Nine – Swiss-made Cloud Mastery

Selected answer: 1. Entirely outside the EU Value 0 SEAL 1

Notes: Nine is a Swiss AG, 100% employee-owned in Zurich. Switzerland is not an EU/EEA member; decision-making resides entirely outside EU/EEA jurisdiction.

Evidence

• European Parliament Fact Sheets — The EEA, Switzerland and the North other 2. October 2026
  Authoritative European Parliament fact sheet confirming Switzerland is not an EEA member and relies on bilateral agreements rather than EEA membership.
  Relevance: Establishes that Switzerland is outside the EU/EEA legal framework, meaning Nine's Swiss jurisdiction does not provide EU/EEA legal entity control.
• Nine Internet Solutions AG — Legal Information / Disclaimer other 2. October 2026
  Official legal page confirming Nine is a Swiss stock corporation (AG) in Zurich, 100% employee-owned, with a wholly-owned Canadian subsidiary — no EU/EEA entities.
  Relevance: Confirms ultimate ownership and decision-making authority reside in Switzerland, not the EU/EEA. No EU/EEA legal entity exists in the corporate structure.
• Wikipedia — European Economic Area other 2. October 2026
  Detailed article on EEA membership confirming Switzerland signed but rejected ratification in a 1992 referendum and was removed as a contracting party.
  Relevance: Provides historical and legal context that Switzerland is not part of the EEA, reinforcing that Swiss-based entities are outside EU/EEA jurisdiction.

Selected answer: 4. Unlikely takeover by or transfer to a non-EU sovereign entity Value 93 SEAL 4

Notes: Nine is 100% employee-owned since 2002 with no M&A signals. Employee ownership creates governance barriers to acquisition, making takeover unlikely but not impossible given its small size.

Evidence

• ESOPs, Takeover Protection, and Corporate Decision-Making other 2. October 2026
  Academic paper from the Journal of Economics and Finance examining how employee stock ownership plans (ESOPs) provide takeover protection and influence corporate governance.
  Relevance: Provides academic evidence that employee ownership structures significantly reduce hostile takeover risk by aligning employee-owner interests and entrenching management against external acquisition.
• Nine Internet Solutions AG — Legal Information / Disclaimer other 2. October 2026
  Official legal page confirming Nine is a Swiss stock corporation (AG) in Zurich, 100% employee-owned, with a wholly-owned Canadian subsidiary — no EU/EEA entities.
  Relevance: Directly confirms 100% employee ownership structure, which is the primary factor in assessing change-of-control risk. No external shareholders or investors that could facilitate a takeover.
• Who Controls an ESOP-Owned Company? other 2. October 2026
  Detailed breakdown of governance in ESOP-owned companies, covering trustee roles, fiduciary duties, and share voting in mergers and asset sales.
  Relevance: Explains governance complexities that make acquiring employee-owned companies difficult, including trustee fiduciary duties and pass-through voting requirements that create barriers to takeover.

Selected answer: 2. Through "voice of the customer" public channels (e.g. feedback portals, online communities) Value 41 SEAL 2

Notes: Nine is Swiss, 100% employee-owned, outside EU/EEA. No formal EU governance bodies exist. EU stakeholders can only influence via public channels like GitHub, docs, and support.

Evidence

• Nine — Official Website other 2. October 2026
  Nine's homepage showcases products, TechTalk events, blog, and support channels. No customer advisory board, feedback portal, or EU stakeholder governance mechanism is mentioned.
  Relevance: Demonstrates that Nine's customer engagement is limited to standard public channels (events, blog, support), supporting the 'voice of the customer' answer.
• Nine Internet Solutions AG — Legal Information / Disclaimer other 2. October 2026
  Official legal page confirming Nine is a Swiss stock corporation (AG) in Zurich, 100% employee-owned, with a wholly-owned Canadian subsidiary — no EU/EEA entities.
  Relevance: Confirms Nine's Swiss, employee-owned structure with no EU governance ties, limiting EU stakeholders to informal feedback channels only.
• Who Controls an ESOP-Owned Company? other 2. October 2026
  Explains ESOP governance: a trustee holds shares on behalf of employees, the board retains strategic control, and employees have no direct voting rights on roadmap decisions.
  Relevance: Shows that in an ESOP like Nine's, roadmap control rests with internal board/trustee, leaving external EU actors no formal governance influence.

Selected answer: 2. Mostly relying on non-EU funding Value 31 SEAL 4

Notes: Nine is 100% employee-owned (Swiss) with no external investors. Switzerland is non-EU/EEA, so capital is non-EU, but company is self-financed, not externally dependent.

Evidence

• Nine Internet Solutions AG — Legal Information / Disclaimer other 2. October 2026
  Official legal page confirming Nine is a Swiss stock corporation (AG) in Zurich, 100% employee-owned, with a wholly-owned Canadian subsidiary — no EU/EEA entities.
  Relevance: Directly confirms 100% employee ownership structure with no external capital, establishing that all financing is Swiss-based (non-EU/EEA) and self-generated.
• Nine Internet Solutions AG — LinkedIn Company Page other 2. October 2026
  LinkedIn company profile listing Nine as Privately Held, founded 2002, headquartered in Zurich, Switzerland, with ~11–50 employees and no investor or funding information.
  Relevance: Third-party corporate listing confirming privately held status with no venture capital or external investor presence, supporting self-financed Swiss capital structure.
• Swiss Made Software — Nine Internet Solutions AG Profile other 2. October 2026
  Swiss Made Software directory profile of Nine as a leading Swiss managed service provider, ISO-certified, ~40 employees, led by CEO Thomas Hug, with no mention of external investors.
  Relevance: Independent Swiss industry directory confirming Nine's Swiss identity and self-financed growth model with no external funding sources referenced.

Selected answer: 1. Minimal Value 0 SEAL 4

Notes: All operations, jobs (~36), revenue (~8M CHF), and data centers are in Switzerland, which is outside EU/EEA. No EU investment or value creation.

Evidence

• Nine Internet Solutions AG — Legal Information / Disclaimer other 2. October 2026
  Official legal page confirming Nine is a Swiss stock corporation (AG) in Zurich, 100% employee-owned, with a wholly-owned Canadian subsidiary — no EU/EEA entities.
  Relevance: Directly shows Nine's economic footprint (jobs, revenue, investment) is entirely Swiss with no EU/EEA presence or value creation.
• Nine Internet Solutions AG — Moneyhouse (Swiss Commercial Register) other 2. October 2026
  Swiss commercial register entry confirming active status, Zurich legal headquarters, CHF 100,000 capital, data processing sector, no EU branches.
  Relevance: Official Swiss register confirms no EU/EEA registered entities or branches, supporting minimal EU economic contribution.
• Swiss Made Software — Nine Internet Solutions AG Profile other 2. October 2026
  Swiss Made Software directory profile of Nine as a leading Swiss managed service provider, ISO-certified, ~40 employees, led by CEO Thomas Hug, with no mention of external investors.
  Relevance: Confirms all operations and jobs are Swiss-based with no EU/EEA expansion or investment.

Selected answer: 1. No clear participation Value 0 SEAL 4

Notes: No evidence found of Nine's participation in IPCEI-CIS, Horizon Europe, or Gaia-X. Small Swiss provider outside EU/EEA legal framework.

Evidence

• CISERO Project — Interactive Map & Full List of All 82 IPCEI-CIS Projects other 2. October 2026
  Official EU-funded directory of all 82 IPCEI-CIS projects across 12 participating EU Member States.
  Relevance: Comprehensive IPCEI-CIS project directory lists no project from Nine Internet Solutions; Switzerland is not a participating country.
• Gaia-X Community – Members Directory other 24. September 2026
  Official Gaia-X hub listing organisations participating in the Gaia-X initiative across Europe.
  Relevance: Gaia-X members directory does not list Nine Internet Solutions AG as a member or participant.
• Nine — Official Website other 2. October 2026
  Nine's homepage showcases products, TechTalk events, blog, and support channels. No customer advisory board, feedback portal, or EU stakeholder governance mechanism is mentioned.
  Relevance: Nine's own website contains no references to IPCEI-CIS, Horizon Europe, Gaia-X, or any EU strategic initiative participation.

Selected answer: Existing Action plan (how to measure ambition? Through means linked to the goals? Relative to the size of the company?) Value 41 SEAL 4

Notes: Nine has partial alignment via renewable energy and data sovereignty focus, but no formal EU industrial strategy action plan or dedicated governance. Small size (~35 employees) warrants proportional ambition assessment.

Evidence

• Nine — Official Website other 2. October 2026
  Nine's homepage showcases products, TechTalk events, blog, and support channels. No customer advisory board, feedback portal, or EU stakeholder governance mechanism is mentioned.
  Relevance: Demonstrates data sovereignty messaging conceptually aligned with EU digital sovereignty goals, but no evidence of participation in EU industrial initiatives (Gaia-X, IPCEI) or formal EU strategy alignment. Key for assessing digital sovereignty dimension.
• Nine — Renewable Energy Documentation other 2. October 2026
  Nine's documentation page confirming two data centers: one powered by 100% renewable electricity (NTS/Colozüri) and one using CO₂-neutral electricity (NTT/E-Shelter), with links to upstream sustainability reports.
  Relevance: Shows partial alignment with EU green sovereignty objectives (e.g., European Green Deal), but framed as operational sustainability rather than formal EU strategy commitment. Relevant to assessing green dimension of industrial strategy alignment.
• Nine Internet Solutions AG — LinkedIn Company Page other 2. October 2026
  Nine's LinkedIn profile with ~35 employees, Swiss-based, showing transparency about renewable vs. CO₂-neutral energy claims at data centers. Founded 2002, ISO-certified, operating two Swiss data centers.
  Relevance: Reveals company scale (small SME) and sustainability transparency practices. Small size contextualizes ambition measurement relative to EU industrial strategy goals. Shows informal green practices but no dedicated EU governance.

Selected answer: 4. Ability to source alternative suppliers or internalise key functions Value 93 SEAL 2

Notes: Nine builds on open standards (Kubernetes, S3, PostgreSQL) with explicit 'no vendor lock-in, migrate out anytime.' 100% employee-owned. Customers can source alternatives if support is withdrawn.

Evidence

• ESOPs, Takeover Protection, and Corporate Decision-Making other 2. October 2026
  Academic paper from the Journal of Economics and Finance examining how employee stock ownership plans (ESOPs) provide takeover protection and influence corporate governance.
  Relevance: Nine is 100% employee-owned; this paper supports that ESOP ownership structure reduces risk of external takeover or forced disruption, enhancing operational resilience and continuity.
• Nine – Products Overview other 2. October 2026
  Nine's full product portfolio page highlighting S3-compatible object storage with 'no vendor lock-in: migrate in or out anytime with standard tooling' and open standards across all products.
  Relevance: Shows that across the entire product portfolio (storage, databases, PaaS), Nine uses open standards ensuring customers can transition to alternative providers if Nine's support is disrupted.
• Nine Kubernetes Engine (NKE) – Product Page other 2. October 2026
  Nine's managed Kubernetes product page explicitly states: 'No proprietary lock-in: your cluster, your rules, migrate out anytime.' Built on open standards with full kubectl access.
  Relevance: Directly demonstrates Nine's design philosophy enabling customers to source alternative suppliers or internalise functions if vendor support is withdrawn — core to the resilience to cut-off assessment.

Selected answer: 1. Non-EU only Value 0 SEAL 1

Notes: Nine is incorporated and operates exclusively in Switzerland under Swiss law (GTC: Swiss law applies exclusively). Switzerland is not an EU or EEA member state.

Evidence

• European Parliament Fact Sheets – The EEA, Switzerland and the North other 2. October 2026
  Official EU Parliament fact sheet confirming Switzerland is not an EU or EEA member state, with relations governed by bilateral sectoral agreements.
  Relevance: Establishes that Switzerland is outside EU/EEA legal frameworks, confirming Nine's jurisdiction cannot be classified as EU law.
• Nine Internet Solutions AG – General Terms and Conditions (GTC) other 2. October 2026
  Nine's GTC explicitly states that Swiss law applies exclusively to all contracts and operations, confirming the provider's legal jurisdiction is Switzerland.
  Relevance: Directly demonstrates that Nine's contracts are governed exclusively by Swiss (non-EU) law, which is the core of the primary legal jurisdiction assessment.
• Swiss Made Software — Nine Internet Solutions AG Profile other 2. October 2026
  Swiss Made Software directory profile of Nine as a leading Swiss managed service provider, ISO-certified, ~40 employees, led by CEO Thomas Hug, with no mention of external investors.
  Relevance: Confirms Nine's Swiss incorporation, Swiss Hosting certification, and exclusive operation from Swiss data centers under Swiss jurisdiction.

Selected answer: Legal structures shielding from foreign law Value 125 SEAL 2

Notes: Swiss AG, 100% employee-owned, exclusive Swiss law, Art. 271 blocking statute shields from foreign claims. Minor exposure via Canadian subsidiary.

Evidence

• Nine Internet Solutions AG – General Terms and Conditions (GTC) other 2. October 2026
  Nine's GTC explicitly states that Swiss law applies exclusively to all contracts and operations, confirming the provider's legal jurisdiction is Switzerland.
  Relevance: Confirms Nine's contractual legal structure anchoring operations in Swiss jurisdiction and shielding from foreign law through choice-of-law and exclusive jurisdiction clauses.
• Object Storage — Nine Internet Solutions AG other 2. October 2026
  Nine's Object Storage product page explicitly states: 'Your data stays in Switzerland with full data residency guarantees, free from the CLOUD Act and subject to Swiss privacy law.'
  Relevance: Demonstrates Nine's own legal assessment that its corporate structure (Swiss AG, no US parent) places it outside CLOUD Act reach, a key extraterritorial law concern.
• Swiss Blocking Statute: Update on Do's and Don'ts Under the Threat of Criminal Sanctions other 2. October 2026
  Legal analysis of Art. 271 Swiss Criminal Code criminalizing unauthorized acts of foreign public authority on Swiss territory, with real enforcement cases.
  Relevance: Art. 271 is a statutory blocking mechanism that legally shields Swiss-based providers like Nine from foreign governmental data demands, directly relevant to extraterritorial law exposure.

Selected answer: 5. Non-EU authorities requests to access data or systems are always rejected by the provider Value 167 SEAL 4

Notes: Swiss blocking statute (Art. 271 SCC) blocks direct foreign data demands; MLA channels allow some requests via Swiss courts. Nine is CLOUD Act-free.

Evidence

• Baker McKenzie — Cloud Compliance Center: Switzerland other 2. October 2026
  Examines Article 271 SCC's application to cloud providers, noting that disclosing Swiss-hosted data to foreign authorities outside MLA channels triggers criminal liability.
  Relevance: Confirms that cloud providers like Nine cannot comply with direct foreign data demands; requests must be routed through Swiss legal channels, supporting Option 4.
• Managing Swiss Data Protection and Secrecy Laws in Cross-Border Investigations — Bär & Karrer other 3. September 2026
  Swiss law firm analysis of Swiss blocking statutes (Art. 271, 273 SCC), which prohibit direct disclosure of data to foreign authorities without Swiss legal process involvement.
  Relevance: Explains how Swiss blocking statutes dispute direct foreign authority requests while permitting some access via mutual legal assistance, matching Option 4 pattern.
• Nine — Object Storage (Product Page) other 2. October 2026
  Nine's Object Storage page explicitly states data stays in Switzerland, free from the CLOUD Act, subject to Swiss privacy law, with full data residency guarantees.
  Relevance: Directly addresses data access pathways: Nine claims CLOUD Act exemption and Swiss legal jurisdiction over all data, limiting non-EU authority access routes.

Selected answer: Part of the offer cannot be exposed to restrictions towards EU MSs or international organisations Value 167 SEAL 4

Notes: Nine's Swiss-hosted, encrypted data services are insulated from EAR/ITAR via Swiss jurisdiction and blocking statute, but U.S.-origin tech components may still be subject to restrictions.

Evidence

• Navigating the Export Implications of Cloud Computing other 2. October 2026
  Export Compliance Training Institute article explaining how EAR § 734.18 and ITAR § 120.54 encryption carve-outs apply to cloud computing, excluding properly encrypted data from export controls.
  Relevance: Shows that Nine's encrypted Swiss-hosted cloud services fall under encryption carve-outs, meaning part of the offer cannot be exposed to EAR/ITAR restrictions for EU MSs or international organisations.
• Swiss Federal Department of Foreign Affairs — Export Controls other 2. October 2026
  Official Swiss government page on export controls, covering Switzerland's participation in all four international export control regimes and SECO's licensing framework.
  Relevance: Establishes the Swiss export control framework governing Nine as a Swiss company, showing Switzerland imposes its own controls aligned with international regimes rather than being subject to U.S. extraterritorial jurisdiction.
• Switzerland – U.S. Export Controls (ITA Country Commercial Guide) other 2. October 2026
  Official U.S. International Trade Administration guide detailing how EAR and ITAR apply to exports to Switzerland, including licensing requirements and screening procedures.
  Relevance: Directly addresses applicability of EAR/ITAR to Switzerland-based entities like Nine, showing U.S. export controls can apply to U.S.-origin technology used by Swiss cloud providers.

Selected answer: 2. Mostly outside the EU Value 41 SEAL 4

Notes: All IP (Deploio, NKE) is created, developed, and registered in Switzerland, which is outside the EU/EEA. 100% Swiss-owned, no EU entities.

Evidence

• Deploio – Your Swiss App Engine other 2. October 2026
  Standalone product page for Deploio, Nine's proprietary PaaS. States 'genuine Swiss quality and 100% CH-owned' with Swiss Made Software and Swiss Hosting certifications.
  Relevance: Directly confirms Nine's proprietary IP (Deploio) is developed in Switzerland and 100% Swiss-owned, placing IP origin outside the EU.
• Nine Internet Solutions AG — Legal Information / Disclaimer other 2. October 2026
  Official legal page confirming Nine is a Swiss stock corporation (AG) in Zurich, 100% employee-owned, with a wholly-owned Canadian subsidiary — no EU/EEA entities.
  Relevance: Confirms IP creation, registration, and corporate development all occur in Switzerland (outside EU/EEA). Copyright explicitly protected under Swiss law.
• Swiss Made Software — Nine Internet Solutions AG Profile other 2. October 2026
  Swiss Made Software directory profile of Nine as a leading Swiss managed service provider, ISO-certified, ~40 employees, led by CEO Thomas Hug, with no mention of external investors.
  Relevance: Independent certification verifying Nine's software IP is developed in Switzerland, confirming IP origin outside the EU/EEA.

Selected answer: non-EU law, mixed non-EU countries Value 41 SEAL 3

Notes: Nine is Swiss (non-EU, non-EEA), 100% employee-owned. IP owned by Swiss entity. Canadian subsidiary is also non-EU. No EU jurisdiction involved.

Evidence

• European Parliament Fact Sheets – The EEA, Switzerland and the North other 2. October 2026
  Official EU Parliament fact sheet confirming Switzerland is not an EU or EEA member state, with relations governed by bilateral sectoral agreements.
  Relevance: Establishes that Switzerland is neither an EU nor EEA member, placing Nine's IP holder jurisdiction firmly outside EU legal frameworks.
• Nine Internet Solutions AG — Legal Information / Disclaimer other 2. October 2026
  Official legal page confirming Nine is a Swiss stock corporation (AG) in Zurich, 100% employee-owned, with a wholly-owned Canadian subsidiary — no EU/EEA entities.
  Relevance: Directly establishes that IP rights are owned by a Swiss (non-EU) entity and that a Canadian (non-EU) subsidiary exists, confirming mixed non-EU jurisdiction for IP holder.
• Swiss Federal Institute of Intellectual Property (IPI) — National IP Law other 2. October 2026
  Official Swiss government portal detailing all Swiss federal IP laws (trademarks, patents, designs, copyright) governing IP rights and enforcement in Switzerland.
  Relevance: Confirms IP rights in Switzerland are governed exclusively by Swiss federal law, not EU law, reinforcing the non-EU jurisdiction classification.

Selected answer: 2. Primarily the provider but not exclusively Value 50 SEAL 1

Notes: Nine manages AES-256 encryption at rest with no BYOK/HYOK offering. Zero trust and Swiss law limit provider access, but customers lack exclusive key control.

Evidence

• Achieving Data Sovereignty in the Cloud: Three Approaches to Key Control other 2. October 2026
  Utimaco article explaining HYOK, Double Key Encryption, and BYOK models for achieving data sovereignty through encryption key control.
  Relevance: Provides the framework for comparing key control models. Nine does not offer any of these customer-controlled key approaches, confirming provider-primary encryption key management.
• Object Storage — Nine Internet Solutions AG other 2. October 2026
  Nine's Object Storage product page explicitly states: 'Your data stays in Switzerland with full data residency guarantees, free from the CLOUD Act and subject to Swiss privacy law.'
  Relevance: Confirms encryption is provider-managed (AES-256 at rest) with no mention of customer-managed keys, BYOK, or HYOK. S3 compatibility allows client-side encryption but no provider KMS service is offered.
• Security — Nine Internet Solutions AG other 2. October 2026
  Nine's security page covering encryption at rest and in transit, zero trust architecture, FINMA compliance, and ISO 27001/9001 certifications.
  Relevance: Shows encryption is embedded in infrastructure with zero trust and least-privilege principles, limiting provider access to data. No customer-controlled key management service is mentioned.

Selected answer: 3. Logs exist but not real-time or controlled by vendor (vendor is replaced by CUSTOMER in the survey) Value 100 SEAL 2

Notes: Nine has ISO 27001 logging and optional NKE audit logs, but these are not real-time, not comprehensive, and lack independent auditability or AI model usage tracking.

Evidence

• Audit Logging — Nine Kubernetes Engine (NKE) Documentation other 2. October 2026
  Official Nine documentation for NKE audit logging. Logs are optional, pushed to Loki/Grafana, set to Metadata level only, and require customer setup via API/kubectl.
  Relevance: Shows Nine's audit logging is limited to Kubernetes clusters, optional, not real-time, and lacks independent auditability or comprehensive data access tracking.
• Nine – Products Overview other 2. October 2026
  Nine's full product portfolio page highlighting S3-compatible object storage with 'no vendor lock-in: migrate in or out anytime with standard tooling' and open standards across all products.
  Relevance: Shows monitoring and observability tools exist but are operational tools, not customer-controlled real-time data access audit logs or independent auditability.
• Security — Nine Internet Solutions AG other 2. October 2026
  Nine's security page detailing ISO 27001/9001 certifications, zero trust architecture, least-privilege IAM, operational monitoring, and documented TOMs for audit support.
  Relevance: Confirms ISO 27001 logging controls exist and monitoring is part of operations, but no evidence of real-time customer-controlled auditability of data access.

Selected answer: 4. Deletion is technically verified with access logs Value 150 SEAL 3

Notes: Nine has ISO 27001/GDPR-based deletion policies but no evidence of systematic technical verification or customer-facing proof of erasure.

Evidence

• ISO 27001 Control 8.10: Information Deletion | UpGuard other 2. October 2026
  Explains ISO 27001:2022 Control 8.10 requiring secure deletion methods, documented verification procedures, and audit evidence such as deletion logs and certificates of destruction.
  Relevance: Nine holds ISO 27001 certification, implying deletion controls exist internally. However, no public evidence shows Nine provides customers with deletion logs or erasure certificates, limiting verification to internal policy.
• Nine Internet Solutions AG – General Terms and Conditions (GTC) other 2. October 2026
  Nine's GTC explicitly states that Swiss law applies exclusively to all contracts and operations, confirming the provider's legal jurisdiction is Switzerland.
  Relevance: GTC only mentions the right to delete data post-contract but provides no technical mechanisms, verification procedures, or proof of erasure—indicating policy-based rather than technically verified deletion.
• Nine Internet Solutions AG — Privacy Policy other 2. October 2026
  Privacy policy referencing Swiss DPA and GDPR compliance, including user rights to access, rectify, block, or erase personal data. No technical erasure verification details.
  Relevance: References GDPR right to erasure but does not describe any technical implementation, audit trail, or proof-of-erasure mechanism—consistent with policy-level compliance only.

Selected answer: 4. Data in the EU by default, tightly controlled exceptions Value 150 SEAL 1

Notes: All data in Switzerland (EU adequate) by default; tightly controlled exceptions via Cloudflare US & Canada support with SCCs.

Evidence

• Nine — Compliance as a Competitive Advantage other 2. October 2026
  Blog post on how Nine enforces Swiss-only support access despite global follow-the-sun teams in Canada.
  Relevance: Shows Nine technically restricts data access to Switzerland, with remote Canada support as the only tightly controlled exception.
• Nine — Data Processing Agreement (DPA) other 2. October 2026
  DPA lists sub-processors: Google Cloud EMEA (Ireland), Cloudflare (US), Nine Canada, with SCCs for third-country transfers.
  Relevance: Reveals tightly controlled exceptions for third-country data access (Cloudflare US, Canada support) with standard safeguards under SCCs.
• Nine — Official Website other 2. October 2026
  Nine's homepage showcases products, TechTalk events, blog, and support channels. No customer advisory board, feedback portal, or EU stakeholder governance mechanism is mentioned.
  Relevance: Directly confirms data hosted exclusively in Switzerland (European jurisdiction with EU adequacy) by default with no third-country data storage.

Selected answer: Mostly non-EU dependencies: Licensed AI, chip dependency Value 50 SEAL 2

Notes: Nine provides NVIDIA GPU hosting in Switzerland but develops no AI models or pipelines. Full US chip dependency; Swiss (non-EU) governance; no EU-origin AI technology stack.

Evidence

• Nine — Before You Build AI Infrastructure: The Questions You Should Be Asking other 2. October 2026
  Nine's blog post outlining key questions for AI infrastructure deployment, emphasizing CLOUD Act risks of US hyperscalers and positioning Nine as a Swiss alternative for AI workloads.
  Relevance: Confirms Nine provides GPU hosting infrastructure, not AI model development or pipelines. Focus is on data residency (Swiss law), not EU AI sovereignty or EU-origin model capabilities.
• Nine — Swiss AI Infrastructure other 2. October 2026
  Nine's dedicated AI infrastructure page showcasing NVIDIA GPU servers (H100 NVL, RTX Pro 6000 Blackwell, L40s) hosted in Swiss data centres for AI training, inference, and fine-tuning workloads.
  Relevance: Shows Nine's AI offering is infrastructure-only with full NVIDIA (US) chip dependency. No own AI models, training pipelines, or EU-origin technology — only hosting of third-party workloads under Swiss law.
• Switzerland Built a Sovereign AI. Then Wired CHF 140M to Microsoft — theCUBE Research other 2. October 2026
  Analytical article assessing Switzerland's AI sovereignty across five pillars, noting contradictions between sovereign AI initiatives and reliance on US technology stacks.
  Relevance: Provides broader context on Swiss AI sovereignty gaps, including technology (6/10) and operational (3/10) scores. Underscores that providers like Nine offer hosting but not EU-origin AI models or independent chip supply.

Selected answer: 3. Standard documented methods for data export are available Value 83 SEAL 4

Notes: Nine provides S3-compatible storage with documented client tools (s3cmd, rclone, restic) and Kubernetes on OCI/open standards—enabling portability with no vendor lock-in.

Evidence

• Day 2 Operations with Kubernetes — Nine Whitepaper other 2. October 2026
  Nine whitepaper on Kubernetes Day-2 operations, covering OCI standards, container portability, and avoidance of vendor lock-in via open standards.
  Relevance: Confirms workload portability via OCI and Kubernetes open standards—containers run unmodified across any compliant environment, preventing lock-in.
• Object Storage — Nine Internet Solutions AG other 2. October 2026
  Nine's Object Storage product page explicitly states: 'Your data stays in Switzerland with full data residency guarantees, free from the CLOUD Act and subject to Swiss privacy law.'
  Relevance: S3 compatibility means customers can use standard tools to export and migrate data anytime without proprietary lock-in, directly addressing portability.
• Object Storage Client Tools — Nine Documentation other 2. October 2026
  Technical documentation for connecting to Nine's S3-compatible storage using s3cmd, rclone, restic, and Minio library with API endpoints and configuration examples.
  Relevance: Provides documented, standard methods for data export/migration using widely available open-source tools—core evidence for option 3.

Selected answer: 2. Operational services are partially sourced from within the EU Value 41 SEAL 1

Notes: Nine is Swiss (non-EU) with Swiss-based ops and Canadian 24/7 support; some sub-processing in EU (Google EMEA Ireland), but not predominantly EU.

Evidence

• Nine — Official Website other 2. October 2026
  Nine's homepage showcases products, TechTalk events, blog, and support channels. No customer advisory board, feedback portal, or EU stakeholder governance mechanism is mentioned.
  Relevance: Shows operational services split across EU (Google Ireland) and non-EU (Cloudflare US, Nine Canada) vendors.
• Nine Internet Solutions AG — Legal Information / Disclaimer other 2. October 2026
  Official legal page confirming Nine is a Swiss stock corporation (AG) in Zurich, 100% employee-owned, with a wholly-owned Canadian subsidiary — no EU/EEA entities.
  Relevance: Confirms Nine is Swiss (non-EU) with operations primarily in Switzerland and Canada, not EU-based teams.

Selected answer: Majority EU, escalation abroad Value 83 SEAL 3

Notes: 36 staff in Zurich (Switzerland, treated as European under framework). Canadian subsidiary provides 24/7 on-call escalation from abroad. No EU member-state staff specifically.

Evidence

• Nine — Expertise Page other 2. October 2026
  Describes certified engineers (CKA, Google Cloud Architect), 24/7 emergency on-call service, multi-level support system all based in Zurich, Switzerland.
  Relevance: Confirms operational expertise and 24/7 support model with Zurich-based engineers, showing where core talent pool is located.
• Nine Internet Solutions AG — Legal Information / Disclaimer other 2. October 2026
  Official legal page confirming Nine is a Swiss stock corporation (AG) in Zurich, 100% employee-owned, with a wholly-owned Canadian subsidiary — no EU/EEA entities.
  Relevance: Directly confirms staff count, Swiss base, and Canadian subsidiary role for 24/7 escalation support — key for skill location assessment.
• Nine Internet Solutions AG — LinkedIn Company Page other 2. October 2026
  LinkedIn company profile listing Nine as Privately Held, founded 2002, headquartered in Zurich, Switzerland, with ~11–50 employees and no investor or funding information.
  Relevance: Independent third-party corroboration of staff size and Swiss-only operations, confirming no EU member-state staff but European-based talent.

Selected answer: 2. The team is mixed but the majority of support staff reside outside the EU Value 41 SEAL 2

Notes: Nine's support team is split between Switzerland (non-EU/EEA) and Canada. Swiss-only access is enforced for sensitive systems, but no staff in EU/EEA.

Evidence

• Nine — Compliance as a Competitive Advantage other 2. October 2026
  Blog post on how Nine enforces Swiss-only support access despite global follow-the-sun teams in Canada.
  Relevance: Directly addresses support channel locations and the split between Swiss and Canadian teams. Confirms no EU/EEA-based support staff exist.
• Nine — Expertise Page other 2. October 2026
  Describes certified engineers (CKA, Google Cloud Architect), 24/7 emergency on-call service, multi-level support system all based in Zurich, Switzerland.
  Relevance: Confirms support is delivered from Zurich (Switzerland, non-EU/EEA) with on-call coverage. No mention of EU-based support staff.
• Nine Internet Solutions AG — Legal Information / Disclaimer other 2. October 2026
  Official legal page confirming Nine is a Swiss stock corporation (AG) in Zurich, 100% employee-owned, with a wholly-owned Canadian subsidiary — no EU/EEA entities.
  Relevance: Confirms company structure with staff in Switzerland (non-EU/EEA) and Canada only. No EU/EEA-based operations or support entities exist.

Selected answer: 3. EU primary with non-EU fallback - Stored/managed in the EU by default, but some storage/replication/access outside the EU may occur (e.g., disaster recovery/support) Value 83 SEAL 4

Notes: Primary docs hosted in Switzerland (European) with open-source code on GitHub (US) and Canadian support branch, so some non-EU storage/access exists.

Evidence

• Manage Your Infrastructure at Nine in Code other 2. October 2026
  Blog post detailing Nine API, nctl CLI, Terraform, Ansible, ArgoCD for IaC. All tools open source; docs at docs.nine.ch hosted on Swiss infrastructure.
  Relevance: Demonstrates comprehensive documentation and operational know-how available for long-term autonomy, primarily hosted in Switzerland (European jurisdiction).
• Nine — Expertise Page other 2. October 2026
  Describes certified engineers (CKA, Google Cloud Architect), 24/7 emergency on-call service, multi-level support system all based in Zurich, Switzerland.
  Relevance: Support is Zurich-based but Canadian branch provides non-EU access for 24/7 coverage, fitting non-EU fallback for operational access.
• nine — GitHub Organization other 2. October 2026
  170 public repositories including nctl CLI, API definitions, and infrastructure tools. Source code publicly available on US-hosted GitHub.
  Relevance: Source code is on GitHub (US jurisdiction), not EU. While publicly available and forkable, storage is outside EU, fitting non-EU fallback criterion.

Selected answer: 4. Ability to source alternative suppliers or internalise key functions Value 125 SEAL 3

Notes: Nine uses open-standards NKE reducing Google dependency, Swiss-based data centres, and DPA veto rights. Some US suppliers (Cloudflare, Intel) remain but can be replaced.

Evidence

• Nine — Data Processing Agreement (DPA) other 2. October 2026
  DPA lists sub-processors: Google Cloud EMEA (Ireland), Cloudflare (US), Nine Canada, with SCCs for third-country transfers.
  Relevance: Reveals supplier jurisdictions and legal control mechanisms: SCCs, notification periods, and customer veto rights enabling supplier substitution.
• Nine Internet Solutions AG — Legal Information / Disclaimer other 2. October 2026
  Official legal page confirming Nine is a Swiss stock corporation (AG) in Zurich, 100% employee-owned, with a wholly-owned Canadian subsidiary — no EU/EEA entities.
  Relevance: Maps Nine's full supply chain showing Swiss-based critical infrastructure providers and identifies foreign suppliers requiring alternatives.
• Nine Kubernetes Engine (NKE) – Product Page other 2. October 2026
  Nine's managed Kubernetes product page explicitly states: 'No proprietary lock-in: your cluster, your rules, migrate out anytime.' Built on open standards with full kubectl access.
  Relevance: Demonstrates Nine's ability to operate independently of foreign hyperscalers via open-standards architecture, reducing dependency on Google Cloud.

Selected answer: Partial disclosure Value 35 SEAL 1

Notes: Nine discloses key hardware partners (Intel, NVIDIA) and GPU selection criteria, but lacks comprehensive supply chain transparency on geographic origins of all physical components.

Evidence

• Nine — GPU Server Product Page other 2. October 2026
  Nine's GPU server page lists NVIDIA GPU models (H100 NVL, L40s, RTX 4500 ADA, RTX Pro 6000 Blackwell) and describes their hardware selection process comparing value proposition and availability.
  Relevance: Directly relevant: shows partial disclosure of hardware component selection and GPU models, but no full bill of materials or geographic origin of all components.
• Nine — Swiss AI Infrastructure other 2. October 2026
  Nine's dedicated AI infrastructure page showcasing NVIDIA GPU servers (H100 NVL, RTX Pro 6000 Blackwell, L40s) hosted in Swiss data centres for AI training, inference, and fine-tuning workloads.
  Relevance: Confirms specific NVIDIA hardware used in Swiss data centres, showing transparency on GPU sourcing but not on full component origins.
• Nine Internet Solutions AG — LinkedIn Company Page other 2. October 2026
  LinkedIn company profile listing Nine as Privately Held, founded 2002, headquartered in Zurich, Switzerland, with ~11–50 employees and no investor or funding information.
  Relevance: Identifies Intel as a hardware partner, confirming partial disclosure of supply chain partners but without detailed component origin information.

Selected answer: Foreign origin, partial disclosure Value 35 SEAL 1

Notes: Nine procures hardware (NVIDIA GPUs, server chassis) from non-EU OEMs without disclosing specific suppliers or manufacturing locations. Partial disclosure via GPU model names only.

Evidence

• Nine — GPU Server Product Page other 2. October 2026
  Nine's GPU server page lists NVIDIA GPU models (H100 NVL, L40s, RTX 4500 ADA, RTX Pro 6000 Blackwell) and describes their hardware selection process comparing value proposition and availability.
  Relevance: Shows Nine procures NVIDIA (US-designed, Taiwan-manufactured) GPUs without disclosing underlying server hardware suppliers or manufacturing locations, confirming foreign-origin hardware with partial disclosure.
• Nine — Infrastructure other 2. October 2026
  Details Nine's two Swiss data centers (ColoZüri, NTT Zürich 1) with redundant power, cooling, and connectivity. No mention of hardware suppliers or component origins.
  Relevance: Confirms Nine operates in Swiss colocation facilities but procures hardware from external OEMs. No disclosure of hardware manufacturing locations, supporting partial disclosure assessment.
• Swiss Made Software — Nine Internet Solutions AG Profile other 2. October 2026
  Swiss Made Software directory profile of Nine as a leading Swiss managed service provider, ISO-certified, ~40 employees, led by CEO Thomas Hug, with no mention of external investors.
  Relevance: Confirms Nine's hardware is procured from NVIDIA and other OEMs rather than self-manufactured. Swiss Made Software label covers software, not hardware origin, highlighting partial disclosure gap.

Selected answer: Partial disclosure Value 35 SEAL 4

Notes: Nine discloses data center locations, ISO certs, GPU models, and open-source code, but lacks firmware provenance, SBOMs, and hardware supplier transparency.

Evidence

• nine — GitHub Organization other 2. October 2026
  170 public repositories including nctl CLI, API definitions, and infrastructure tools. Source code publicly available on US-hosted GitHub.
  Relevance: Provides partial software transparency via open-source repos but does not cover firmware, embedded code in hardware, or hardware component jurisdiction — only application-layer code.
• Nine — Infrastructure other 2. October 2026
  Details Nine's two Swiss data centers (ColoZüri, NTT Zürich 1) with redundant power, cooling, and connectivity. No mention of hardware suppliers or component origins.
  Relevance: Shows physical infrastructure transparency but explicitly omits hardware component origins, supplier identities, and firmware provenance — central to this assessment question.
• Nine — Security Page other 3. October 2026
  ISO 27001/9001 certified, zero trust architecture, FINMA compliance, encryption at rest/transit, least-privilege IAM.
  Relevance: Demonstrates security certifications and practices but provides no component-level supply chain transparency, SBOMs, or firmware provenance verification.

Selected answer: 3. Core and essential parts of the software are designed and maintained by EU teams Value 71 SEAL 3

Notes: Core proprietary software (Deploio, NKE, API) is Swiss-developed, but relies on globally-developed open-source stack. Switzerland is non-EU.

Evidence

• Deploio Team — Deplo.io other 3. October 2026
  Shows all Deploio software developers based in Zurich, Switzerland. Co-founded by Nine (Zurich) and Renuo AG (Swiss). Team includes platform and software engineers.
  Relevance: Demonstrates that Nine's core proprietary software (Deploio PaaS) is developed exclusively by a Swiss-based team, not EU teams, limiting the EU-origin scope.
• nine — GitHub Organization other 2. October 2026
  170 public repositories including nctl CLI, API definitions, and infrastructure tools. Source code publicly available on US-hosted GitHub.
  Relevance: Shows Nine's own software tools are developed by Swiss-based engineers, but infrastructure relies on globally-developed open-source dependencies (Kubernetes, Linux, etc.).
• Swiss Made Software — Nine Internet Solutions AG Profile other 2. October 2026
  Swiss Made Software directory profile of Nine as a leading Swiss managed service provider, ISO-certified, ~40 employees, led by CEO Thomas Hug, with no mention of external investors.
  Relevance: Confirms Nine's proprietary software carries Swiss origin certification, but Switzerland is non-EU, placing core software outside the EU-origin criterion for full scoring.

Selected answer: 3. Non-EU control, EU execution - Execution is performed by EU teams, but pipeline administration and/or final release approvals (incl. signing) are under non-EU jurisdiction Value 71 SEAL 3

Notes: Pipeline admin and release approvals under Swiss (non-EU) jurisdiction; execution also by Swiss teams, not EU-based.

Evidence

• Deploio — Swiss App Engine (PaaS) other 3. October 2026
  Product page for Deploio PaaS showing automatic build/deploy on Git push, hosted entirely in Swiss data centers, ISO 27001/9001 certified.
  Relevance: Demonstrates Nine's software build and release pipeline is operated from Switzerland under Swiss jurisdiction, with no EU involvement.
• Nine Kubernetes Engine (NKE) – Product Page other 2. October 2026
  Nine's managed Kubernetes product page explicitly states: 'No proprietary lock-in: your cluster, your rules, migrate out anytime.' Built on open standards with full kubectl access.
  Relevance: Shows software stack packaging and distribution from Swiss infrastructure under Swiss jurisdiction, with open-source components managed by Swiss teams.
• Swiss Made Software — Nine Internet Solutions AG Profile other 2. October 2026
  Swiss Made Software directory profile of Nine as a leading Swiss managed service provider, ISO-certified, ~40 employees, led by CEO Thomas Hug, with no mention of external investors.
  Relevance: Confirms all software development and operations are entirely Swiss-based under Swiss jurisdiction, directly relevant to origin of software and governing jurisdiction.

Selected answer: Few non-EU vendors or facilities involved in critical services, non documented, or non-EU vendors/facilities transparently documented Value 71 SEAL 2

Notes: Few non-EU dependencies (Cloudflare US, NTT Japan) transparently documented in DPA. Core infrastructure is Swiss-owned and operated.

Evidence

• Nine — Data Processing Agreement (DPA) other 2. October 2026
  DPA lists sub-processors: Google Cloud EMEA (Ireland), Cloudflare (US), Nine Canada, with SCCs for third-country transfers.
  Relevance: Transparently documents non-EU sub-processors (Cloudflare US, NTT Japan facility) and their roles, processing locations, and SCC safeguards for supply chain dependency assessment.
• Nine — Infrastructure other 2. October 2026
  Details Nine's two Swiss data centers (ColoZüri, NTT Zürich 1) with redundant power, cooling, and connectivity. No mention of hardware suppliers or component origins.
  Relevance: Shows data center facility dependency on NTT (non-EU/Japanese) while confirming core infrastructure is Swiss-based, relevant to single point of dependency on non-EU facilities.
• Nine Internet Solutions AG — Cloudtango Provider Profile other 3. October 2026
  Cloudtango profile of Nine listing technology partnerships with Intel, Google, and Amazon, plus ISO 27001 certification and Swiss HQ.
  Relevance: Reveals non-EU technology partners (Intel US, Google US, Amazon US) in Nine's supply chain, complementing DPA findings on non-EU vendor dependencies.

Selected answer: Critical suppliers and subcontractors can be audited Value 71 SEAL 2

Notes: DPA grants audit rights over Nine's records for listed sub-processors; ISO 27001 ensures supplier mgmt. No evidence of audit rights extending to entire sub-supplier chain.

Evidence

• ISO 27001:2022 Annex A 5.19–5.22 Supplier Management Controls other 3. October 2026
  Explains ISO 27001:2022 supplier relationship controls: supplier policy, risk classification, security clauses with audit rights, ICT supply chain security, and ongoing monitoring.
  Relevance: Defines the ISO 27001 framework requirements Nine must follow for supplier management, clarifying the scope and limits of audit rights and supply chain visibility under certification.
• Nine — Data Processing Agreement (DPA) other 2. October 2026
  DPA lists sub-processors: Google Cloud EMEA (Ireland), Cloudflare (US), Nine Canada, with SCCs for third-country transfers.
  Relevance: Directly addresses audit rights and sub-processor visibility. Audit scope is limited to Nine's records and does not extend to sub-suppliers of sub-processors like Google Cloud or Cloudflare.
• Security — Nine Internet Solutions AG other 2. October 2026
  Nine's security page covering encryption at rest and in transit, zero trust architecture, FINMA compliance, and ISO 27001/9001 certifications.
  Relevance: ISO 27001 certification implies supplier management controls (A.5.19-A.5.22) including supplier registers and ICT supply chain security, but these are internal processes, not customer audit rights over the full chain.

Selected answer: 4. Standards-based and broadly compatible - Interfaces and data formats predominantly follow recognised open standards (e.g., ETSI/CEN/CENELEC, ISO/IEC, IETF/W3C) with stable versioning and full documentation Value 150 SEAL 3

Notes: Nine uses open standards (K8s, S3, OpenAPI) with published specs, GitHub repos, Terraform and kubectl support. Some Nine-specific CRDs remain.

Evidence

• Introducing the Nine Self-Service API — Nine.ch Blog other 3. October 2026
  Technical blog post detailing Nine's API built on Kubernetes CRDs via Crossplane, with OpenAPI v2 spec published on GitHub and Terraform interoperability.
  Relevance: Shows API architecture based on open Kubernetes standards with published OpenAPI spec, enabling third-party integration via curl, kubectl, and Terraform without proprietary barriers.
• nine — GitHub Organization other 2. October 2026
  170 public repositories including nctl CLI, API definitions, and infrastructure tools. Source code publicly available on US-hosted GitHub.
  Relevance: Demonstrates open publication of API specifications, CLI tools, and infrastructure-as-code examples, enabling third-party interoperability and reducing vendor-specific dependencies.
• Nine Kubernetes Engine (NKE) – Product Page other 2. October 2026
  Nine's managed Kubernetes product page explicitly states: 'No proprietary lock-in: your cluster, your rules, migrate out anytime.' Built on open standards with full kubectl access.
  Relevance: Directly evidences use of recognised open standards (Kubernetes/CNCF) with no vendor lock-in, full kubectl access, and integration with standard open-source tools for interoperability.

Selected answer: 4. Policy for most core services - A formal policy mandates and documents open standards for most core services, with managed exceptions Value 150 SEAL 3

Notes: Nine consistently documents open standards across all core services (K8s, S3, OSS DBs) with a stated company-wide commitment, but lacks a formal governance policy document.

Evidence

• nine — GitHub Organization other 2. October 2026
  170 public repositories including nctl CLI, API definitions, and infrastructure tools. Source code publicly available on US-hosted GitHub.
  Relevance: Practical evidence of open standards adoption — public repos, OpenAPI specs, Kubernetes CRDs via Crossplane, and open-source tooling (Terraform, Ansible, ArgoCD).
• Nine — Official Website other 2. October 2026
  Nine's homepage showcases products, TechTalk events, blog, and support channels. No customer advisory board, feedback portal, or EU stakeholder governance mechanism is mentioned.
  Relevance: Demonstrates Nine's overarching, documented commitment to open standards across all products, serving as the closest equivalent to a formal policy statement.
• Nine Kubernetes Engine (NKE) – Product Page other 2. October 2026
  Nine's managed Kubernetes product page explicitly states: 'No proprietary lock-in: your cluster, your rules, migrate out anytime.' Built on open standards with full kubectl access.
  Relevance: Shows a core service (Managed Kubernetes) fully built on publicly governed open standards (CNCF Kubernetes) with documented no-lock-in guarantees.

Selected answer: 3. The software is open source , permitting modification and redistribution, but governance is centralised (e.g., single-company or non-open foundation), limiting strategic autonomy or smooth handover Value 100 SEAL 3

Notes: Nine uses open-source components (Kubernetes, PostgreSQL) under independent foundations, but its own platform tools are governed centrally by Nine as a single company.

Evidence

• GitHub – ninech/deploio-examples other 3. October 2026
  Apache-2.0 licensed repository hosting example applications for Deploio PaaS, supporting Ruby, Python, PHP, Java, and Go with buildpack and Dockerfile approaches.
  Relevance: Shows Nine releases code under permissive open source licenses (Apache-2.0) permitting modification and redistribution, but governance remains with Nine as a single company.
• Nine – Products Overview other 2. October 2026
  Nine's full product portfolio page highlighting S3-compatible object storage with 'no vendor lock-in: migrate in or out anytime with standard tooling' and open standards across all products.
  Relevance: Demonstrates the platform is built on open source technologies (Kubernetes, PostgreSQL, MariaDB, OpenSearch) under independent foundations, but managed service layer itself is proprietary.
• nine — GitHub Organization other 2. October 2026
  170 public repositories including nctl CLI, API definitions, and infrastructure tools. Source code publicly available on US-hosted GitHub.
  Relevance: Shows Nine publishes open source code with modification rights, but repos are governed by Nine (single company), not an independent foundation, limiting strategic autonomy and handover.

Selected answer: Some public insight exists (all) Value 100 SEAL 3

Notes: Nine provides public docs (docs.nine.ch), API specs, security architecture, and 170 open-source repos, but lacks comprehensive architectural/data-flow docs for all services.

Evidence

• nine — GitHub Organization other 2. October 2026
  170 public repositories including nctl CLI, API definitions, and infrastructure tools. Source code publicly available on US-hosted GitHub.
  Relevance: Open-source repos reveal service architecture, API definitions, and tooling, giving public visibility into design and dependencies of the platform.
• Nine Documentation Hub other 3. October 2026
  Public documentation hub covering managed services, API reference, Kubernetes, databases, and product architecture with service-level docs and diagrams.
  Relevance: Provides public architectural documentation across all service categories, including API structure, resource management, and some data flow diagrams (e.g., Tempo tracing).
• Security — Nine Internet Solutions AG other 2. October 2026
  Nine's security page covering encryption at rest and in transit, zero trust architecture, FINMA compliance, and ISO 27001/9001 certifications.
  Relevance: Publicly documents security architecture, data protection flows, and infrastructure dependencies, supporting service architecture transparency assessment.

Selected answer: EU-hosted, foreign stack Value 50 SEAL 3

Notes: Nine uses entirely foreign (US) processors (Intel/AMD) and accelerators (NVIDIA) hosted in Swiss data centers. No European processor IP, design, or fabrication involvement.

Evidence

• Advancing European Sovereignty in HPC with RISC-V (EuroHPC JU) other 31. August 2026
  EuroHPC JU article on DARE project designing EU sovereign RISC-V HPC accelerators and processors with €120M budget.
  Relevance: Contrasts what true European HPC processor sovereignty (EU-designed RISC-V chips) looks like against Nine's reliance on US NVIDIA/Intel hardware.
• Nine — GPU Server Product Page other 2. October 2026
  Nine's GPU server page lists NVIDIA GPU models (H100 NVL, L40s, RTX 4500 ADA, RTX Pro 6000 Blackwell) and describes their hardware selection process comparing value proposition and availability.
  Relevance: Shows the specific foreign (NVIDIA) hardware models used for high-performance computing, with no European-designed processors or accelerators in the stack.
• Nine — Swiss AI Infrastructure other 2. October 2026
  Nine's dedicated AI infrastructure page showcasing NVIDIA GPU servers (H100 NVL, RTX Pro 6000 Blackwell, L40s) hosted in Swiss data centres for AI training, inference, and fine-tuning workloads.
  Relevance: Confirms Nine's HPC/AI compute stack is entirely built on US-designed NVIDIA accelerators with no European processor IP, illustrating complete foreign stack dependency.

Selected answer: EAL2 Value 71 SEAL 2

Notes: Nine holds ISO 27001/9001 directly; SOC 1/2 and PCI DSS only via data center partner. Lacks cloud-specific ISO 27017/27018, CSA STAR, C5, or EUCS.

Evidence

• European Cloud – Nine Provider Overview other 3. October 2026
  Third-party provider overview noting Nine's ISO 27001/9001 certifications, FINMA Circular 2008/7 compliance, and Swiss data center locations.
  Relevance: Confirms FINMA compliance capability and provides independent overview of Nine's certification and compliance posture.
• Nine Internet Solutions AG – Official Certifications other 3. October 2026
  Nine's official certifications page listing ISO 27001, ISO 9001, and ClimateCare. Data center partners hold SOC 1/2, PCI DSS, FINMA ISAE 3000, ISO 22301, and Tier IV.
  Relevance: Directly lists all certifications held by Nine and its data center partners, showing the gap between direct and partner-held certifications.
• Swiss Made Software — Nine Internet Solutions AG Profile other 2. October 2026
  Swiss Made Software directory profile of Nine as a leading Swiss managed service provider, ISO-certified, ~40 employees, led by CEO Thomas Hug, with no mention of external investors.
  Relevance: Independent verification of Nine's certification claims from the Swiss Made Software industry label body.

Selected answer: 3. Moderate compliance to some well-know EU Regulations (controls exist but gaps remain; compliance not fully demonstrated) Value 71 SEAL 4

Notes: Nine demonstrates GDPR compliance and ISO 27001/9001 certification, but no evidence of NIS2 or DORA compliance. Gaps remain for key EU frameworks.

Evidence

• Nine Internet Solutions AG – Commitment to Data Protection other 3. October 2026
  Nine's data protection commitment page detailing GDPR compliance measures: DPO appointment, DPA, internal process changes, and Swiss nFADP alignment.
  Relevance: Demonstrates GDPR compliance with DPA, data protection officer, and internal processes, but does not address NIS2 or DORA.
• Nine Internet Solutions AG – Official Certifications other 3. October 2026
  Nine's official certifications page listing ISO 27001, ISO 9001, and ClimateCare. Data center partners hold SOC 1/2, PCI DSS, FINMA ISAE 3000, ISO 22301, and Tier IV.
  Relevance: Confirms independently audited ISO 27001 and FINMA-related compliance, but no NIS2 or DORA certifications are listed.
• Swiss Made Software — Nine Internet Solutions AG Profile other 2. October 2026
  Swiss Made Software directory profile of Nine as a leading Swiss managed service provider, ISO-certified, ~40 employees, led by CEO Thomas Hug, with no mention of external investors.
  Relevance: Third-party verification of ISO certifications and Swiss hosting label, providing independent confirmation of Nine's compliance posture.

Selected answer: 4. The entire incident lifecycle is handled by teams operating exclusively within the EU. Threat intelligence and incident data obtained mostly via EU sources Value 107 SEAL 3

Notes: Nine's entire incident lifecycle is handled by Zurich-based teams under Swiss jurisdiction. No ENISA participation found; threat intel sources not publicly detailed.

Evidence

• CSIRTs Network — EU CSIRTs Network (powered by ENISA) other 3. October 2026
  Official portal of the EU CSIRTs Network, established under NIS/NIS2 Directive, enabling cross-border incident information sharing among EU member states, powered by ENISA.
  Relevance: No evidence found of Nine participating in ENISA's CSIRT network or information sharing frameworks, ruling out Option 5 which requires active ENISA participation.
• Nine — Expertise Page other 2. October 2026
  Describes certified engineers (CKA, Google Cloud Architect), 24/7 emergency on-call service, multi-level support system all based in Zurich, Switzerland.
  Relevance: Shows the full incident response lifecycle is handled by Swiss-based teams with no escalation to non-EU or foreign teams, supporting Option 4 over Options 2 and 3.
• Security — Nine Internet Solutions AG other 2. October 2026
  Nine's security page covering encryption at rest and in transit, zero trust architecture, FINMA compliance, and ISO 27001/9001 certifications.
  Relevance: Confirms incident handling is embedded in ISO 27001-certified operations conducted exclusively from Switzerland, with no mention of escalation to non-EU teams.

Selected answer: 4. Customers have full direct access to their security monitoring and logs which are stored in the EU Value 107 SEAL 3

Notes: Nine Cockpit, nctl CLI, and Grafana give customers full direct log/monitoring access. Data stored in Switzerland (EU adequacy). No evidence of immutable logs.

Evidence

• Audit Logging — Nine Kubernetes Engine (NKE) Documentation other 2. October 2026
  Official Nine documentation for NKE audit logging. Logs are optional, pushed to Loki/Grafana, set to Metadata level only, and require customer setup via API/kubectl.
  Relevance: Shows customers get direct access to audit logs through Grafana/Loki, not just periodic reports. Enables direct oversight of security-relevant logging. Matches existing evidence ID 777.
• Monitoring and Logs — Deploio Guides (Nine Cockpit) other 3. October 2026
  Documents how customers access application logs via Nine Cockpit or nctl CLI with filtering, plus metrics dashboards and on-demand Grafana provisioning for custom monitoring.
  Relevance: Demonstrates full direct customer access to logs and monitoring through portal and CLI, beyond basic reporting. Customers can provision own Grafana for customized oversight.
• Security — Nine Internet Solutions AG other 2. October 2026
  Nine's security page covering encryption at rest and in transit, zero trust architecture, FINMA compliance, and ISO 27001/9001 certifications.
  Relevance: Confirms security operations and logging are hosted in Swiss data centers with ISO 27001 controls. Switzerland has EU data adequacy, supporting sovereignty of stored logs. Matches existing evidence IDs 775/778/793.

Selected answer: 3. Moderate compliance - GDPR/NIS2-aligned reporting procedures in place with vulnerabilities and breaches communicated within mandated timelines; CSIRT cooperation available but not real-time Value 71 SEAL 2

Notes: Nine has ISO 27001-certified incident handling and GDPR-aligned breach reporting to supervisory authorities per TOMs, but no real-time CSIRT data sharing or proactive vulnerability disclosure program found.

Evidence

• NIS2 Directive Article 23: Reporting Obligations other 3. October 2026
  Full legal text of NIS2 Article 23 detailing mandatory incident reporting timelines: 24-hour early warning, 72-hour notification, and 1-month final report to CSIRTs.
  Relevance: Provides EU regulatory benchmark for incident reporting timelines and CSIRT cooperation requirements, against which Nine's Swiss-focused procedures show alignment gaps for real-time EU CSIRT sharing.
• Security — Nine Internet Solutions AG other 2. October 2026
  Nine's security page detailing ISO 27001/9001 certifications, zero trust architecture, least-privilege IAM, operational monitoring, and documented TOMs for audit support.
  Relevance: Confirms ISO 27001-certified incident handling and FINMA compliance, supporting moderate compliance level for structured incident management without EU CSIRT real-time sharing.
• Technical and Organizational Measures (TOMs) – Nine Internet Solutions AG other 3. October 2026
  Nine's formal TOMs document includes an Incident Response Management section with documented procedures for detecting, reporting, and handling security incidents, involving ISO and Data Protection Officers.
  Relevance: Directly evidences Nine's incident response and breach reporting processes, showing documented procedures for reporting to supervisory authorities but no real-time CSIRT integration or NIS2-specific timelines.

Selected answer: 3. Moderate Autonomy - security patches are deployed with sufficient notice to the customer and testing is possible, except for zero-day patching Value 71 SEAL 4

Notes: Nine deploys patches on its schedule with advance notice for disruptive updates; time-critical zero-day patches applied outside maintenance windows, limiting customer control.

Evidence

• Swiss Made Software — Nine Internet Solutions AG Profile other 2. October 2026
  Swiss Made Software directory profile of Nine as a leading Swiss managed service provider, ISO-certified, ~40 employees, led by CEO Thomas Hug, with no mention of external investors.
  Relevance: Confirms Nine fully manages security patching for provided software, indicating customer has moderate autonomy with provider-controlled patch deployment schedules.
• Weekly Maintenance Window — Nine.ch Docs other 3. October 2026
  Defines scheduled maintenance windows for security updates; Nine reserves right to apply time-critical security updates outside these windows without standard notice.
  Relevance: Shows Nine controls patch deployment timing, including exception for zero-day patches applied outside maintenance windows, matching 'except for zero-day patching' criterion.
• What Does the Server Management Include? — Nine.ch Docs other 3. October 2026
  Details Nine's managed server patching: security patches applied continuously, customers notified in advance for disruptive updates, weekly maintenance restarts without individual notice.
  Relevance: Directly describes Nine's patching autonomy model: patches deployed on Nine's schedule with advance notice for disruptions, but customers cannot independently deploy infrastructure patches.

Selected answer: 3. Partial control by independent entities on the data provided by the vendor Value 71 SEAL 1

Notes: DPA grants audit rights for records but prohibits on-site audits; scope limited to documentation, not premises. Swiss jurisdiction adds barriers for EU entities.

Evidence

• Nine — Data Processing Agreement (DPA) other 2. October 2026
  DPA lists sub-processors: Google Cloud EMEA (Ireland), Cloudflare (US), Nine Canada, with SCCs for third-country transfers.
  Relevance: Directly defines audit scope: customers may commission independent auditors for records review, but on-site audits are prohibited and scope is limited to documentation, restricting full audit access.
• Nine Internet Solutions AG – Official Certifications other 3. October 2026
  Nine's official certifications page listing ISO 27001, ISO 9001, and ClimateCare. Data center partners hold SOC 1/2, PCI DSS, FINMA ISAE 3000, ISO 22301, and Tier IV.
  Relevance: Shows multiple independent audits at data center level, but these are facility-level certifications, not customer-initiated audits with full access to Nine's security and compliance operations.
• Nine.ch ISO/IEC 27001 Certificate 2024 other 3. October 2026
  ISO/IEC 27001:2022 certificate issued by Swiss Safety Center AG (TÜV) to Nine Internet Solutions AG, valid Dec 2024–2027, covering PaaS/SaaS development and operation.
  Relevance: Confirms Nine undergoes independent external ISMS audits via certification body, but these are vendor-commissioned, not customer-driven, supporting partial rather than full audit access.

Selected answer: PUE < 1.5 + roadmap Value 125 SEAL 4

Notes: NTT fleet PUE 1.38; ColoZüri highly efficient w/ cold aisle, free cooling, heat recovery. Nine has PUEDA roadmap & annual CO2 offsetting. No own PUE published.

Evidence

• Nine — Infrastructure other 2. October 2026
  Details Nine's two Swiss data centers (ColoZüri, NTT Zürich 1) with redundant power, cooling, and connectivity. No mention of hardware suppliers or component origins.
  Relevance: Documents Nine's energy-efficient infrastructure design and sustainability practices including cold aisle containment and renewable energy at both data centers.
• NTS Workspace AG – Further Increase Energy Efficiency other 3. October 2026
  NTS Workspace news page detailing participation in Switzerland's federal PUEDA energy efficiency program, implementing cold aisle containment, free-cooling, and heat recovery at colozüri.ch.
  Relevance: Shows ColoZüri's roadmap of continuous energy efficiency improvements through the PUEDA program, with concrete optimization measures identified and implemented.
• NTT DATA – Environment Data (PUE & Energy Metrics) other 3. October 2026
  NTT DATA Group's official environmental data page reporting fleet-wide data center PUE of 1.38 (FY2024), 60% renewable energy share, and carbon neutrality targets by 2040.
  Relevance: Provides PUE proxy (1.38) for NTT Zurich 1 data center operated by Nine, plus NTT's sustainability roadmap with measurable improvement targets.

Selected answer: No policy Value 0 SEAL 0

Notes: No documented circular economy or hardware reuse/recycling program found; Nine has environmental certifications but no end-of-life hardware lifecycle policy.

Evidence

• Nine — Official Website other 2. October 2026
  Nine's homepage showcases products, TechTalk events, blog, and support channels. No customer advisory board, feedback portal, or EU stakeholder governance mechanism is mentioned.
  Relevance: Demonstrates energy sustainability efforts but no evidence of hardware reuse, refurbishment programs, or responsible end-of-life hardware treatment practices.
• Nine Internet Solutions AG – Official Certifications other 3. October 2026
  Nine's official certifications page listing ISO 27001, ISO 9001, and ClimateCare. Data center partners hold SOC 1/2, PCI DSS, FINMA ISAE 3000, ISO 22301, and Tier IV.
  Relevance: Shows environmental management certifications exist but no hardware reuse, refurbishment, or circular economy program is documented for end-of-life hardware treatment.
• Nine Internet Solutions AG — Legal Information / Disclaimer other 2. October 2026
  Official legal page confirming Nine is a Swiss stock corporation (AG) in Zurich, 100% employee-owned, with a wholly-owned Canadian subsidiary — no EU/EEA entities.
  Relevance: Confirms general environmental compliance but contains no mention of hardware recycling, circular economy practices, or end-of-life hardware management policies.

Selected answer: Annual report Value 125 SEAL 2

Notes: Nine discloses annual CO₂ compensation via myclimate and renewable energy usage on its infrastructure page, but lacks detailed EU methodology or audited sustainability reporting.

Evidence

• «Digital = Emission-Free?» — Nine Blog (myclimate) other 3. October 2026
  Guest blog post by myclimate on Nine's website discussing ICT sector emissions (2-4% of global CO₂) and detailing Nine's annual offsetting of 189.5 tonnes CO₂ worth CHF 4,738 via certified climate projects.
  Relevance: Provides specific annual CO₂ figures and Nine's partnership with myclimate for transparent CO₂ accounting, but lacks Scope 1/2/3 breakdown or water usage metrics required for detailed EU methodology.
• Nine — Infrastructure other 2. October 2026
  Details Nine's two Swiss data centers (ColoZüri, NTT Zürich 1) with redundant power, cooling, and connectivity. No mention of hardware suppliers or component origins.
  Relevance: Directly shows Nine's annual disclosure of renewable energy use and CO₂ compensation, supporting 'Annual report' level of environmental reporting rather than detailed EU methodology.

Selected answer: Only green EU energy supplies Value 250 SEAL 4

Notes: Both Swiss data centers use exclusively green energy: ColoZüri 100% renewable, NTT CO2-neutral. All energy is European-sourced and renewable/low-carbon.

Evidence

• Nine — Infrastructure other 2. October 2026
  Details Nine's two Swiss data centers (ColoZüri, NTT Zürich 1) with redundant power, cooling, and connectivity. No mention of hardware suppliers or component origins.
  Relevance: Confirms both data centers are in Switzerland with green energy practices and annual CO2 offsetting through certified myclimate projects.
• Nine — Renewable Energy Documentation other 2. October 2026
  Nine's documentation page confirming two data centers: one powered by 100% renewable electricity (NTS/Colozüri) and one using CO₂-neutral electricity (NTT/E-Shelter), with links to upstream sustainability reports.
  Relevance: Directly states Nine's energy sourcing: 100% renewable at one DC, CO2-neutral at the other — both green and European-sourced.
• NTT Global Data Centers 2026 Sustainability Report other 3. October 2026
  NTT's sustainability report covering 72% renewable energy fleet-wide, net-zero by 2040 target, and 1.35 average PUE across EMEA including Zurich.
  Relevance: Validates NTT Zurich data center's CO2-neutral claim with 72% renewable energy and net-zero commitments across NTT's EMEA footprint.