Your Zurich revFADP audit, passed first try
You need a WordPress build that survives a Swiss revFADP review on day one, with every plugin inventoried for data export risk and a consent layer that holds up under a Zurich data protection officer’s scrutiny. We deliver that package: audit-ready WordPress, documented technical and organisational measures aligned to the nDSG, and FINMA-aware controls for clients on the fintech side of the lake.
The Swiss rulebook touching the technical layer covers revFADP / nDSG in force since 2023-09-01, FINMA cybersecurity supervision for regulated fintech and asset managers, and FADP transfer rules for data leaving the country toward non-Adequate destinations. Knowing where these rules end and pragmatic engineering begins is what separates a Zurich-relevant developer from someone who just speaks WordPress.
| Regulation | What it covers | What we do |
|---|---|---|
| revFADP / nDSG | National data protection in force since 2023-09-01 | Documented processing register, 2FA on wp-admin, encrypted backups |
| FINMA cybersecurity | Supervision of regulated fintech and asset managers | Hardened WAF, dependency SBOM, monitored vulnerability response |
| FADP transfer rules | Data leaving CH toward non-Adequate countries | Swiss hosting by default, documented transfer assessments, no silent third-country loaders |
WordPress development for Zurich and Switzerland
A Zurich SME website is rarely just a brochure. It usually sits between a Bexio or Abacus accounting backend, a TWINT or PostFinance Pay checkout, a multilingual editorial team writing in two or three official languages, and a revFADP privacy regime that has been in force since 1 September 2023. We build WordPress sites that fit that environment, not a generic “Swiss premium quality” template.
Most of our work for Greater Zurich Area clients sits in three buckets: corporate sites for service firms in finance, insurance, and consulting; WooCommerce stores selling into the CH-DE and CH-FR markets; and Mittelstand multilingual sites that need to ship in DE-CH, FR-CH, and sometimes IT-CH without the editorial team duplicating effort.
When WordPress fits and when it does not
WordPress is rarely the wrong answer for a Swiss SME content site, a service firm, or a B2B lead-generation site under a few thousand SKUs. It becomes a poor fit when the constraint is regulated fintech under direct FINMA cybersecurity guidance, where audit trail expectations and operational risk classification push you toward a hardened internal stack rather than a public-facing CMS.
For commerce, the trade-off is less clean. WooCommerce with Datatrans, Wallee, or Saferpay handles most CH-DE and CH-FR shops just fine. Once the catalogue moves into a few thousand SKUs with ERP-driven stock from Abacus or SAP, Shopify Plus with a Bexio integration starts to remove enough operational pain to be worth the licence. For B2B with quote-based pricing, contract pricing per customer, and complex tax rules across CH/EU, BigCommerce or a custom build can outpace WooCommerce. We will tell you which side of that line your project sits on before we start.
Swiss payment integrations we work with
The Swiss payment landscape is not the European one with a CHF symbol on it. The integrations that actually matter:
- TWINT, used by roughly two thirds of the Swiss adult population, integrated through Datatrans, Wallee, or directly via the merchant API.
- Swiss QR-bill (QR-Rechnung), the default invoicing standard since 2022, generated server-side and embedded in WooCommerce orders or Bexio sync.
- PostFinance Pay and PostFinance Card, still the dominant rails for an older Mittelstand customer base.
- Datatrans (Zurich), Wallee (St. Gallen), and Saferpay (Worldline Schweiz) as the three orchestration gateways most CH agencies default to.
- Stripe CH for international SaaS pricing and Klarna CH for B2C “buy now pay later”.
- PEAX for digital mailbox integration on B2B portals.
For shipping, Swiss Post (Die Post) covers about 70 percent of e-commerce volume, with DPD CH, DHL CH, and Planzer handling parcel and palletised flows. Real-time rate calculation and label printing through these carriers is configured per shop, not bolted on.
revFADP, FINMA, and what compliance actually means
The revised Swiss Federal Act on Data Protection (revFADP / nDSG) entered into force on 1 September 2023. It is GDPR-aligned but not identical: stricter on profiling consent, lighter on documentation thresholds for SMEs, and explicit about data exports outside the EEA. For most WordPress sites this means: a documented privacy policy in each language version, a cookie consent flow that defaults to refused, a register of processing activities, and clarity on which sub-processors (analytics, email, CDN) sit outside Switzerland.
For fintech and InsurTech sites in Crypto Valley Zug or the Lausanne EPFL spinoff scene, the FINMA cybersecurity guidance adds expectations around incident reporting, third-party risk, and operational resilience that a public marketing site usually does not need to meet directly, but its connected portals do. We flag this on day one rather than at launch.
Hosting in Switzerland
Most of our Zurich clients want CH-resident hosting for at least the production database, even when the marketing site itself sits on a CDN edge. The realistic options:
- Cyon (Basel), Hostpoint (Rapperswil-Jona), Infomaniak (Geneva), and Metanet (Zurich) for managed shared and VPS hosting with CH datacentres.
- Datacentres in Zurich Brüttisellen, Glattbrugg, and Rumlang for colocated workloads.
- Cloudflare and Fastly edges for global delivery, with the origin in CH.
Infomaniak is the default choice for clients who want explicit Swiss data sovereignty and a green-energy story; Hostpoint and Cyon are the workhorses for SME WooCommerce; Metanet covers the regulated end with ISO 27001 documentation.
Multilingual reality: four languages, three editorial workflows
Switzerland has four official languages: German (63 percent), French (23 percent), Italian (8 percent), and Romansh (0.5 percent in Graubünden). Most Zurich SMEs ship in two: DE-CH and EN. Mittelstand firms selling nationally ship in three: DE-CH, FR-CH, IT-CH. Almost no one ships Romansh outside of Graubünden cantonal sites and tourism operators.
The stacks we use:
| Languages shipped | Plugin stack | Editorial workflow |
|---|---|---|
| 2 (DE-CH plus EN) | Polylang | Manual translation, single editor per language |
| 3 to 4 (DE-CH, FR-CH, IT-CH, optional RM) | WPML plus WPML String Translation plus WPML Translation Management | Per-language editor, translation memory shared |
| 4 plus marketing automation | WPML plus DeepL connector | Drafts machine-translated, human reviewed before publish |
One trap: DE-CH is not DE-DE. Swiss German written form drops the eszett (ß) and writes “ss” instead, uses Helvetisms (Velo for bicycle, Tram for streetcar, Heugümper for grasshopper, parkieren for to park, grillieren for to grill), and follows the Schweizer Duden rather than the Duden Mannheim. If your translation team or DeepL pipeline outputs DE-DE by default, the result reads as foreign even when the grammar is correct. We configure the stack to flag this.
Hreflang implementation that does not break
The single most common SEO defect we inherit on Swiss multilingual sites is broken or missing hreflang. The minimum viable setup for a CH site shipping DE-CH plus FR-CH plus IT-CH plus EN:
de-CH,fr-CH,it-CH,en(oren-CHif you target Swiss English specifically)x-defaultpointing to the language selector or the DE-CH version- Reciprocal links: every language version links to all others including itself
- Sitemap-level
xhtml:linkannotations as a redundancy layer
Polylang and WPML both emit hreflang correctly when configured. The breakage is almost always in custom code that strips the <head> annotations on cached pages, or in CDN rules that vary by cookie rather than by URL.
Our development process
Discovery, architecture, build in two-week sprints, staging review at each sprint end, launch with DNS cutover during low-traffic windows for the CH market (typically Tuesday or Wednesday morning CET). Code in Git with feature branches per scope item, deployed via SSH or GitHub Actions to staging then production. Every project ships with a written handover including the plugin inventory, the renewal calendar for paid licences, the backup retention policy, and the on-call escalation path.
Pricing
All pricing is individual and tied to project scope. We work on fixed-price scopes for well-defined builds, time-and-materials for ongoing work, and monthly retainers for maintenance plus measured improvement. Contact us for a scoped proposal for your Zurich or Swiss WordPress project.
