Information Security Commitment

Our Vision

Data Guardians SA supports its clients in information security and data protection. Our ambition is to protect their information with the same level of rigor as the one we help them achieve. This expertise is at the heart of our business: it requires us to apply, every day, the same principles that we recommend to our clients.

This document sets out Data Guardians’ commitments regarding information security. These commitments apply across the entire company, including at our clients’ premises and when working remotely.

Management Commitment

The Management of Data Guardians takes personal responsibility for information security and makes it a strategic priority. It is committed to:

Integrating information security into the company’s strategy and into every major business decision;
Allocating the necessary human, technical and financial resources, proportionate to the risks;
Protecting the confidentiality, integrity and availability of the information entrusted to us, and ensuring the continuity of services provided to our clients;
Regularly overseeing progress towards security objectives and the evolution of risks;
Promoting a security culture shared by all employees;
Complying at all times with the legal, regulatory and contractual obligations applicable to Data Guardians.

Absolute security does not exist. That is why Data Guardians prioritizes its measures according to actual risks and actively prepares for the possibility of an incident, rather than assuming that one will never occur.

Our Principles

Risk-based approach: information is inventoried and classified according to its sensitivity, and measures are proportionate to the risks, which are regularly reassessed.
Security and privacy by design and by default: security and data protection are integrated from the outset of every project or change, and our systems are configured from the start with the most protective settings.
Zero Trust: no user or device is considered trustworthy by default. Every access is authenticated, limited to what is strictly necessary, and restricted to devices managed by Data Guardians.
Data protection: data is encrypted at rest and in transit, and employees are bound by confidentiality commitments that remain in effect after they leave the company.
Supplier management: our suppliers are subject to contractual and security requirements. Data Guardians remains responsible to its clients for the services it entrusts to third parties.
Incident preparedness: Data Guardians operates on the assumption that an incident may occur. It continuously monitors its systems, maintains an incident response procedure and a business continuity plan that is regularly tested. Any vulnerability can be reported to security@dataguardians.ch.
Transparency: in the event of a data breach, Data Guardians informs the authorities and affected individuals in accordance with the Swiss Federal Act on Data Protection (FADP), as well as its clients in accordance with its contractual commitments.
Shared responsibility: security is everyone’s responsibility. Every employee receives security awareness training upon joining the company, complies with the applicable rules and immediately reports any incident.
Continuous improvement: Data Guardians continuously improves its security framework through risk assessments, internal and external audits, penetration testing, management reviews and lessons learned from incidents. This commitment is reviewed at least once a year.

Reference Framework

Data Guardians’ Information Security Management System (ISMS) is based on the ISO/IEC 27000 family of standards, and in particular on the ISO/IEC 27001 standard.

Data Guardians has been ISO/IEC 27001 certified since 2026, for the following scope: cybersecurity, data protection and information security consulting and audit services. This certificate is renewed every three years and is subject to an annual surveillance audit.