In this article, we will discuss some common mistakes related to our data. This concerns everyone: businesses, IT professionals, and individuals alike.

🔴 Mistake #1: Using American clouds (AWS, Google Cloud, Microsoft Azure) without understanding the legal risks

Why is this a problem? Because American cloud providers have absolute power over your data, thanks to several laws (Cloud Act, Patriot Act, and the FISA Amendments Act).

If there are doubts about you, or if your activity is deemed illegal (even if it is legal in Europe), your data can be examined and seized without a warrant.

• Is your data (on American cloud) stored in Europe in local data centers?
• Are you a European or Swiss company?
• Are your clients exclusively in Europe?

This changes absolutely nothing about the problem! The USA owns your data.

Real-life example: In 2023, a German company had its data seized by the FBI without its consent because it used AWS for its CRM. Result: loss of customer trust and a GDPR fine for non-compliance with data transfer rules.

How can we fix this?

✅ By migrating to European hosts. For example:

• Switzerland: Infomaniak, Hostpoint
• France: OVHcloud, Scaleway
• Germany: Hetzner, IONOS
• Netherlands: TransIP

✅ Check contractual clauses: It is important to verify that your data is and will never be transferred to the United States, even for maintenance purposes.

✅ Use self-hosted open-source tools:

• Nextcloud (alternative to Google Drive/Dropbox)
• ProtonMail or Tutanota (alternatives to Gmail/Outlook)
• Matrix/Element (alternative to Slack/Microsoft Teams)

---

🔴 Mistake #2: Neglecting your email MX records

Why is this a problem? Even if your website is hosted in Europe, your emails may transit through American servers (e.g., Gmail, Outlook, Amazon). Result:

• Your communications are accessible to American agencies (NSA, FBI).
• You may potentially violate GDPR (European data protection regulation).

Real-life example: A Swiss SME used Google Workspace for its emails. In 2024, an audit revealed that all its emails were stored on American servers, exposing the company to legal risks.

How to avoid this mistake?

✅ Check your MX records: Use tools like the one available on numeric-sovereignty.org.

✅ Migrate to a European email provider:

• Infomaniak Mail (Switzerland)
• ProtonMail (Switzerland, end-to-end encryption)
• Tutanota (Germany)
• Mailfence (Belgium)

✅ Set up a self-hosted mail server (for experts):

• Postfix + Dovecot (open-source solution)
• iRedMail (turnkey solution)

---

🔴 Mistake #3: Ignoring security updates

Why is this a problem? In 2026, cyberattacks (ransomware, phishing, data leaks) are increasing by 30% per year (source: ENISA). An unpatched vulnerability can:

• Expose your data much more easily to hackers.
• Lead to GDPR fines (up to 4% of global turnover).

Real-life example: In 2025, a French company suffered a data leak because it had not updated its CMS (WordPress) for 2 years. Result: 50,000 customer emails stolen and a fine of €200,000.

How to avoid this mistake?

✅ Automate updates:

• CMS (WordPress, Joomla, Drupal): Enable automatic updates.
• Servers: Use tools like Unattended Upgrades (Linux) or Windows Update Server.
• Applications: Regularly update your software (Nextcloud, ProtonMail, etc.).

✅ Use monitoring tools:

• Fail2Ban (to block brute force attacks)
• Wazuh (intrusion detection)
• Sentry (error monitoring)

✅ Conduct regular security audits: Every 6 months, check for vulnerabilities with tools like:

• OpenVAS (free)
• Nessus (paid)
• Sucuri (for websites)

---

🔴 Mistake #4: Not encrypting sensitive data

Why is this a problem? Even with a European host, your data can be intercepted:

• In transit (e.g., during a transfer between servers).
• At rest (e.g., on a stolen hard drive).
• By a malicious employee (e.g., a system administrator).

Real-life example: In 2024, a Swiss clinic suffered a leak of medical data because its backups were not encrypted. Result: 10,000 patient files exposed and a fine of 1 million CHF.

How to avoid this mistake?

✅ Encrypt data in transit:

• HTTPS (SSL/TLS) for all websites (use Let’s Encrypt for free certificates).
• VPN for remote connections (e.g., ProtonVPN, Mullvad).
• SFTP/SSH for file transfers (instead of FTP).

✅ Encrypt data at rest:

• Hard drives: Use LUKS (Linux) or BitLocker (Windows).
• Databases: Native encryption (e.g., MySQL with AES_ENCRYPT, PostgreSQL with pgcrypto).
• Files: Tools like VeraCrypt or Cryptomator.

✅ End-to-end encryption for communications:

• Emails: ProtonMail, Tutanota
• Messaging: Signal, Matrix/Element
• Video conferencing: Jitsi Meet (self-hosted), BigBlueButton

---

🔴 Mistake #5: Not training your teams in cybersecurity

Why is this a problem? 90% of successful cyberattacks are due to human error (source: IBM Security Report 2025). Examples:

• An employee clicks on a phishing link.
• A weak password is used ("123456" or "password").
• A collaborator shares sensitive data via unsecured email.

Real-life example: In 2025, a Swiss bank fell victim to a phishing attack because an employee clicked on a fake "Microsoft Support" email. Result: access to 200 customer accounts and a loss of 5 million CHF.

How to avoid this mistake?

✅ Regularly train your teams:

• Practical workshops:
  • "How to recognize a phishing email?"
  • "How to create a secure password?"
  • "What to do in case of a data leak?"
• Training tools:
  • KnowBe4 (phishing simulations)
  • Cybersecurity Awareness Training (online courses)

✅ Implement strict policies:

• Passwords:
  • Minimum length: 12 characters.
  • Complexity: Uppercase, lowercase, numbers, symbols.
  • Password manager: Bitwarden, KeePass.
• Data access:
  • Principle of least privilege: Each employee only has access to the data they need.
  • Two-factor authentication (2FA): Mandatory for all accounts.

✅ Regularly test your teams:

• Phishing simulations: Send fake emails to see who clicks.
• Surprise audits: Check if passwords are secure.

---

📋 Checklist to avoid these mistakes in 2026

💡 Bonus: How to go further?

1. Conduct a comprehensive audit:
   • Use tools like SecurityHeaders.com to check the security of your site.
   • Hire a cybersecurity consultant (like numeric-sovereignty.org) for a personalized audit.
2. Create an incident response plan:
   • What to do in case of a data leak?
   • Who to contact (DPO, authorities, clients)?
   • How to limit the damage?
3. Subscribe to cybersecurity insurance:
   • Example: AXA Cyber Risk, Zurich Cyber Insurance.
   • Cost: 500–5000 CHF/year (depending on the company size).
4. Join communities:
   • Swiss Cyber Security Days
   • European Digital Rights (EDRi)
   • YouTube Channel "The Cyber Mentor"