Data hosting
Data hosting: where your data goes, who accesses it
In Switzerland, with AWS, under contract.
This page describes the infrastructure actually used and the rules that apply to your data: location, sub-processors, access, backup, retention, return. Each point refers to the document that binds it.
15-day free trial · 2 licences included · No payment method required
In brief
- Hosting provider
- Amazon Web Services EMEA SARL
- Location
- Switzerland, eu-central-2 region (Zurich)
- Sub-processors
- AWS and HERE, listed in the DPA; full list on request
- Your data
- It remains your property; returned on request at the end of the contract
- Framework
- Terms of Use, DPA, privacy policy
Infrastructure actually used
Who hosts and who processes what
The providers and the processing presented here are those that the contractual documents describe and commit to.
| What | Who and where | Source |
|---|---|---|
| Platform hosting | Amazon Web Services EMEA SARL; data centres in Switzerland, eu-central-2 region “Switzerland (Zurich)”. | DPA, annex 3 |
| Mapping and truck routes | HERE Europe B.V. (Netherlands): mapping, route calculation and navigation APIs integrated into the Nereva Transports app; data transmitted: GPS positions and routing requests of active missions; processing in the European Union, governed by a DPA with HERE. | DPA, annex 3 · Terms of Use, art. 14 bis |
| Other technical providers | Authentication, monitoring, payment, transactional messaging: full, up-to-date list on request at privacy@nereva.com; any change is notified with at least 30 days’ notice and opens a right to object. | DPA, art. 10 · Terms of Use, art. 36 |
| Physical security | Physical security measures implemented by AWS in its data centres in Switzerland, certified ISO 27001 and to equivalent standards (certification of the hosting provider). | DPA, annex 2 |
Location
Hosted in Switzerland. Some data passes through sub-processors.
The platform’s data, personal data included, is hosted in Switzerland. During missions, truck route calculation goes through HERE, in the European Union, and other technical providers listed in the DPA may be involved.
Hosting
AWS infrastructure in Switzerland (Zurich). Personal data is hosted exclusively in Switzerland as at the date of the DPA.
Processing by sub-processors
HERE, in the European Union, for mapping and routing of active missions; other providers listed on request.
Transfers
Any transfer outside Switzerland or the EEA is governed by safeguards: the Client’s authorisation or appropriate safeguards (standard contractual clauses, assessment of the destination country).
Access and responsibilities
Who is responsible for what
For data processed as part of the service, your company is the controller and Nereva acts as processor, on your documented instructions. For the website and non-client areas, Nereva is the controller.
Nereva’s access
Nereva’s authorised staff access data strictly to the extent necessary for the operation and support of the service; least-privilege access, logging of sensitive actions.
Users’ access
Each user accesses their company’s information, according to their account, role and permissions. Principals designated by a carrier see what the carrier shares.
Roles and profilesSub-processors
Each sub-processor is bound by obligations equivalent to those of the DPA; Nereva remains responsible for their performance towards the Client.
Audit
The Client, or an appointed independent auditor, may audit the processing once per calendar year, with 30 days’ notice; the general elements of the continuity and recovery plans are provided on reasoned request.
Backup and continuity
What the contract provides
The commitments below are best-efforts obligations, described in the DPA, the Terms of Use and the SLA.
| Point | What the contract says | Source |
|---|---|---|
| Encryption | In transit (TLS 1.2 or higher) and at rest, databases and backups included. | DPA, annex 2 |
| Backups | Regular data backup and documentation of the recovery procedures. | DPA, art. 9 · Terms of Use, art. 20.2 |
| Continuity and recovery | Documented business continuity and disaster recovery plans, reviewed periodically; indicative target objectives: recovery point 24 hours, recovery time 48 hours. | SLA, art. 14 |
| Maintenance | Scheduled maintenance outside business hours, preferably between 22:00 and 06:00 (CET), announced with notice; emergency maintenance possible to preserve data security. | SLA, art. 7 · Terms of Use, art. 18 |
| Data breach | Notification to the Client as soon as possible and no later than 72 hours after becoming aware of it, with the nature, the likely consequences and the measures taken. | DPA, art. 13 |
Ownership and return
Your data remains yours; here is exactly what that covers
The Terms of Use distinguish Client Data, which remains its exclusive property, from Derived Data, irreversibly anonymised, which belongs to Nereva.
Your data
- Exclusive property of the Client: entries, notes, photos, comments (Terms of Use, art. 10.2)
- Licence of use by Nereva limited to providing, securing and improving the service, revocable on termination
- Statements and reports downloadable in PDF or XLSX; statistics exportable to Excel
- At the end of the contract: return on written request within 90 days, in a structured, machine-readable format
- Then deletion or irreversible anonymisation, certified in writing
What Nereva keeps
- Derived data, irreversibly anonymised and aggregated: statistics, service improvement, model training
- The models trained from this anonymised data
- Never your identifying data for these purposes: anonymisation is irreversible and traced
- Data subject to a legal retention obligation, for the period provided
Sources: Terms of Use, art. 10 and 30; DPA, art. 14; AI and data policy, art. 6 to 10. A reversibility service beyond the standard scope may be charged.
Retention periods
Kept for the period provided, no longer
The periods below are those of the privacy policy (art. 11). Beyond them, data is deleted or irreversibly anonymised, subject to legal obligations and ongoing proceedings.
| Data | Period | Source |
|---|---|---|
| Client and user accounts | Duration of the contractual relationship, extended by the statutory limitation periods, unless otherwise instructed by the Client. | Privacy policy, art. 11 |
| Invoicing and accounting | 10 years from the end of the financial year (art. 958f CO). | Privacy policy, art. 11 |
| Geolocation (Nereva Transports app) | 12 months from recording, extendable in the event of a dispute; visibility of the route history by a principal limited to 30 days by default. | Privacy policy, art. 11 · Terms of Use, art. 14 bis |
| Technical and security logs | 6 to 12 months, except in the event of a security incident. | Privacy policy, art. 11 |
| Prospect data | 3 years from the last contact. | Privacy policy, art. 11 |
| Anonymised training data | 36 months at most, unless documented necessity. | AI and data policy, art. 19 |
Legal documents
The texts that bind Nereva
- Data processing agreement (DPA)Security measures, authorised sub-processors, transfers, end of contract, audit
- Privacy policyData collected, purposes, retention periods, rights of individuals
- Terms of UseData ownership (art. 10), security (art. 20), reversibility (art. 30)
- Service level agreementAvailability, maintenance, continuity and recovery
- AI and data policyData lake zones, anonymisation, training purposes
- SecurityAccess, traceability, service security, availability
Your questions
Hosting, plainly
Where is the data hosted?
In Switzerland, on the Amazon Web Services infrastructure, eu-central-2 region (Zurich). As at the date of the DPA, personal data is hosted exclusively in Switzerland.
Does all data always stay in Switzerland?
Hosting is in Switzerland, but some processing goes through sub-processors listed in the DPA: mapping and truck route calculation are provided by HERE Europe B.V., in the European Union, for active missions. Any transfer outside Switzerland or the EEA is governed by appropriate safeguards.
Is Nereva compliant with the GDPR and the FADP?
Processing is designed to comply with the GDPR and the FADP: defined roles (the Client as controller, Nereva as processor), DPA, security measures, retention periods, rights of individuals. The legal documents describe precisely what is done.
Can Nereva use or share our data?
Your data is not sold; recipients are limited to authorised staff, sub-processors and the principals you designate. Nereva does however use derived data, irreversibly anonymised and aggregated, for its statistics, service improvement and the training of its models (Terms of Use, art. 10.5).
Can we get our data back?
Statements and reports download in PDF or XLSX, statistics export to Excel. At the end of the contract, data return is requested in writing within 90 days, in a structured, machine-readable format; the data is then deleted or irreversibly anonymised.
How long is the data kept?
Depending on its nature: invoicing 10 years, geolocation 12 months, technical logs 6 to 12 months, prospect data 3 years; account data for the contractual relationship, extended by the limitation periods.
Is my data backed up?
The contract provides for regular backup, encryption at rest of databases and backups, and documented continuity and recovery plans, with indicative target objectives of a 24-hour recovery point and a 48-hour recovery time. These are best-efforts obligations.
Does Nereva step into the commercial relationship?
No. Your partners and your business relationships remain yours. Nereva synchronises operations without stepping into the commercial relationship. It takes no commission on flows.
Other questions? The general FAQ and the legal documents detail each point.
Go furtherWhere your data is hosted, who accesses it, and what the contract provides.
15-day free trial with 2 licences. No payment method required. Monthly subscription afterwards, no long-term commitment.