digital sovereignty

In Switzerland, the topic of digital sovereignty is moving further into the political spotlight this year. At the beginning of July, the Canton of Geneva became the first canton ever to adopt an official digital sovereignty strategy. On the same day, it became known that the Confederation’s cyber specialists are deliberately seeking distance from Microsoft. The City of Zurich is testing “openDesk”, an open-source alternative to Microsoft 365, and in Germany the federal government and the states decided with the “Germany Stack” to make open file formats mandatory from 2028.

The driving force behind it: cutting costs and regaining control. The Confederation and the cantons have spent over 1.1 billion Swiss francs on Microsoft licences over the past ten years. In the City of Zurich, Microsoft costs have quadrupled in just seven years. And with the revised Data Protection Act (revDSG), the question of where data is stored and who can access it is no longer a gut feeling—it’s compliance.

The blind spot: customer data

What has barely featured in the whole debate so far: it revolves almost exclusively around individual tools—Office, email, cloud storage. But an organisation’s most sensitive data isn’t Word documents. It’s people data: Who are my contacts, how do they behave, what are they interested in, what have they requested or bought? This data sits in marketing: in newsletter tools, in the CRM, in marketing automation.

But most SMEs and organisations outsource this sensitive customer data to US corporations like Mailchimp, HubSpot or Salesforce—everything stored in US clouds. This leads to a paradoxical situation: you migrate Office away from Microsoft to become more sovereign, while at the same time you keep sending the profiles of your own clients to a US corporation. That’s the blind spot.

With the revDSG, this becomes a concrete risk. For particularly sensitive data, fines of up to CHF 250,000 can be imposed—against the responsible person.

Why municipalities are particularly affected

Nowhere is this as tangible as at municipal level. It’s not just the Confederation: the municipality of Volketswil has already switched to a purely Swiss alternative to Microsoft 365. Lenzburg has publicly named Microsoft dependency as a challenge. The new centre “Sovereign Digital Switzerland” explicitly targets all levels of government: the Confederation, cantons and municipalities.

Municipalities communicate constantly: newsletters to residents, event registrations, information on votes, place marketing, tourism, club announcements. At its core, that’s marketing automation—they just don’t call it that in public administration. The data behind it is particularly sensitive, though. It’s the data of their own citizens.

For a municipality, it’s hard to justify writing to residents via a US newsletter provider while switching Office for sovereignty reasons.

The feasible path

This is exactly where open-source marketing automation is the solution. At Aivie, it’s based on Mautic—an open, established platform we’ve been working with for eight years. The principle: your own instance, full data control, and the data stays in Switzerland.

By default, it’s stored encrypted on a Swiss server, compliant with the revDSG. If you want maximum sovereignty, there’s also the option of full hosting on Swiss infrastructure.

With both options, you avoid what comes with US clouds: a newsletter tool that quietly monetises contact profiles in the background, and vendor lock-in with annual price jumps—like Mailchimp is demonstrating once again.

Even so, it includes everything a modern marketing tool needs to do: newsletters, automations, segmentation, forms, campaigns.

The key difference from the big public-sector migration: for an SME or a municipality, this isn’t a century-long project—it can be implemented in weeks. Sovereignty is no longer a multi-million question. It’s a fundamental decision.