Confidentiality and information security

We protect client information so that it is accessible only to those who need it, available when needed, unaltered except by authorised change and traceable in its handling.

Access is on a need-to-know basis, per engagement. We hold only the information the work requires and keep it under section 11.

Our measures follow the state of the art and the risk of the information concerned, as Swiss and EU data protection law require. We review them every 12 months and after any incident.

Client information means everything a client gives us or we produce for it that is not public, whatever its form. We treat it as confidential from receipt, without time limit, until the client makes it public or releases us.

We use client information only for the engagement it was given for. We disclose it only to people who need it for that engagement and are bound to confidentiality, and otherwise only with the client’s consent or where the law compels us (9.3). We do not name clients or describe their matters publicly without their consent.

Information from one engagement is not used for another without the client’s consent. Where two engagements conflict, our code of conduct applies: we disclose and, if the conflict cannot be managed, we decline.

Personal data within client information is handled under our privacy notice and, where we act as processor, under the client’s instructions and a data processing agreement.

Every account that holds or can reach client information requires multi-factor authentication. Our standard is phishing-resistant hardware keys; codes sent by SMS are not accepted anywhere.

Passwords are unique and generated, and kept in an encrypted password manager. Credentials are not shared between people or written into documents.

Access is granted per engagement to the people working on it and removed, with local copies deleted, when their part ends. No one receives client information before being bound in writing to confidentiality and to this statement.

Our people are briefed on this statement, on social engineering and on the use of AI tools before their first engagement and annually, and report suspicious messages immediately. Technical controls and prompt reporting carry the main burden; training supports them.

Client information is accessed only from devices under our control. Each is encrypted, locked, updated automatically, protected by endpoint security and can be wiped remotely. We run no software past the end of its security support. Freelancers work on devices that meet this section or on accounts we provide.

Traffic from our devices is filtered, and client information cannot be moved to services we have not approved.

We do not use public or shared computers for client work, do not store client information on removable media and do not work on client material where screens can be overlooked. Devices crossing borders carry only what the trip requires.

Client information is encrypted in transit and at rest to current standards (TLS 1.3 and AES-256-class encryption). Email is the ordinary channel, as our general terms and conditions provide; material a client or we classify as sensitive moves on end-to-end encrypted channels agreed at the outset, and we do not change channel on a request received by message.

Cryptography follows the NIST post-quantum standards of 2024 as our providers implement them; provider progress is part of the annual review in 6.3.

Printed material is kept to the minimum, stored locked and shredded when no longer needed.

We work with a small number of cloud providers on enterprise terms. Each is bound by a data processing agreement and processes data in Switzerland, the EU or, under the Data Privacy Frameworks, standard contractual clauses or the UK addendum, the United States.

We tell a client on request, through its named representatives, where its information is processed and by which providers. We do not move it to another country without telling the client in advance and, where the client’s terms require, obtaining its consent.

We review our providers every 12 months for security posture, terms and incident history, and we keep their number small.

Client information goes only into AI tools on business terms that exclude training on our data and limit retention, under our accounts, never into personal or consumer accounts.

Inside information and material a client designates as restricted are processed only in AI tools that meet 7.1 and retain nothing after the session, by the people on the insider list for the matter, and within any restriction the client’s own rules impose.

AI agents work with credentials scoped to one engagement, revoked at its close, and their actions are logged. We review agent output before it takes effect and before it reaches a client, and we treat instructions contained in documents, web pages or messages that a tool reads as untrusted.

We keep our AI literacy current, as the EU AI Act requires of deployers, and we do not present machine output as verified analysis.

We are not a financial institution and are not supervised by FINMA. Our capital-markets work regularly brings us inside information, and we handle it under the EU Market Abuse Regulation, the Swiss Financial Market Infrastructure Act and the client’s own rules.

Inside information is kept in a separate, access-restricted workspace, limited to named individuals. For each matter in which we act on an issuer’s behalf we keep our own insider list, acknowledge the client’s insider-list obligations in writing and record who had access and when.

We treat inside information as closed: no disclosure, no hint, no use, except what the engagement itself requires under the client’s procedure and the law. We take part in market soundings, wall-crossings and delayed disclosure only under the client’s procedure, and we do not brief media, analysts or investors on inside information. Personal dealing by our people in a client’s securities is governed by our code of conduct.

Where a client is a regulated financial institution, we accept its supplier policies on information security and compliance as part of the engagement, and we answer its supervisory and audit requirements as set out in section 12.

We treat any confirmed or reasonably suspected loss, theft, unauthorised access or disclosure of client information as an incident, record it, contain it and investigate it.

We notify an affected client in writing, through the contacts and channel agreed at the start of the engagement, without delay and in any event within 24 hours of becoming aware of an incident concerning its information, update it at least every 48 hours until closed and cooperate with its own response. We notify the Federal Data Protection and Information Commissioner and data subjects where the law requires, and do not notify a client’s regulator on the client’s behalf unless the client asks.

We disclose client information to an authority only when legally compelled and, unless the law prohibits it, after informing the client.

After an incident we review this statement and our measures and correct what failed.

Client information is held on cloud platforms with versioned storage. Backups are independent of the credentials used for daily work and are restore-tested every 12 months.

Loss or theft of a device is treated as an incident under section 9: its credentials are revoked and the device is wiped at once. Because every device is encrypted and holds no client information outside protected storage, loss does not by itself expose client information, and we confirm this to the client only once we have verified it. Work continues on a replacement provisioned from our standard configuration.

A sealed emergency-access arrangement lets a nominated person reach client information if the managing director is unavailable.

We keep engagement records, including client information, for 10 years after the end of an engagement, under this statement, as our record of the work and in the service of continuing relationships.

A client may at any time ask for its information to be returned or deleted. We do so within 30 days and confirm it in writing, stating the date by which backup copies are overwritten, except for what we must keep under the law or our general terms and conditions, which stays under this statement until deleted.

We do not rely on certification. We publish our commitments, evidence them on request and allow review of records.

We answer clients’ security questionnaires against this statement, provide the internal control list that supports it under confidentiality, and allow review of relevant records on 10 business days’ notice, extended to devices after an incident affecting the client. We tell a client before reducing a control it relies on.

The managing director is responsible for this statement. It is reviewed every 12 months, after any incident and within 3 months of any change in law that affects it.