Last updated: October 29, 2026
1. Context — the 2023 revised FADP
The revised Swiss Federal Act on Data Protection (FADP, also "nLPD") entered into force on 1 September 2023. It replaces the 1992 FADP and strengthens the rights of data subjects as well as the obligations of controllers and processors. ark.flow has been designed to comply with this legal framework, in parallel with GDPR compliance for European customers.
2. Why ark.flow is "FADP-first"
- Application infrastructure hosted exclusively in Europe: ark.flow Compta in production in the European Union (Vienna) with a hot standby in Switzerland, ark.flow Fiduciaire in production in Switzerland (Geneva), independent backups in Switzerland.
- Per-Instance isolation: each customer has its own application containers and a dedicated database, on a shared server. No customer data is shared between Instances.
- Encryption at rest for credentials, tokens and secrets in AES-256-GCM.
- Documented application location: Compta in the European Union, Fiduciaire in Switzerland, continuity and backups in Switzerland. Payment, CDN/DNS and optional AI-provider flows are documented separately.
- Cookieless analytics (self-hosted Umami), no third-party commercial tracker.
- Identified AI that can be disabled: AI features are described in our legal pages and can be disabled on request. Providers are used under their API terms, which in principle exclude training on the data sent; depending on the provider, processing may take place in the United States.
3. FADP obligations and our response
| FADP article | Obligation | ark.flow response |
|---|---|---|
| Art. 5 | Definitions (data, processing, profiling) | Terminology used consistently across all our legal pages |
| Art. 6 | Principles: lawfulness, good faith, proportionality, purpose, accuracy, limited retention | Purposes and retention periods detailed in the Privacy Policy |
| Art. 8 | Data security | Technical and organisational measures described on the Security page and in the DPA |
| Art. 9 | Processing by a processor | Framework clauses in the Terms; public list of subprocessors |
| Art. 12 | Record of processing activities | Record kept in the cases required by Art. 12 FADP and Art. 24 DPO |
| Art. 16-17 | Cross-border disclosure | Compta production in the EU, Fiduciaire production in Switzerland; continuity and backups in Switzerland; external AI possibly in the United States; other flows documented by subprocessor and purpose |
| Art. 19-21 | Duty to inform, automated decisions | Covered by the Privacy Policy; no automated decisions with legal effect |
| Art. 22 | Data protection impact assessment (DPIA) | The Customer, as controller, assesses whether a DPIA is required; ark.swiss sàrl assists on request (see DPA) |
| Art. 24 | Notification of data security breaches | Report to the FDPIC as soon as possible in case of high risk; notification within 72 hours to the competent authority where the GDPR applies |
| Art. 25 | Right of access | Response within 30 days to privacy@ark.swiss |
| Art. 28 | Right to data portability | JSON/CSV export and native Crésus export (Compta) available |
| Art. 30 | Processing infringing personality rights, right to object | Handled by the privacy contact point |
| Art. 32 | Right to rectification and erasure | Response within 30 days, subject to the 10-year accounting obligations |
| Art. 49 | Complaint to the FDPIC | Contact details provided in the Privacy Policy |
4. Technical and organisational measures (summary)
- In transit: HTTPS through Cloudflare, Cloudflare origin certificate up to our servers, HSTS and a content security policy (CSP).
- At rest: AES-256-GCM for secrets and tokens; encrypted Borg backup archives.
- Access: administration with SSH keys over a private WireGuard network; sensitive actions logged in the application.
- Resilience: daily Borg backups kept for 14 days, 8 weeks and 24 months; integrity check and restore of a test file at every full cycle; hot standby site at Infomaniak for ark.flow Compta.
- Organisation: access to production systems limited to the ark.swiss team.
5. Cross-references
- Privacy Policy — substantive information notices
- Cookie Policy — trackers and local storage
- Terms of Service — contractual framework
- Data Processing Agreement (DPA) — processing on behalf (Art. 28 GDPR / Art. 9 FADP)
6. Data protection contact
In case of discrepancy between language versions, the French version prevails.