Sovereign S3 object storage in Switzerland: why move off AWS

Egress fees, nFADP and the CLOUD Act: why your AWS S3 storage costs more than advertised and exposes your data. Migrating to sovereign Swiss S3, explained.

AWS S3 advertises $0.023 per GB of storage. What Swiss companies discover after a few months of heavy use: egress fees at $0.09/GB often come to 3 or 4 times that. On 50 TB of active data with 15 TB of monthly outbound traffic, bandwidth alone passes $1,300/month, on a bill where storage accounts for only $1,150.

The problem does not stop at the budget. AWS is a US company subject to the CLOUD Act, which makes any use a transfer to a country without adequate protection under the Swiss nFADP, whichever AWS region you pick. Many Swiss companies run active S3 buckets without having put in place the three contractual obligations the nFADP requires in that case.

What AWS S3 really costs a Swiss company

AWS S3 pricing has four distinct cost lines (source: aws.eu/fr/s3/pricing, May 2026). S3 Standard storage is billed at $0.023/GB/month, or $23/TB. Egress to the internet is billed at $0.09/GB beyond the first 100 GB free each month. PUT requests cost $0.005 per 1,000 operations and GET requests $0.0004 per 1,000.

The trap is structural: storage is the visible cost shown on the landing page. Egress is the variable cost that follows real usage, and for any application serving content (web assets, exports, reports, analytics data) those outbound transfers add up fast. A team restoring a 10 TB backup pays $900 in egress alone.

* Figures based on aws.eu/fr/s3/pricing (May 2026), excluding GET/PUT requests and additional fees.

The financial cost is not the only issue to deal with.

The nFADP problem your AWS contract does not mention

AWS is a US company subject to the CLOUD Act. Storing data about Swiss individuals on AWS S3 is a transfer to a country without adequate protection under art. 16 nFADP, even when the bucket sits in eu-central-1 (Frankfurt) or any other European region. The physical location of the servers does not determine the jurisdiction that applies to the parent company.

That transfer is legally permitted, but it carries three obligations many Swiss companies have not yet met. First, a processing agreement compliant with art. 9 nFADP must be signed with AWS; the standard AWS Data Processing Addendum has to be checked clause by clause against Swiss specifics, not only against GDPR. Second, documented safeguards under art. 16 para. 2 nFADP must be established: adherence to the Swiss-U.S. Data Privacy Framework, or standard contractual clauses recognised by the FDPIC. Third, the company's record of processing activities must explicitly name "United States" as the recipient country, together with the corresponding safeguards. For a full account of the nFADP obligations tied to your cloud provider, our dedicated article covers these three points in detail.

When to migrate to sovereign Swiss S3, and when not to

Decision rule:

IF (personal data of Swiss residents) OR (regulated sector) OR (egress volume > 5 TB/month)
THEN → sovereign Swiss S3

IF (development workload with no sensitive data) AND (fully AWS-based team) AND (egress < 1 TB/month)
THEN → AWS S3 acceptable with an nFADP-compliant DPA in place

For most Swiss companies running S3 in production, the first criterion applies.

Migrating from AWS S3, three commands to start

Hikube's S3 API compatibility means existing tools work with no code change. Only the endpoint changes. Migration with rclone:

# 1. Configure rclone for Hikube S3
rclone config create hikube s3
provider Other
endpoint s3.hikube.cloud
access_key_id YOUR_ACCESS_KEY
secret_access_key YOUR_SECRET_KEY

# 2. Migrate a whole bucket
rclone sync s3:my-aws-bucket hikube:my-hikube-bucket
--progress
--transfers 16

# 3. Verify integrity
rclone check s3:my-aws-bucket hikube:my-hikube-bucket

Teams using the AWS CLI or the Python, Node or Go SDKs have a single parameter to change, the endpoint. PUT, GET, DELETE and LIST calls stay identical. No application code to rewrite.

Checking the transfer before you switch

S3 compatibility is not to be assumed. Before writing "only the endpoint changes" into a migration plan, verify it against your own calls: basic operations first, then the multipart transfer every tool uses past a few hundred megabytes, then whatever your case depends on, versioning, bucket policies, presigned URLs, notifications. The exact list of supported operations is not published: ask for it if your chain depends on a specific call. Product scope: S3 object storage.

Once the copy is running, five checks decide whether you can switch:

• The object count, compared on both sides, not the volume alone, a thousand missing small files do not show up in a terabyte total.
• The total size, as a second check, to catch truncated transfers.
• A full rclone check, which compares fingerprints rather than names.
• A real application read, have the application itself read an object, with its own credentials, not yours.
• Writes during the copy, identify and replay them, or announce a freeze window. Syncing live data always leaves a delta.

WORM and encryption do not replace each other. WORM mode prevents an object from being modified or deleted before its expiry, not even by an administrator: that is what makes an archive hold up and what protects it from ransomware that has the rights. Encryption prevents reading. The two are orthogonal, and one does not excuse the other. Hikube object storage offers two WORM modes, governance and compliance; encryption details and service limits should be asked for before designing a chain that depends on either.

ROI over 12 months

A calculation on a typical profile, not a result measured at a customer. Redo it with your own volumes and egress before taking it to a committee.

Profile: an 80-person Swiss company, 50 TB of data on AWS S3 Standard in eu-central-1, 15 TB of monthly outbound traffic (reports, exports, application assets), in a sector subject to the nFADP.

* AWS, aws.eu/fr/s3/pricing (May 2026). Hikube: public pricing of 0.02 CHF/GB/month, with no claim of a public Hikube egress rate. AWS compliance cost is an estimate (DPA, external audit, record update).

The 12-month saving exceeds the cost of storage alone, because AWS egress is structurally more expensive than the storage itself under active production use. For companies who want to go further into sovereign cloud for Swiss companies, our reference article covers the legal, technical and operational dimensions.

Summary

Two reasons to review your S3 storage if you are in Switzerland: the real cost (AWS egress at $0.09/GB against a TCO line on the hyperscaler side, not a public Hikube egress rate; outbound traffic often exceeds storage under production use) and nFADP compliance (AWS = country without adequate protection, three contractual obligations to put in place). The migration takes three rclone commands. The ROI shows from the first month on egress volumes.

Your S3 data costs more, and risks more, than it appears. See our S3 Object Storage offering →