Swiss Fiduciary Websites: Client Portals and Professional Duties

For a Swiss Treuhand firm, the public website has two jobs that pull in different directions. It must win new mandates from small businesses and private clients, which calls for an open, friendly presentation of services, people and prices. At the same time it is often the entry point to a client portal where the most confidential documents a small business has are exchanged: payroll data, bank statements, tax returns, annual accounts and correspondence with the tax authorities.

That second job is where the unique risks lie. Email attachments, consumer file-sharing links and unencrypted upload forms are still common in the sector, and each one is a potential data breach. This article explains how to design secure document exchange, how to decide where client data is stored, and which Swiss rules shape what the website says and does: the Federal Act on Data Protection (FADP), the criminal provision on professional confidentiality, and the anti-money laundering rules that changed on 1 October 2026.

The revised Federal Act on Data Protection came into force on 1 September 2023. Several of its articles apply directly to the way a fiduciary runs its website and portal:

The Federal Data Protection and Information Commissioner (FDPIC) is the supervisory authority for private companies. Its website describes its role as protecting everyone's right to privacy by ensuring that federal bodies and private companies do not process personal data unlawfully.

Fiduciaries handle exactly the kind of information the FADP calls secret. Article 62 FADP makes it a criminal offence, on complaint, for anyone who learns secret personal data while practising their profession, for the purpose of that profession, to disclose it wilfully. The fine can reach 250,000 francs. The same penalty applies to people who work for or train with someone subject to a duty of confidentiality, and the duty continues after they leave the profession or finish their training.

Article 61 adds fines of up to 250,000 francs, on complaint, for private persons who wilfully disclose data abroad in breach of the transfer rules, assign processing to a processor without meeting the conditions of Article 9, or fail to comply with the minimum data security requirements set by the Federal Council.

For website and portal design, this means confidentiality cannot be an afterthought. Every place where a client document might travel needs a deliberate decision:

• Uploads go into an encrypted portal, never into a contact form that forwards attachments by email.
• Downloads are available only after login, never through public links that anyone with the URL can open.
• Notifications by email say that a new document is available, without attaching it or naming its contents in the subject line.
• Staff access follows the mandate: an employee sees the clients they work for, not the whole firm's archive.
• Former staff lose access on their last day, and their accounts are reviewed rather than simply disabled.

A good portal makes the secure way the easy way. If uploading a payslip takes longer than emailing it, clients will email it. The design priorities are:

1. Simple login with a second factor. An authenticator app or a one-time code by SMS protects accounts without frustrating clients. Offer a clear recovery process that does not rely on email alone.
2. Folders that mirror the mandate. Accounting, payroll, VAT, tax return and correspondence, each with a year, so clients know where to put things.
3. Requests with deadlines. The fiduciary can request specific documents ("bank statements December") with a due date, and the client sees an open-items list.
4. Mobile upload. Clients photograph receipts on their phone; the portal should accept these directly and convert them into usable files.
5. Audit trail. Who uploaded, viewed or downloaded which document and when, visible to the firm and, where appropriate, to the client.
6. Retention and deletion. Documents are archived and deleted according to rules you define and document, not kept forever by default.

Many fiduciaries use the portal module of their accounting software. That is often the right choice, as long as you check the hosting location, the processor agreement and the security features against the points above. Where no suitable module exists, our web application development team builds portals that connect to the systems you already use.

"Hosted in Switzerland" is a popular promise on fiduciary websites, and for good reason: clients like it, and it simplifies the cross-border rules. But the FADP does not require Swiss hosting as such. Under Article 16 FADP, personal data may be disclosed abroad if the Federal Council has decided that the destination guarantees an adequate level of protection, or, failing that, if adequate protection is ensured by other means listed in the article, such as data protection clauses notified to the FDPIC in advance or standard clauses the FDPIC has approved, issued or recognised.

The real questions for a fiduciary are therefore practical:

• Where are the portal, the backups and the support staff of the provider located?
• Does the provider rely on subcontractors abroad, for example for email delivery or monitoring?
• Can the provider guarantee data security in the sense of Article 9, and will it notify you of breaches as quickly as possible?
• Does any contractual duty of confidentiality you have agreed with clients prohibit the assignment?

If you do choose Swiss hosting, say exactly what is hosted in Switzerland. "The portal and its backups are hosted in data centres in Switzerland" is a precise statement. "All data stays in Switzerland" is a promise that breaks the moment someone sends you an email through an international provider. Under Article 19, if data is disclosed abroad, the privacy notice must name the state or international body concerned.

Fiduciary websites often describe a broad range of services, from bookkeeping to company formation and advice on structures. Since autumn 2026, the wording of those service pages has a new relevance. TREUHAND|SUISSE reports that the revised Anti-Money Laundering Act and its ordinance came into force on 1 October 2026. According to the association, the revision extends the range of activities covered, so that certain advisory services of fiduciaries can trigger obligations even without access to client funds.

The association states that advisers without existing AMLA supervision who were already providing advisory services newly subject to the Act on 1 October 2026 must submit an application to a self-regulatory organisation (SRO) by 1 December 2026 at the latest, and that the due diligence obligations have applied since 1 October 2026. Depending on the activity, accepting mandates from new clients may require prior SRO affiliation. Financial intermediaries already affiliated with the association's SRO must notify it of newly covered advisory activity by the same date.

For the website this means:

• review service pages so they describe what you actually do and are cleared to do;
• make sure onboarding forms collect what your due diligence process requires, and nothing that it does not;
• explain to prospective clients that identification steps are a legal requirement, not bureaucracy for its own sake;
• keep identification documents inside the secure portal, never in email.

Whether a particular mandate falls under the Act is a legal question for your SRO and advisers. The website should simply avoid promising services that your setup does not yet cover.

Clients choose a fiduciary on trust, and the website should show the facts that support it. TREUHAND|SUISSE says on its homepage that membership is regarded in the market as a seal of quality standing for professional competence, quality and trustworthiness. If you are a member, say so and link to the association's member directory. If you hold federal diplomas, list them with the exact title.

For audit work, be precise. The Federal Audit Oversight Authority states on its website that individuals and firms providing statutory audit services require a licence from it. A fiduciary that performs statutory audits should name its licence status accurately; one that does not should avoid wording that suggests it does.

Security can also be a trust signal, if it is specific. The association offers its members a cybersecurity section with first aid after a hacker attack, guides and checklists, and templates for implementing the new Data Protection Act. Telling clients which concrete measures you apply, such as two-factor login, encrypted storage and staff training, is more convincing than a generic padlock icon.

Beyond security, a fiduciary website competes on clarity. Small business owners want to know what you do, for whom, and roughly what it costs. Effective pages include:

• Service pages by client type: sole traders, GmbH and AG, associations, private individuals with tax returns.
• Service pages by task: bookkeeping, payroll, VAT, annual accounts, tax returns, company formation.
• A transparent onboarding page: what happens after the first meeting, which documents are needed, how the portal works.
• A deadlines page: key dates in the tax year for your canton, updated each year.
• Team pages: qualifications and languages, because many clients choose a fiduciary who speaks their language.

Switzerland's languages matter here too. A firm serving clients in German and French, or German and Italian, should offer at least the key pages and the portal interface in each. Our multilingual website development team builds sites where the language versions stay in step.

1. No document uploads through public contact forms or email.
2. Client portal with two-factor login, per-client access rights and an audit trail.
3. Processor agreements and security checks for every provider that handles client files.
4. Hosting locations, including backups and subcontractors, documented and named in the privacy notice.
5. Breach process agreed with providers, including fast notification.
6. Service pages reviewed against the AMLA changes in force since 1 October 2026.
7. Onboarding forms aligned with your due diligence process.
8. Memberships, diplomas and licences stated precisely.
9. Specific security measures described instead of generic claims.
10. Key pages and portal available in every language your mandates require.

Our privacy-first website projects apply the same principles under Swiss law. To plan a website and portal for your firm, request a quote.

• Federal Act on Data Protection (FADP), SR 235.1, English version
• FDPIC homepage
• TREUHAND|SUISSE: new AMLA obligations from 1 October 2026
• TREUHAND|SUISSE: AMLA revision and fiduciary mandates
• TREUHAND|SUISSE homepage
• Federal Audit Oversight Authority homepage
• TREUHAND|SUISSE: cybersecurity