The revFADP demands data protection from the planning stage, information about data flows, an impact assessment where risk is high, and access on request. An ACO system meets that structurally only if the agent has read-only access, logs every action, and the critical commerce data stays under Swiss law. Anyone vetting a vendor therefore asks first about jurisdiction, audit log and exit, not about the server location.
Four duties and what ACO delivers for them.
The basis is the Federal Act on Data Protection, SR 235.1, in force since 1 September 2023. The supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC). The articles are paraphrased.
The revFADP does not prescribe a technology. It demands evidence. The four articles on the left are the points where an ACO agent becomes visible in operation: read-only access and audit log for article 7, transparency about data flows for article 19, the two-zone architecture as a building block of the impact assessment for article 22, the export of the logs for article 25.
The graphic is not legal advice. It shows which documents an operator can request from a vendor before an agent gets access to the order flow.
Read-only access to code and API, an audit log per action, actions only within the policy set by the operator.
Transparency about data flows and zones: which data category is processed where, which law applies there, which contractual basis exists.
Two-zone architecture as a documented assessment building block: separation by data category and jurisdiction, zero retention, no training on operator data.
Export of the records: an audit log with timestamp, data category, purpose and action, available for access requests and supervision.
If the shop ships to the EU or addresses people there, the GDPR applies as well. For the use of an ACO vendor that means two things in practice: a data processing agreement under Art. 28 GDPR and, where risk is high, a data protection impact assessment under Art. 35 GDPR. Both largely overlap with Art. 22 revFADP, so one assessment can serve both legal orders.
The EU AI Act, Article 14 requires effective human oversight of AI systems, not an approval for every decision. A policy framework set by the operator, an audit log per action and the ability to abort at any time satisfy that oversight.
Two zones from a Swiss point of view.
This is how the reference implementation XEREBRO separates the data. What matters is not where a server stands, but which law binds the company that processes the data.
EU-certified cloud provider, Frankfurt region.
- Data processing agreement and standard contractual clauses (DPA and SCCs)
- Zero retention: prompts and data are processed, not stored
- No training on operator data, fixed by contract
- ISO 27001:2022, ISO 27017, ISO 27018, ISO 27701, SOC 1/2/3 Type II, C5 BSI, PCI DSS Level 1
Every number can be checked on the providers' trust portals. Full certificate list of the reference implementation.
The US CLOUD Act of 2018 obliges providers under US law to hand over data on order, even when that data is stored outside the United States. A server in Frankfurt therefore does not protect Swiss commerce data if the contracting party is a US group. A provider with seat and ownership in Switzerland does not fall under this act, which is why the critical zone sits there.
For the shop itself three criteria count: which law binds the provider, which certificates can be checked on a trust portal, and who the contracting party for the data processing agreement is. Infomaniak and Hostpoint are Swiss providers under Swiss law; hyperscalers offer the broader certificate chain and regions in the EU but remain bound to their home jurisdiction. Which combination fits depends on the data categories in the shop, not on the brand name.
Five questions for any vendor.
Who may set and change policies?
Roles, approval levels and a record of every change to a policy.