B2B Software Consulting in Zurich
Switzerland is not the EU: the revised FADP has bound Zurich companies since 1 September 2023 and its fines of up to CHF 250,000 land on individuals rather than the balance sheet. ERPStack delivers custom ERP and CRM work remotely into eu-central-2, the AWS Zurich region every account must opt into.
Quick Answer
In short: Switzerland's revised FADP has bound Zurich since 1 September 2023 and can fine an individual up to CHF 250,000. ERPStack builds custom ERP to it: FINMA Circular 2023/1 resilience controls, Art. 47 banking secrecy scoped through RBAC, Swiss QR-bill and ISO 20022 payments, in AWS eu-central-2 under 5 ms from the metro.
Regional Compliance
- Revised FADP (nDSG), in force 1 September 2023 — FDPIC
- FINMA Circular 2023/1 Operational risks and resilience
- Art. 47 Banking Act — Swiss banking secrecy
- Swiss QR-bill (Implementation Guidelines 2.3) and ISO 20022
- Swissdec Lohnstandard-CH (ELM) 6.0 salary declaration
Security & Compliance Architecture
Zurich compliance is criminal law rather than administrative fines. The revised FADP prosecutes individuals, Article 47 of the Banking Act prosecutes disclosure, and FINMA Circular 2023/1 tells the engineering team where critical data may live — three regimes a Zurich finance, insurance or biotech buyer meets at once.
CHF 250,000 lands on a person, not a company
Articles 60 and 61 of the revised FADP, in force since 1 September 2023, fine wilful breaches up to CHF 250,000, and Article 64 lets the undertaking pay instead only when the fine would stay under CHF 50,000 and identifying the individual would be disproportionate. A Zurich ERP therefore records who approved each cross-border configuration change, not merely that it changed.In Switzerland, test environments are in scope
FINMA Circular 2023/1, in force 1 January 2024, defines critical data at margin no. 7 and, at margin no. 76, extends protection through development, change and migration — test environments explicitly included. ERPStack therefore seeds Zurich staging from synthetic data shaped by Zod schemas, exercised by Vitest and Playwright, and gates production restores behind Role-Based Access Control (RBAC).Two breach clocks, neither of them GDPR’s
Article 24 of the revised FADP tells a Zurich controller to notify the FDPIC as quickly as possible, with no 72-hour figure; FINMA Circular 2023/1 adds a 24-hour preliminary notification and a 72-hour report at margin no. 68. ERPStack models both as separate deadline rows against one incident inside an Immutable Audit Trail, so neither clock is inferred.Swiss VAT and social charges are their own surface
Swiss VAT runs at 8.1 percent standard, 2.6 percent reduced and 3.8 percent for accommodation — none of them EU rates — while AHV, IV and EO take 10.6 percent of salary and BVG begins at CHF 22,680. A Zurich ERP that hard-codes an EU rate fails its first audit, so ERPStack keeps rates as versioned PostgreSQL rows with effective dates.
Engineering Blueprint
Switzerland has its own AWS region, and it is not switched on by default. ERPStack builds the Zurich stack on Next.js, TypeScript and PostgreSQL, deploying it to eu-central-2 (3 availability zones, opt-in) or Microsoft Azure Switzerland North, provisioned with Terraform and Docker, leaving the Geneva region, Switzerland West, as the restricted secondary it is.
QR-bill, not XRechnung
Switzerland skipped the clearance mandate Germany imposed, so a Zurich ERP issues no XRechnung. It issues a QR-bill: the Swiss QR Code that definitively replaced payment slips on 1 October 2022, carrying a QR-IBAN and structured reference under Swiss Implementation Guidelines 2.3, with version 2.4 arriving on the SIC release of 13 November 2026. ERPStack mints the reference in PostgreSQL with Drizzle ORM, validates it with Zod, and reconciles the ISO 20022 camt.054 return.
export const qrBills = pgTable('qr_bills', {
qrIban: varchar('qr_iban').notNull(),
vatRate: numeric('vat_rate').default('8.1'),
});Swiss payroll runs on Swissdec, so the ERP need not
Swissdec’s Lohnstandard-CH (ELM) reached version 6.0 in March 2026 and is certified from April 2026, on a four-year major cycle that keeps two versions live in parallel. ERPStack treats a certified payroll as an upstream system and owns what it does not cover — Certified Timesheet Tracking, Quellensteuer allocation across cantons, and the AHV wage base feeding it — over a REST integration rather than a re-certified fork.
The re-identification key stays in Zurich
Article 47 of the Banking Act reaches auxiliaries and service providers, not only the bank, so ERPStack pseudonymises client identifiers in every Zurich build before a row leaves Switzerland. It keeps the mapping table in eu-central-2 behind AWS Key Management Service and Postgres row-level security under a Zero-Trust Security posture; analytics, Redis caches and Sentry traces see the token, never the client.
Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in Zurich
Real-Time Fraud Detection Platform
Real-time fraud detection and risk scoring platform
Read Case StudyTarget Industries in Zurich
Frequently Asked Questions
Buy the payroll. Swiss salary declaration runs on Swissdec's Lohnstandard-CH (ELM), now version 6.0 published in March 2026 and certified from April 2026, and re-certifying a bespoke engine every four-year cycle rarely pays for a Zurich firm. ERPStack wraps a certified payroll the way it wraps SAP S/4HANA or Odoo, and owns time, projects and billing.
Yes, with conditions. Articles 16 and 17 of the revised FADP permit disclosure abroad where the Federal Council recognises adequate protection, or under contractual clauses, binding corporate rules or FDPIC-approved standard clauses. Many Zurich banks still stay in eu-central-2 or Microsoft Azure Switzerland North, because Article 47 of the Banking Act criminalises disclosure of client data.
Because AWS Europe (Zurich), eu-central-2, is an opt-in region: unlike eu-central-1 in Frankfurt it is disabled by default on every AWS account. It opened in November 2022 as the 28th AWS Region with three availability zones. ERPStack enables it in the account baseline so a Zurich Terraform plan never fails on an unreachable region.
No. Switzerland operates no clearance or B2B e-invoicing mandate, so a Zurich ERP needs neither XRechnung nor ZUGFeRD. What it does need is the QR-bill, which replaced Swiss payment slips on 1 October 2022, and Swiss VAT at 8.1 percent standard, 2.6 percent reduced and 3.8 percent for accommodation — rates ERPStack keeps as PostgreSQL rows.
The revised FADP carries no administrative fines. Articles 60 and 61 punish wilful breaches with a fine up to CHF 250,000, and Article 64 lets the company pay only where the fine would not exceed CHF 50,000 and identifying the individual would be disproportionate. A named person in Zurich carries the risk, so ERPStack records each approver in an Immutable Audit Trail.
Article 24 of the revised FADP requires notification to the FDPIC as quickly as possible where a breach is likely to cause a high risk to the data subject's personality or fundamental rights — there is no fixed 72-hour clock as under GDPR. For a Zurich bank, FINMA Circular 2023/1 adds a 24-hour preliminary notification and a report within 72 hours.
Its critical-data chapter. Margin no. 73 requires critical data to be identified systematically and categorised, margin no. 76 extends protection through development, change and migration including test environments, and margin no. 78 demands a regularly reviewed authorisation system on need-to-know lines. In practice that rules production client data out of any Zurich staging PostgreSQL database.
AHV, IV and EO take 10.6 percent of salary, split 5.3 percent each between employer and employee, while BVG occupational pension starts at CHF 22,680 with a coordination deduction of CHF 26,460 and an upper limit of CHF 90,720. Quellensteuer settles through the Canton of Zurich's eQuest and ELM channels, so ERPStack keeps those as ERP and CRM fields.
Legally yes, practically with care. Article 47 of the Banking Act punishes disclosure of client identifying data with up to three years' imprisonment, or a fine up to CHF 250,000 where negligent, and it reaches auxiliaries and service providers. ERPStack pseudonymises a Zurich bank’s identifiers before any row leaves Switzerland and holds the re-identification key in a PostgreSQL vault in eu-central-2 under AWS Key Management Service.