Cinnamon Cloud · For Swiss banks and their vendors

Outsourcing from Switzerland, to FINMA rules.

The Cinnamon Cloud runs our own solutions, Cinnamon Core and Cinnamon Reporting, as a service. And it is open to anyone who must meet FINMA requirements when serving Swiss banks: software vendors, fintechs and specialised service providers.

FINMAmaterial outsourcing to FINMA rules
ISO 27001certified, renewed every year
SOC 2Type 2, renewed every year
24/7Security Operations Center
CHdata held in Switzerland

What the cloud is Get in touch

What it is

Swiss-based outsourcing to FINMA rules

Material outsourcing to FINMA rules: Our standard for outsourcing material functions of Swiss banks: the same security level for every bank.
ISO 27001: Information security, certified to ISO 27001:2022 and renewed every year.
SOC 2 Type 2: Operational controls, audited every year, that your auditors can follow.
Security Operations Center: Monitoring around the clock, seven days a week.
Data held in Switzerland: Stored and processed on Microsoft Azure in the Switzerland North region, production geo-redundant.

We run the cloud ourselves, and the platform in it is developed by our parent company, bmpi AG.

Proof

Reviewed and approved by a cantonal bank

A Swiss cantonal bank has audited the Cinnamon Cloud and approved it to hold sensitive client data under FINMA’s outsourcing rules. The cloud is connected to the bank’s core banking system.

Reviewed by a Swiss cantonal bank
Approved for sensitive client data
Connected to the bank’s core banking system

Bank approval is the highest hurdle in this market. For you it means you do not start from zero, but in an environment that has already passed that audit.

In the standard

Security and evidence are included in the package

Platform

Microsoft Azure, Switzerland North region; production geo-redundant
Data residency in Switzerland, tenant separation, backup and archive
Network security with WAF, DDoS protection and private endpoints
Encryption at rest and in transit, managed keys

Security operations

Operation around the clock with on-call
Security Operations Center with SIEM; logs kept at least a year, immutable
Vulnerability and patch management
Identity and access management with access reviews

Evidence

ISO 27001 and SOC 2 Type 2, renewed every year
Annual penetration tests with retest
Security incident response with notification within 24 hours
ISMS and policies kept up to date

More evidence, when your bank asks for it

The security level is the same for every bank. What a bank requires beyond it is available as the Compliance & Governance add-on: compliance reporting to the bank, support through examinations by FINMA, the audit firm and internal audit, participation in your committees and extended security monitoring.

How it is built

Every client in an environment of its own

In the Cinnamon Cloud, clients share no runtime environment. Every client gets its own, separate for development, test and production, and everything in it is described as code.

An environment per client

Its own Kubernetes cluster (Azure Kubernetes Service), its own database server, its own key vault and its own storage
Development, test and production separate, each in its own Azure subscription and network range
Databases (PostgreSQL or MySQL), key vault and storage reachable only over the private network
Scales automatically with load; production on the AKS Standard tier with Microsoft’s availability SLA

Network and access

Network traffic is blocked until it is explicitly allowed, at two levels: subnet firewalls and network policies in the cluster
Web application firewall to the OWASP Core Rule Set that blocks rather than passes on failure; TLS 1.2 and 1.3 only
Administration only with a Microsoft Entra ID sign-in and through a jump host; local admin accounts are switched off
Privileged roles through Entra Privileged Identity Management, time-limited and separated by duty

Operations as code

Networks, clusters, databases and certificates come from versioned pipelines, not by hand
Every change to production is shown as a diff first and rolled out only after approval
Third-party container images only from our own registry mirror, pinned by digest, scanned with Trivy and with a bill of materials (SBOM)
Security patches for the clusters automatic; point-in-time restore of the databases as a pipeline

Every change is traceable: from the ticket through specification, tests and review to the architecture decision.

Connection to the bank

Connected to the core banking system, through a dedicated encrypted tunnel

The bank’s systems reach the Cinnamon Cloud through a dedicated site-to-site VPN, built zone-redundant. The bank allowlists a small, fixed set of addresses in its firewall, even where address ranges overlap. With dynamic routing where needed, and with client certificates for system interfaces.

IPsec with IKEv2, AES-256 and perfect forward secrecy
Fixed addresses for the bank’s firewall, by 1:1 NAT
Dynamic routing (BGP) where the bank needs it
No path from the bank’s network to administration or build

Who it is for

Built for our own service, open to others

For Cinnamon clients

Cinnamon Core and Cinnamon Reporting as a service, and the whole processing if you wish: we run the platform, the production runs and the interfaces.

Cinnamon SaaS →Cinnamon BPO →

For vendors serving banks

Software vendors, fintechs and specialised service providers who must run their solution to FINMA requirements for Swiss banks, and would rather not build a data centre to do it.

The third option

A lean alternative to the large providers

For hosting to FINMA requirements there are two large, established providers. Smaller vendors ask for a third option. The Cinnamon Cloud is that option: for agile vendors, with us at the table, the team that does both the platform and the operating.

What the Cinnamon Cloud is not

Not a hosting provider for core banking systems. The cloud runs solutions that connect to a core banking system, not the core banking system itself.

Next step

Does your operation fit the Cinnamon Cloud?

In half an hour we work out what you want to run, for which banks, and which evidence we bring to it.

Book a slot Request a conversation

Free slots in the calendar, no Microsoft account needed.

Opens your mail program with a prepared enquiry.

Or call us:+41 44 454 84 84

Your contact

Thomas Tscherrig

Cinnamon · bmpi AG