Compliance overview
This page explains how Boxium approaches compliant handling of physical archives. It is not legal advice. You remain responsible for determining what must be kept and for how long.
Want to sanity-check your current setup?
Records retention
GeBüV (high level)
Swiss law requires business records to be retained for defined periods: accounting records for 10 years (Art. 958f CO), medical records up to 20 years, VAT documents for immovable property for 20 years, and AML/KYC records for 10 years from end of business relationship.
In practice, that means:
- You must be able to produce records when requested
- Records must remain complete and unchanged
- Handling should be traceable (who had access, when)
What Boxium does operationally
- • Signed chain-of-custody protocol at pickup and retrieval
- • Registers boxes with barcodes in a restricted-access, logged facility
- • Returns boxes by request (per box, not per document)
- • Supports destruction (only with your written confirmation)
What you remain responsible for
- • Deciding what must be kept and for how long
- • Packing boxes so contents remain stable and identifiable
- • Confirming in writing before any destruction
Privacy
FADP/DSG (high level)
If archives contain personal data, you need to treat physical storage like a controlled process.
Operational expectations typically include:
- Controlled access
- Minimum necessary handling
- Traceability
- Subcontractor clarity (if used)
Boxium process posture
- Access is restricted and logged
- Handover is recorded at pickup and retrieval
- Subcontractors operate under documented instructions
Risk management
Typical pitfalls we avoid
"Self-storage" with no access logs or chain-of-custody
Informal pickup/return without written trace
Partial-box retrieval (high risk of loss and mix-ups)
Scanning promises that imply "certified copies" without a defined process
FAQ
Compliance questions
Does Boxium provide GeBüV certification?
We do not certify your compliance. We provide operational controls (chain-of-custody, access logging, retention handling) that support your compliance posture. You remain responsible for determining what must be kept and for how long.
Who decides when records can be destroyed?
You do. We only destroy when you confirm in writing that retention has ended and destruction is permitted. We never make retention decisions on your behalf.
Can I audit your storage facility?
Yes, by appointment. We can provide access logs and chain-of-custody records for your boxes on request.
What happens if a box is damaged?
We document condition at intake. Any damage discovered is logged and reported. Liability terms are defined in your service agreement.
Do you use subcontractors?
For specific steps like certified destruction, we may use vetted subcontractors under documented instructions. The subcontractor list is available on request.
How long do you keep access logs?
Access logs are retained for the duration of your service agreement plus a reasonable period for dispute resolution and legal obligations.