The Sovereignty Gap

Digital sovereignty is one of those phrases that sounds solid until you try to measure it.

The Swiss Confederation now treats digital sovereignty as a strategic concern. Its own data-centre strategy explicitly connects sovereign operation with the ability to run critical computing under its own control, while the federal cloud strategy deliberately combines government infrastructure, private clouds and public-cloud providers according to risk and sensitivity.¹²

That raises a simpler question.

Where does Swiss politics itself actually run?

Not metaphorically. Technically.

Who delivers the websites of the parties represented in the National Council? Who controls their DNS? Who receives their email? Who operates the application origin behind a CDN? And when an infrastructure provider carries a Swiss name, is it actually Swiss-controlled?

I audited the public infrastructure of all ten parties represented in the Swiss National Council.³⁴ The result is not a ranking of political virtue, and it is not an accusation of hypocrisy. It is something more useful: a small x-ray of the dependency structure beneath Swiss political communication.

And the main finding is not that Swiss parties use foreign technology. Everyone already knows that modern digital systems are international.

The more interesting finding is that the word “Swiss” becomes surprisingly slippery once you move from where a server appears to sit, to who operates the service, to who ultimately controls the company or infrastructure underneath it.

That difference is the sovereignty gap.

The first mistake: asking where the server is

The easiest version of this research would have been a map.

Resolve a domain. Find an IP address. Geolocate the IP. Put a Swiss flag next to anything that lands in Zurich, Geneva or Basel.

That would also have been misleading.

A server can be physically located in Switzerland while the infrastructure is controlled by a foreign-owned company. A Swiss operating company can belong to an international parent. A Swiss brand can resell infrastructure operated by somebody else. And a US-controlled CDN edge can sit in front of an application that is actually hosted by a Swiss-controlled provider.

Those are not edge cases. They are normal properties of modern internet architecture.

The methodology therefore separates three questions:

1. Location — where does an observed endpoint appear to be physically located?
2. Operator — which company operates the service?
3. Control — who ultimately controls the provider or the infrastructure underneath it?

Only the third question determines the control classification used in the core score.

Physical location is reported, but it does not create a sovereignty point.

That choice matters because otherwise the research would reward geography even when corporate or operational control sits elsewhere.

What we actually measured

The population is intentionally boring: every party represented in the Swiss National Council, no additions and no ideological filtering. The order follows the 2023 National Council vote share rather than the result of this study.³⁴

The technical measurement was performed on 7 October 2026. Provider ownership and control were reviewed on 8 October 2026. Infrastructure changes, so this is a timestamped observation, not a permanent property of any party.

The work was inspired by the public methodology of staysin.eu, which examines hosting, DNS, mail, CDN and external services to assess whether infrastructure remains under EU control.⁵ But simply replacing “EU” with “Switzerland” would have produced a poor Swiss methodology, so several changes were made.

Four core components

For each party we scored a small set of architectural components:

• Web delivery — the provider answering the public website request.
• DNS — the infrastructure operating the authoritative nameservers.
• Mailbox / MX — the provider receiving inbound email.
• Origin hosting — only when the application origin behind a separate edge/CDN could be attributed with sufficient evidence.

The formula is deliberately transparent:

Swiss core score = Swiss-controlled known applicable components / known applicable components

A direct-hosted website does not receive two points for “web” and “origin”; that would double-count the same infrastructure relationship. A separate CDN and a separately identifiable origin can both count because they represent different control layers.

Unknown means unknown

This may be the most important rule in the whole project.

If ownership could not be positively established, the provider was not casually treated as Swiss because it had a Swiss legal entity, Swiss address or .ch domain.

It became UNKNOWN_CONTROL.

Likewise, if a CDN concealed the application origin and passive evidence was insufficient to attribute it, the origin remained unknown.

Unknown components are shown in grey and excluded from the denominator. They are never silently converted into foreign or Swiss.

Edge is not origin

Cloudflare is the best illustration.

SVP, SP, Die Mitte and the Greens all use Cloudflare at the public edge and for DNS in the measured setup. But that does not prove that Cloudflare hosts the application itself.

Passive OSINT allowed the origin behind the SP site to be attributed to Nine, and the origin behind the Greens to cyon. The corresponding origins for SVP and Die Mitte could not be established with sufficient confidence and therefore remain unknown.⁶

MX is not SPF

Email required another distinction.

An MX record tells us which infrastructure receives inbound mail. SPF tells us which systems are authorised to send mail on behalf of the domain.

A Microsoft SPF include might represent an authorised sender, a CRM workflow or newsletter tooling. It does not automatically mean Microsoft hosts the mailbox. Therefore MX participates in the core score; SPF senders are reported separately.

Third-party services are separate

Analytics, fonts, tag managers, video embeds and other browser-loaded services were observed before consent and after rejecting optional tracking where a consent manager existed.

They do not enter the core score.

That is intentional. Otherwise a complex website with ten optional services would be punished ten times more than a simple website, even if the critical infrastructure of both sites were identical.

Instead, external dependencies are their own dimension.

This becomes important later.

The result

Across the ten parties, the model produced 30 known core infrastructure components and 4 unknown components.

Of the known components:

• 8 were Swiss-controlled
• 22 were foreign-controlled

That makes roughly 26.7% of the known core components Swiss-controlled across the sample. This aggregate is descriptive only: it is not election-weighted, not a party average, and not a claim that every component has identical strategic importance.

The party-level picture is more useful:

The detailed evidence, provider classifications, claim register and reproducible public dataset are part of the accompanying research release.⁷⁸⁹

A few things immediately stand out.

First, the two highest percentages in this narrow technical indicator belong to regional parties: Lega and MCG. That is not evidence of greater political commitment to digital sovereignty. It simply reflects the infrastructure they happened to use at the measurement date.

Second, several of the largest national parties depend heavily on the same global providers. Cloudflare appears as the web edge for four parties. Microsoft 365 appears as the mailbox provider for four parties.

Third, a score of zero does not always mean the same thing. GLP and EDU have three known foreign-controlled components. FDP has only one known component in the denominator because the control of two Swiss operating brands could not be positively established. SVP and Die Mitte each have a hidden origin that remains unknown.

The fraction matters more than the percentage.

That is why every result is shown as n of d known, with unknown components displayed explicitly.

The most interesting case is not American. It is Swiss.

METANET is where this research became more interesting than a simple list of foreign cloud providers.

METANET AG is a Swiss operator. Its infrastructure is visible in Switzerland. Its brand is Swiss.

But METANET sits inside group.one, a European hosting group backed by Cinven and the Ontario Teachers’ Pension Plan. Public announcements describe the combination of group.ONE and dogado — whose brands include METANET — as acquired and financed by Cinven and Ontario Teachers, alongside founder and management shareholders.¹⁰¹¹

Under this study’s definition, that makes the infrastructure foreign-controlled, despite the Swiss operating company.

That distinction affects GLP and EDU directly.

It also affects Kreativ Media. Kreativ Media is a Swiss-facing DNS brand, but its authoritative nameserver infrastructure resolves into METANET’s AS21069. The score follows infrastructure control rather than the reseller label.

This is precisely the kind of case that gets lost when sovereignty is reduced to a data-centre address.

The opposite problem appeared with FDP.

OpenBusiness / SwissCenter and WNG are Swiss operating entities in the observed stack. But we could not establish ultimate ownership control strongly enough from public evidence.

The tempting answer would have been to colour them green.

We did not.

They remain unknown.

That may make the result less dramatic, but it makes the research stronger. Absence of evidence of foreign control is not evidence of Swiss control.

The foreign edge can hide a Swiss core

The SP and Greens demonstrate the inverse problem.

From the outside, both sites look strongly foreign-controlled at first glance: Cloudflare sits at the edge and operates authoritative DNS.

But the application origin behind that layer could be resolved through passive evidence.

For SP, the evidence pointed to Nine Internet Solutions AG. Nine states that it is 100% employee-owned, and its hosting infrastructure is operated in Switzerland.¹²

For the Greens, the origin could be attributed to cyon. The cyon classification is deliberately more cautious: the most recent public ownership event supports Swiss control, but the current AG shareholder register is not publicly observable, so the confidence is medium rather than absolute.¹³

This is why “Cloudflare site” is not a sufficient description of either architecture.

A CDN is a delivery layer. It may be strategically significant. It may also conceal a very different infrastructure relationship behind it.

The architecture has layers; the sovereignty analysis has to have layers too.

The score is not the whole story

Here is the part I like most about the data.

Lega has 3 of 3 known core components under Swiss control. Yet its website still contacted five foreign-controlled providers before consent in the measured browser run.

The Greens, by contrast, had only 1 of 4 Swiss-controlled core components but no foreign third-party provider observed before consent in that run.

EDU scored 0 of 3 for its core infrastructure and still loaded no foreign third-party provider before consent.

These are not contradictions.

They reveal that we are measuring two different things:

• Who controls the critical infrastructure layers?
• Which external services receive requests when a visitor opens the website?

Google appeared as a pre-consent dependency on six of the ten websites. Other observed providers included Meta, TikTok, Automattic, unpkg and jsDelivr.⁷

None of that is, by itself, a legal conclusion. The browser observation does not tell us whether a particular request violates Swiss data-protection law, whether personal data was transferred, or whether a consent implementation was compliant.

It tells us something narrower and still useful:

what external infrastructure was contacted during the measured browsing state.

That distinction is why this project is not a privacy compliance audit.

This is not a hypocrisy index

It would be easy to turn this into a partisan graphic.

“Party talks about sovereignty, party uses American cloud.”

That is not what the data proves, and it would waste the more important lesson.

The infrastructure choices of political parties reflect the same market structure that every Swiss SME, association and public institution faces:

• global CDN providers are easy to deploy;
• Microsoft 365 appeared as the mailbox provider for four of the ten parties in this sample;
• web agencies choose familiar stacks;
• DNS is often bundled with hosting or domain services;
• ownership changes after acquisitions;
• reseller relationships hide underlying providers;
• the easiest service to buy is not always the easiest service to classify.

The Swiss federal administration itself does not pursue technological autarky. Its cloud strategy is explicitly hybrid and multi-cloud. The point is to choose the appropriate layer according to risk, sensitivity and operational requirements.²

That is a more mature way to think about sovereignty.

Sovereignty is not isolation. It is knowing where dependence exists, deciding which dependencies are acceptable, and retaining credible alternatives where they matter.

The problem with the word “Swiss”

This study suggests a procurement question that should probably be asked far more often:

When somebody sells us a “Swiss cloud”, which part is Swiss?

The legal entity?

The people operating it?

The data centre?

The ASN?

The software?

The parent company?

The voting rights?

The capital?

The underlying infrastructure supplier?

These answers can point to different countries.

This is why I think the industry needs something more precise than marketing claims about data residency.

We already use software bills of materials to describe the components inside software. A similar idea would be useful for infrastructure:

A sovereignty bill of materials

For any critical digital service, publish a small machine-readable declaration containing:

• operating legal entity;
• ultimate controlling entity or ownership class;
• infrastructure providers;
• authoritative DNS provider;
• mail provider;
• CDN / edge provider;
• primary processing jurisdictions;
• known subcontractors;
• whether services are directly operated or resold;
• confidence and last verification date.

Not because every foreign dependency is unacceptable.

Because unknown dependency is a terrible basis for strategic decision-making.

What the methodology cannot tell us

A defensible result needs to be as explicit about its limitations as it is about its findings.

1. This is a technical indicator, not a legal judgment

The score does not determine compliance with the Swiss Data Protection Act, the GDPR, procurement law, secrecy obligations or sector-specific regulation.

Legal control can involve contracts, organisational safeguards and statutory mechanisms that are not visible from the outside. FDPIC guidance on cross-border transfers is relevant context, but the project deliberately does not convert that legal framework into a binary website compliance verdict.¹⁴

2. Ownership is a research definition of control

Equity control, voting control, operational control and legal jurisdiction are related but not identical.

This study follows ultimate ownership/control where it can be established and infrastructure control when a Swiss-facing reseller depends on another provider. Reasonable experts could choose a different sovereignty definition.

3. Equal weighting is a methodological choice

Web delivery, DNS, mailbox and distinct origin contribute equally when they are known and applicable.

That makes the score transparent, but it does not mean those components are equally important in every threat model. A government security team might assign DNS or origin hosting more weight. A political campaign might consider email more sensitive. A weighted model could be legitimate — but the weights would introduce another subjective choice.

We chose equal weighting because it is visible and reproducible.

4. CDN architectures can have a larger denominator

A directly hosted website usually has three core components: web delivery, DNS and mailbox. If a site uses a separate CDN and the underlying origin can also be resolved, it may have four.

That is intentional: a foreign-controlled edge and a Swiss-controlled origin are two distinct control relationships.

It also means percentages should never be read without the fraction beside them.

5. Origin attribution is imperfect

A CDN is specifically designed to prevent the public internet from talking directly to the origin.

We used passive evidence only. No access controls were bypassed. Where evidence was insufficient, the origin remained unknown.

6. Browser observations are snapshots

Third-party requests can change because of A/B tests, lazy loading, geolocation, consent states or site updates.

The browser results describe what was observed during the scan conditions, not every request the site could ever make.

7. Infrastructure moves

DNS changes. Hosting providers migrate customers. Companies get acquired. Ownership structures change.

That is why the evidence is timestamped and why the public release includes reproducibility tooling.

What I would ask every party — and every public institution

The useful follow-up is not “why do you use Cloudflare?”

It is a short governance checklist:

Do you know who ultimately controls your critical providers?

Can you separate public web delivery from the systems holding sensitive data?

Do you know which foreign providers are contacted before a visitor makes a choice?

Can you replace your DNS, email or hosting provider without rebuilding everything?

Do you have an explicit policy for which workloads require Swiss control, which can remain European, and which can be global?

When you buy a Swiss service, do you verify the ownership and infrastructure chain — or only the address on the invoice?

These are not political questions.

They are architecture questions.

And architecture has a habit of becoming political only after it fails.

The sovereignty gap

The easy version of sovereignty is a flag beside a server.

The real version is messier.

A Swiss company can sit on foreign-controlled infrastructure. A Swiss server can belong to foreign capital. A US-controlled edge can hide a Swiss origin. A website can have a fully Swiss-controlled core and still call multiple foreign services when somebody opens the page.

That is not an argument for digital isolation.

It is an argument for precision.

The most important output of this study is not that Lega scored 100%, that MCG scored 67%, or that several national parties scored zero on their known core components.

The important output is the model underneath those numbers:

location is not operator; operator is not control; core infrastructure is not the same as browser dependencies; and unknown should stay unknown until evidence changes it.

Digital sovereignty is becoming part of Swiss strategy.¹

If we are going to use the phrase seriously, we should be able to describe the architecture seriously too.

That begins with a simple habit:

follow the stack all the way down.

Sources