hours engineers with documentation produced in the appropriate language combination. FINMA submissions are accepted in any of the three official languages (German, French, Italian) plus English. We deliver architecture decision records, FINMA outsourcing packs, ISAE 3402 control plans, and tabletop exercise scripts in German + English by default, French + English on request for Romandie clients, and Italian + English for Ticino-based clients (rare but occurs for Lugano private banks).