AI & automation
AI with your data in Switzerland – Azure OpenAI under your control
Client data does not belong in public chat tools. How SMEs can use Azure OpenAI in Microsoft Foundry and control where their prompts are processed.
Why public chat tools are risky for client data
For example: in a fiduciary firm, staff want help summarising long documents and preparing replies to client enquiries. If they use personal accounts in public chat tools, client data leaves the controlled environment. Depending on the provider and settings, inputs may be stored or used to improve the service, and the firm has neither a contract nor oversight. Data protection law still applies: the FDPIC states that the Federal Act on Data Protection applies directly to AI-supported processing.
The answer is a controlled alternative. If your people mainly work in Outlook, Word and Teams, Microsoft Copilot is often simpler. Azure OpenAI fits when you build your own application for your documents and processes, with precise control over where data is processed.
What Azure OpenAI does differently
Azure OpenAI is part of Microsoft Foundry, Microsoft's AI platform on Azure (formerly Azure AI Foundry). You deploy a model in a Foundry resource within your own Azure subscription. According to Microsoft:
- Microsoft hosts the models in Azure; they do not interact with services operated by OpenAI, such as ChatGPT.
- Prompts and responses are not available to other customers or to OpenAI.
- They are not used to train foundation models without your permission, and the models do not store prompts.
- Processing is governed by Microsoft's Data Protection Addendum.
The details are on Microsoft's data, privacy and security page.
Where your prompts are processed
When you deploy a model, you choose a deployment type. Stored data, such as uploaded files, always stays in the Azure geography of your resource. Where prompts are processed depends on the type:
| Type | Where prompts are processed | Suitable when |
|---|---|---|
| Standard | Within the Azure geography of the resource – for Switzerland North, in Switzerland | processing must stay in Switzerland |
| Data Zone (EU) | Within the EU Data Boundary, i.e. in EU and EFTA countries | processing in Europe is enough |
| Global | In any Azure region where the model runs | there are no location requirements |
Switzerland has two Azure regions: Switzerland North in Zurich and Switzerland West in Geneva. Access to Switzerland West is restricted and meant for scenarios such as disaster recovery, so in practice Switzerland North is the obvious choice.
The catch is model choice. New models appear first as Global, then as Data Zone and last in the regional variant, with no guaranteed date. As of October 2026, Microsoft lists mainly older models such as GPT-4.1, GPT-4.1 mini and GPT-4o for the Standard type in Switzerland North, plus embedding models that prepare text for search. Newer generations are mostly available there only as Data Zone or Global. Check the current availability table before each project, as it changes constantly. With Azure Policy – binding rules for your subscription – you can block unwanted types such as Global.
Whether processing in Europe or worldwide is acceptable depends on, among other things, the Federal Act on Data Protection, client contracts and confidentiality obligations. Clarify this before choosing; this article is not legal advice.
Abuse monitoring: what may be stored
Two different safeguards apply. Guardrails (previously content filters) check prompts and responses for harmful content in real time. Abuse monitoring looks for patterns suggesting breaches of the usage rules. Flagged prompts and responses are first reviewed automatically, including by AI models; in some cases, authorised Microsoft employees look at them. The data stored for this stays in the Azure geography of your resource. Microsoft's current pages state no fixed retention period; if that matters to you, ask Microsoft.
If you cannot permit storage or human review, you can apply for modified abuse monitoring. At present, however, this is only open to customers and partners managed by a Microsoft account team or in an eligible programme. If your company does not qualify, plan on standard monitoring and check whether it fits your confidentiality obligations.
Some features also store data deliberately, such as conversation history via the Responses API or uploaded files. This stays in your resource in the same geography and can be deleted at any time.
Access, networking and costs
Securing access and the network
- Microsoft Entra ID instead of API keys: people and applications get access through roles such as "Cognitive Services User" rather than fixed keys, which can then be disabled.
- Managed identities: applications running in Azure authenticate without stored passwords or keys.
- Private endpoints: switch off public network access so the resource is reachable only from your virtual network or via VPN.
- Separation and logging: separate test from production, grant minimal rights, log access.
Understanding costs and quotas
You pay per token – a small piece of text, roughly a word or part of one – with separate rates for input and output. The price depends on the model and deployment type; Microsoft describes Global Standard as the lowest-priced option. Pay-per-token billing suits fluctuating use; reserved capacity ("provisioned" deployments) is designed for consistently high volumes.
Quotas limit how many tokens and requests per minute a subscription can process, and Microsoft raises them automatically as usage grows. Set a budget with a cost alert in the Azure portal, use smaller models for simple tasks and limit how much text each request sends.
What you can build
- Questions over your own documents: Azure AI Search indexes approved material such as policies, templates or guides, and the model answers with references to its sources. Azure AI Search is available in Switzerland North and Switzerland West. Only index what every user of the application may see, or reflect permissions in the index.
- Draft email replies: an assistant classifies incoming enquiries and suggests a reply; a person reviews and sends it.
- Extracting data from documents: Azure Document Intelligence in Foundry Tools recognises text and fields in invoices, receipts or forms, with prebuilt or custom models. Check its availability in your region.
For example: a fiduciary firm uses Document Intelligence to read incoming receipts, a language model suggests the client mandate each belongs to, and a member of staff confirms it. Every step remains traceable.
How to get started
- Choose one use case with a clear benefit and a manageable set of data.
- Classify the data and decide whether processing must stay in Switzerland or Europe is enough.
- Create a Foundry resource in Switzerland North, choose a suitable model and deployment type, and block unwanted types with Azure Policy.
- Manage access with Entra ID and managed identities, switch off public access and disable keys.
- Decide whether standard abuse monitoring is acceptable for your data.
- Build a prototype with test data and evaluate it with real questions from daily work.
- Monitor budget, quotas and usage.
- Document purpose, data sources and responsibilities, and inform staff; for high-risk processing, the FADP requires a data protection impact assessment.
We plan and build such solutions in your Azure environment, from architecture to a first prototype – see AI & automation and cloud & infrastructure. For how fiduciary firms can use AI sensibly, read AI for fiduciary firms. For a first assessment of your use case, get in touch.